WordPress.org
Get WordPress

Making WordPress.org

Changeset 15190


Ignore:
Timestamp:
09/11/2026 06:56:36 PM (9 days ago)
Author:
obenland
Message:

Escape the remaining output, clearing EscapeOutput

Closes ​https://github.com/WordPress/wordpress.org/pull/902.

Location:
sites/trunk
Files:
187 edited

Legend:

Unmodified
Added
Removed

  • sites/trunk/api.wordpress.org/public_html/core/browse-happy/1.0/index.php

    r13103 r15190  
    2727if ( $jsonp ) {
    2828        header( 'Access-Control-Allow-Origin: *' );
     29        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSONP or serialized PHP); escaping would corrupt the format.
    2930        echo $jsonp.'('.json_encode($data).')';
    3031} elseif ( defined( 'JSON_RESPONSE' ) ) {
    … …  
    3435} else {
    3536        header( 'Content-Type: text/plain' );
     37        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSONP or serialized PHP); escaping would corrupt the format.
    3638        echo serialize( $data );
    3739}

  • sites/trunk/api.wordpress.org/public_html/core/browse-happy/1.0/test.php

    r1 r15190  
    11<?php
    22
     3// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Standalone script; WordPress is never loaded here, so esc_html() does not exist.
    34echo htmlspecialchars( $_SERVER['HTTP_USER_AGENT'], ENT_QUOTES ) . "<br/><br/>";
    45
    … …  
    89
    910foreach ( $output as $k => $v )
     11        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Standalone script; WordPress is never loaded here, so esc_html() does not exist.
    1012        echo htmlspecialchars( $k . ' = ' . ( is_bool( $v ) ? (int) $v : $v ), ENT_QUOTES ) . "<br/>";

  • sites/trunk/api.wordpress.org/public_html/core/credits/wp-credits.php

    r15086 r15190  
    449449                        echo json_encode( $results );
    450450                } else {
     451                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (serialized PHP); escaping would corrupt the format.
    451452                        echo serialize( $results );
    452453                }

  • sites/trunk/api.wordpress.org/public_html/core/importers/1.0/index.php

    r13762 r15190  
    2222
    2323$response = array( 'importers' => $popular_importers, 'translated' => false );
     24// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON or serialized PHP); escaping would corrupt the format.
    2425echo defined( 'JSON_RESPONSE' ) ? json_encode( $response ) : serialize( $response );
    2526

  • sites/trunk/api.wordpress.org/public_html/core/serve-happy/1.0/index.php

    r13102 r15190  
    4444
    4545                echo '/**/' .
     46                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- JSONP callback name, restricted to [a-zA-Z0-9_.] inline.
    4647                        preg_replace('/[^a-zA-Z0-9_.]/', '', $_GET['callback'] ) .
     48                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- JSONP response body; json_encode() output, which an HTML escaper would corrupt.
    4749                        '(' . $json_data . ')';
    4850        } else {
    4951                call_headers( 'application/json' );
    5052
     53                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- JSON response body; json_encode() output, which an HTML escaper would corrupt.
    5154                echo $json_data;
    5255        }

  • sites/trunk/api.wordpress.org/public_html/dotorg/github/activity.php

    r11276 r15190  
    164164                if ( ! in_array( $payload->action, [ 'opened', 'edited', 'closed', 'deleted' ] ) ) {
    165165                        header( 'HTTP/1.0 422 Unprocessable Entity', true, 422 );
     166                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text webhook acknowledgement; the payload is signature-verified upstream.
    166167                        die( "NO; $event:{$payload->action} not required." );
    167168                }
    … …  
    216217                if ( ! in_array( $payload->action, [ 'opened', 'reopened', 'edited', 'closed' ] ) ) {
    217218                        header( 'HTTP/1.0 422 Unprocessable Entity', true, 422 );
     219                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text webhook acknowledgement; the payload is signature-verified upstream.
    218220                        die( "NO; $event:{$payload->action} not required." );
    219221                }

  • sites/trunk/api.wordpress.org/public_html/dotorg/helpscout/plugins-themes.php

    r14337 r15190  
    6767
    6868        if ( $post_ids ) {
    69                 echo '<p><strong>' . ucwords( $type ) . ' mentioned in this email:</strong></p>';
     69                echo '<p><strong>' . esc_html( ucwords( $type ) ) . ' mentioned in this email:</strong></p>';
    7070
    7171                display_items( $post_ids );
    … …  
    8585                if ( $items ) {
    8686                        $url = add_query_arg( [ 'post_type' => $repo_post_types[ $type ], 'author' => $user->ID ], admin_url( 'edit.php' ) );
    87                         echo '<p><strong><a href="' . esc_url( $url ) . '">' . ucwords( $type ) . ' owned by this user:</a></strong></p>';
     87                        echo '<p><strong><a href="' . esc_url( $url ) . '">' . esc_html( ucwords( $type ) ) . ' owned by this user:</a></strong></p>';
    8888
    8989                        display_items( $items );

  • sites/trunk/api.wordpress.org/public_html/dotorg/slack/community-deputies-calendly-webhook.php

    r15087 r15190  
    4141                        'The Calendly token has probably been revoked, the password was probably changed.' .
    4242                        'Please update the COMMUNITY_CALENDLY_TOKEN secrets constant with a new PAT created on https://calendly.com/integrations/api_webhooks from the WordCamp Calendly account.' .
     43                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Written to the error log by trigger_error(), not rendered.
    4344                        wp_remote_retrieve_body( $req ),
    4445                        E_USER_WARNING

  • sites/trunk/api.wordpress.org/public_html/dotorg/slack/props.php

    r12395 r15190  
    4141                        header( 'X-Slack-No-Retry', 1 ); // Don't retry this event again.
    4242                        trigger_error(
     43                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Written to the error log, or returned to Slack as the plain-text challenge response.
    4344                                sprintf( 'Received retry for %s because: %s', $message_id, $headers['X-Slack-Retry-Reason'] ),
    4445                                E_USER_NOTICE
    … …  
    5253
    5354        } catch ( Exception $exception ) {
     55                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Written to the error log, or returned to Slack as the plain-text challenge response.
    5456                trigger_error( $exception->getMessage(), E_USER_WARNING );
    5557
    … …  
    6062                 */
    6163                http_response_code( 200 );
     64                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Written to the error log, or returned to Slack as the plain-text challenge response.
    6265                die( $result );
    6366        }

  • sites/trunk/api.wordpress.org/public_html/dotorg/slack/security-team.php

    r15087 r15190  
    9696        }
    9797
     98        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text response listing usernames; the trailing newline is significant.
    9899        echo implode( "\n", $team ) . "\n"; // Trailing newline critical.
    99100        exit;

  • sites/trunk/api.wordpress.org/public_html/dotorg/trac/oembed/index.php

    r15149 r15190  
    160160$cache_key = sha1( $url );
    161161if ( $data = wp_cache_get( $cache_key, 'trac-oembed' ) ) {
     162        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- oEmbed response body (JSON or XML); escaping would corrupt the format.
    162163        die( $data );
    163164}
    … …  
    192193        $output = '<h1>Temporarily Unavailable</h1>';
    193194        wp_cache_set( $cache_key, $output, 'trac-oembed', MINUTE_IN_SECONDS );
     195        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- oEmbed response body (JSON or XML); escaping would corrupt the format.
    194196        die( $output );
    195197}
    … …  
    357359wp_cache_set( $cache_key, $data, 'trac-oembed', HOUR_IN_SECONDS );
    358360
     361// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- oEmbed response body (JSON or XML); escaping would corrupt the format.
    359362echo $data;

  • sites/trunk/api.wordpress.org/public_html/dotorg/trac/pr/class-trac.php

    r14781 r15190  
    149149
    150150                } elseif ( $json && isset( $json->error ) ) {
     151                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Trac API client; the message is caught by the calling method, not rendered.
    151152                        throw new \Exception( 'JSON Error: ' . $json->error->code . ' ' . $json->error->message );
    152153                } elseif ( ! $json ) {

  • sites/trunk/api.wordpress.org/public_html/themes/info/1.0/index.php

    r14891 r15190  
    3131        ) {
    3232                header( 'Content-Type: text/html; charset=utf-8' );
     33                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Themes API response body in the requested format; escaping would corrupt it.
    3334                die( "<p>{$error}</p>" );
    3435        }
    … …  
    4344
    4445        if ( 'php' === $format ) {
     46                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Themes API response body in the requested format; escaping would corrupt it.
    4547                echo serialize( $response );
    4648        } else {
    … …  
    141143$api->set_status_header();
    142144
     145// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Themes API response body in the requested format; escaping would corrupt it.
    143146echo $api->get_result( $format );
    144147

  • sites/trunk/api.wordpress.org/public_html/themes/info/1.1/index.php

    r14799 r15190  
    2121if ( $callback ) {
    2222        header( 'Content-Type: text/javascript; charset=UTF-8' );
     23        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Themes API response body (JSONP or JSON); escaping would corrupt the format.
    2324        echo "$callback($response);";
    2425} else {
    2526        header( 'Content-Type: application/json; charset=UTF-8' );
     27        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Themes API response body (JSONP or JSON); escaping would corrupt the format.
    2628        echo $response;
    2729}

  • sites/trunk/api.wordpress.org/public_html/themes/theme-directory/1.0/index.php

    r12632 r15190  
    3333        if ( $callback ) {
    3434                header( 'Content-Type:application/javascript; charset=' . get_option( 'blog_charset' ) );
     35                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Themes API response body (JSONP or JSON); escaping would corrupt the format.
    3536                echo "$callback( $json );";
    3637        } else {
    3738                header( 'Content-Type: application/json; charset=' . get_option( 'blog_charset' ) );
     39                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Themes API response body (JSONP or JSON); escaping would corrupt the format.
    3840                echo $json;
    3941        }

  • sites/trunk/api.wordpress.org/public_html/translations/plugins/1.0/index.php

    r10998 r15190  
    1414        if ( $$field && ! is_string( $$field ) ) {
    1515                header( $_SERVER['SERVER_PROTOCOL'] . ' 400 Bad Request' );
     16                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Field name comes from the literal list iterated above, not from the request.
    1617                die( "?{$field}= invalid." );
    1718        }

  • sites/trunk/api.wordpress.org/public_html/translations/themes/1.0/index.php

    r10998 r15190  
    1414        if ( $$field && ! is_string( $$field ) ) {
    1515                header( $_SERVER['SERVER_PROTOCOL'] . ' 400 Bad Request' );
     16                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Field name comes from the literal list iterated above, not from the request.
    1617                die( "?{$field}= invalid." );
    1718        }

  • sites/trunk/browsehappy.com/public_html/functions.php

    r15179 r15190  
    100100
    101101function browsehappy_echo_version( $browser ) {
    102         echo browsehappy_fetch_version( $browser );
     102        echo esc_html( browsehappy_fetch_version( $browser ) );
    103103}
    104104

  • sites/trunk/browsehappy.com/public_html/index.php

    r15179 r15190  
    4343                <ul id="browserlist" class="wrap">
    4444<?php foreach ( browsehappy_get_browser_data() as $browser => $data ) : ?>
    45                         <li id="<?php echo $browser; ?>">
     45                        <li id="<?php echo esc_attr( $browser ); ?>">
    4646                                <a href="<?php echo esc_url( $data->url ); ?>" title="<?php echo esc_attr( $data->long_name ); ?>">
    4747                                        <div class="icon"></div>
    48                                         <h2 lang="en"><?php echo $data->name; ?></h2>
    49                                         <p class="info"><?php echo $data->info; ?></p>
     48                                        <h2 lang="en"><?php echo esc_html( $data->name ); ?></h2>
     49                                        <p class="info"><?php echo esc_html( $data->info ); ?></p>
    5050                                        <?php /* translators: %s: Browser version. */ ?>
    5151                                        <p class="version"><?php printf( esc_html__( 'Latest Version: %s', 'browsehappy' ), '<strong>' . esc_html( apply_filters( 'get_browsehappy_version', $browser ) ) . '</strong>' ); ?></p>
    … …  
    5353                                </a>
    5454                                <?php do_action( 'browsehappy_browser_after', $browser ); ?>
    55                         </li><!-- #<?php echo $browser; ?> -->
     55                        </li><!-- #<?php echo esc_html( $browser ); ?> -->
    5656<?php endforeach; ?>
    5757                </ul><!-- #browserlist -->
    … …  
    6262                        <section id="about">
    6363                                <h2><?php esc_html_e( 'What is Browse Happy?', 'browsehappy' ); ?></h2>
    64                                 <p><?php $what = __( 'Using an outdated browser makes your computer unsafe. Browse Happy is a way for you to find out what are the latest versions of the major browsers around. You can also learn about alternative browsers that may fit you even better than the one you are currently using.', 'browsehappy' );
    65 echo $what; ?></p>
     64                                <?php $what = __( 'Using an outdated browser makes your computer unsafe. Browse Happy is a way for you to find out what are the latest versions of the major browsers around. You can also learn about alternative browsers that may fit you even better than the one you are currently using.', 'browsehappy' ); ?>
     65                                <p><?php echo esc_html( $what ); ?></p>
    6666                        </section><!-- #about -->
    6767                        <section id="share">
    … …  
    9191if ( isset( $_GET['locale'] ) )
    9292        $redirect_uri = add_query_arg( 'locale', urlencode( $_GET['locale'] ), $redirect_uri );
    93 $facebook_pieces = array(
    94         'app_id=180651631983617', // Browse Happy app
    95         'link=' . home_url( '/' ),
    96         'picture=' . get_template_directory_uri() . '/imgs/apple-touch-icon-114x114.png',
    97         'name=' . urlencode( __( 'Browse Happy', 'browsehappy' ) ),
    98         'description=' . urlencode( $what ),
    99         'message=' . urlencode( __( 'Online. Worry-free. Upgrade your browser today!', 'browsehappy' ) ),
    100         'display=popup',
    101         'redirect_uri=' . $redirect_uri,
     93
     94$facebook_args = array(
     95        'app_id'       => '180651631983617', // Browse Happy app.
     96        'link'         => home_url( '/' ),
     97        'picture'      => get_template_directory_uri() . '/imgs/apple-touch-icon-114x114.png',
     98        'name'         => __( 'Browse Happy', 'browsehappy' ),
     99        'description'  => $what,
     100        'message'      => __( 'Online. Worry-free. Upgrade your browser today!', 'browsehappy' ),
     101        'display'      => 'popup',
     102        'redirect_uri' => $redirect_uri,
    102103);
     104
     105// add_query_arg() leaves the values it is given alone, so they are encoded here.
     106$facebook_url = add_query_arg( rawurlencode_deep( $facebook_args ), 'https://www.facebook.com/dialog/feed' );
    103107?>
    104                                                 <li class="facebook"><a onclick="window.open(this.href, 'fbshare', 'status=0,toolbar=0,location=0,menubar=0,directories=0,resizable=0,scrollbars=0,height=325,width=540'); return false;" href="https://www.facebook.com/dialog/feed?<?php echo implode( '&', $facebook_pieces ); ?>" title="<?php esc_attr_e( 'Share on Facebook', 'browsehappy' ); ?>">Facebook</a></li>
     108                                                <li class="facebook"><a onclick="window.open(this.href, 'fbshare', 'status=0,toolbar=0,location=0,menubar=0,directories=0,resizable=0,scrollbars=0,height=325,width=540'); return false;" href="<?php echo esc_url( $facebook_url ); ?>" title="<?php esc_attr_e( 'Share on Facebook', 'browsehappy' ); ?>">Facebook</a></li>
    105109                                        </ul>
    106110                                </nav>

  • sites/trunk/buddypress.org/public_html/wp-content/themes/bb-base/functions.php

    r15188 r15190  
    425425 */
    426426function bb_base_homepage_topics( $args = false ) {
     427        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Buffered bbPress loop-topics template part; escaping would print the rendered markup.
    427428        echo bb_base_get_homepage_topics( $args );
    428429}
    … …  
    497498 */
    498499function bb_base_support_topics() {
     500        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Buffered bbPress content-archive-topic template part; escaping would print the rendered markup.
    499501        echo bb_base_get_support_topics();
    500502}

  • sites/trunk/common/includes/profiles/profiles.php

    r12255 r15190  
    6767        } finally {
    6868                if ( $error ) {
     69                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Written to the error log by trigger_error(), not rendered.
    6970                        trigger_error( $error, E_USER_WARNING );
    7071                }

  • sites/trunk/common/includes/slack/announce/lib.php

    r14899 r15190  
    108108                $channels = array_filter( $channels, function( $c ) use ( $channel ) { return $c !== $channel; } );
    109109                if ( $channels ) {
     110                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text response body, not HTML.
    110111                        printf( "You are allowed to use these commands in #%s (also %s).", $channel, '#' . implode( ' #', $channels ) );
    111112                } else {
     113                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text response body, not HTML.
    112114                        echo "You are allowed to use these commands in in #$channel.";
    113115                }
    114116        } else {
     117                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text response body, not HTML.
    115118                printf( "You are not allowed to use these commands in #%s, but you are in #%s.", $channel, implode( ' #', $channels ) );
    116119        }
    … …  
    118121        echo "\n";
    119122
     123        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text response body, not HTML.
    120124        printf( "If you are a team lead and need to be granted access, contact an admin in <#%s|%s> for assistance.\n", SLACKHELP_CHANNEL_ID, SLACKHELP_CHANNEL_NAME );
     125        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text response body, not HTML.
    121126        printf( "Your linked WordPress.org account that needs to be granted access is '%s'.", $user );
    122127}
    … …  
    256261
    257262        if ( str_word_count( $data['text'] ) <= 2 ) {
     263                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text response body, not HTML.
    258264                printf( "When making announcements, please use a descriptive message for notifications. %s is too short.", $data['text'] );
    259265                return;

  • sites/trunk/common/includes/slack/props/lib.php

    r12396 r15190  
    2323        // Don't throw if a recipient lookup fails, since we still want other recipients to get props.
    2424        if ( empty( $giver_user ) ) {
     25                // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Slack request handler; the message is returned to Slack as plain text, not rendered as HTML.
    2526                throw new Exception( 'w.org user lookup for slack ID '. $request->event->user .' failed' );
    2627        }
    … …  
    240241                $success = false;
    241242
     243                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text response body, not HTML.
    242244                trigger_error( 'Adding activity failed with error: ' . $response_body, E_USER_WARNING );
    243245        }

  • sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

    r14486 r15190  
    291291                                        '<meta http-equiv="refresh" content="1;url=%1$s" />' .
    292292                                        '<a href="%1$s">%1$s</a>',
     293                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Escaped above, with a fallback for environments without WordPress helpers.
    293294                                        $to
    294295                                );

  • sites/trunk/common/includes/wporg-sso/wp-plugin.php

    r15178 r15190  
    607607                                        sprintf(
    608608                                                "<h1>Logged in!</h1><p>You are currently logged in as <code>%s</code>.</p><p><a href='%s'>Would you like to logout?</a>",
    609                                                 wp_get_current_user()->user_login,
     609                                                esc_html( wp_get_current_user()->user_login ),
    610610                                                esc_url( wp_logout_url() )
    611611                                        )

