[wp-trac] [WordPress Trac] #27710: Playlist titles must be escaped or sanitized in templates

[WordPress Trac]

#27710: Playlist titles must be escaped or sanitized in templates
--------------------------+-------------------
 Reporter:  nacin         |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  high          |  Milestone:  3.9
Component:  Media         |    Version:  trunk
 Severity:  major         |   Keywords:
  Focuses:                |
--------------------------+-------------------
 [27868] escaped data.title in playlists. [27960] reverted it. However, it
 allows for XSS within the editor. Our rule, designed as defense-in-depth,
 is that even an admin with unfiltered HTML cannot cause admin-area XSS.

 We would have to go between {{ and {{{ based on is_admin(), I guess. I
 don't love that, either. It also means HTML will be represented as HTML
 rather than rendered (not a big deal). I don't know the solution for this.
 We can figure it out during 3.9 RC.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/27710>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform