[wp-trac] [WordPress Trac] #24301: Unescaped user input in image preview

[WordPress Trac]

#24301: Unescaped user input in image preview
--------------------------+--------------------
 Reporter:  tollmanz      |       Owner:
     Type:  defect (bug)  |      Status:  new
 Priority:  high          |   Milestone:  3.6
Component:  Post Formats  |     Version:  trunk
 Severity:  major         |  Resolution:
 Keywords:  has-patch     |
--------------------------+--------------------
Changes (by SergeyBiryukov):

 * keywords:   => has-patch


Comment:

 Apart from a missing quote, it's also fairly easy to break the admin by
 inserting a closing `</div>` tag here.

 [attachment:24301.patch] adds `strip_tags( $value, '<img>' )`. It turned
 out that it also helps with the missing quote too, `strip_tags()` removes
 the broken markup.

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/24301#comment:6>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software