-
Notifications
You must be signed in to change notification settings - Fork 4.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Late escape comment blocks #37860
Late escape comment blocks #37860
Conversation
Looks like escaping has caused tests to fail. Perhaps I"m being over zealous here? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Edit: after the last review done by @swissspidy , it seems that it is not ready for approval 🙇🏻♂️
There are still changes required here.
@c4rl0sbr4v0 I've dismissed your review in order that this doens't get merged when it's not yet finished. Much appreciated. |
@swissspidy They changeset is now pretty limited. Let me know what you think. |
Thank your time and patience @swissspidy and @aristath. |
Description
This is not a security problem.
This PR simply moves escaping of all PHP output to be as "late" as possible. This means we avoid escaping variables until they are output in the HTML markup.
This is a WP Core best practice.
How has this been tested?
Check all comments blocks work "as was".
Check all tests continue to pass.
Screenshots
Types of changes
Checklist:
*.native.js
files for terms that need renaming or removal).