  • sites/trunk/environments/plugin-directory/bin/import-plugins.php

    r14720 r15190  
    223223
    224224foreach ( $browse_sections as $section ) {
     225        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI import progress written to the console, not HTML.
    225226        echo "Fetching plugins in '{$section}' section...\n";
    226227
    … …  
    240241                $missing = array_diff( $batch, array_keys( $batch_data ) );
    241242                if ( $missing ) {
     243                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI import progress written to the console, not HTML.
    242244                        echo "  Skipped (not found): " . implode( ', ', $missing ) . "\n";
    243245                }
    … …  
    256258                if ( $existing ) {
    257259                        wp_set_object_terms( $existing[0]->ID, $section, 'plugin_section', true );
     260                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI import progress written to the console, not HTML.
    258261                        echo "    {$slug}... {$existing[0]->post_title} (tagged)\n";
    259262                }
    … …  
    267270                }
    268271
     272                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI import progress written to the console, not HTML.
    269273                echo "    {$slug}...";
    270274
    … …  
    277281                wp_set_object_terms( $post->ID, $section, 'plugin_section', true );
    278282                $imported_slugs[] = $slug;
     283                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI import progress written to the console, not HTML.
    279284                echo " {$post->post_title} (done)\n";
    280285                $imported++;
    281286        }
    282287
     288        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI import progress written to the console, not HTML.
    283289        echo "  {$section}: {$imported} new, " . count( $existing_slugs ) . " tagged.\n\n";
    284290}

  • sites/trunk/global.wordpress.org/public_html/wp-content/mu-plugins/downloads/rosetta-downloads.php

    r15188 r15190  
    173173                                                </td>
    174174                                        </tr>
    175                                         <?php echo implode( "\n", $rows ); ?>
     175                                        <?php echo implode( "\n", $rows ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Table row markup assembled above from escaped parts. ?>
    176176                                </tbody>
    177177

  • sites/trunk/global.wordpress.org/public_html/wp-content/mu-plugins/roles/class-translation-editors-list-table.php

    r15179 r15190  
    271271                        ?>
    272272                        <label class="screen-reader-text" for="cb-select-<?php echo (int) $user->ID; ?>"><?php esc_html_e( 'Select translation editor', 'rosetta' ); ?></label>
    273                         <input id="cb-select-<?php echo $user->ID; ?>" type="checkbox" name="translation-editors[]" value="<?php echo $user->ID; ?>">
     273                        <input id="cb-select-<?php echo (int) $user->ID; ?>" type="checkbox" name="translation-editors[]" value="<?php echo (int) $user->ID; ?>">
    274274                        <?php
    275275                }
    … …  
    297297                }
    298298
     299                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Avatar and edit-link markup assembled above from escaped parts.
    299300                echo "$avatar $edit";
    300301        }
    … …  
    306307         */
    307308        public function column_name( $user ) {
    308                 echo "$user->first_name $user->last_name";
     309                echo esc_html( "$user->first_name $user->last_name" );
    309310        }
    310311
    … …  
    315316         */
    316317        public function column_email( $user ) {
    317                 echo "<a href='" . esc_url( "mailto:$user->user_email" ) . "'>$user->user_email</a>";
     318                printf( '<a href="%1$s">%2$s</a>', esc_url( "mailto:$user->user_email" ), esc_html( $user->user_email ) );
    318319        }
    319320
    … …  
    361362                }
    362363
     364                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Project links are assembled above from escaped URLs and names.
    363365                echo implode( '<br>', $projects );
    364366        }

  • sites/trunk/global.wordpress.org/public_html/wp-content/mu-plugins/roles/views/cross-locale-pte.php

    r15179 r15190  
    1212        </h2>
    1313
    14         <?php echo $feedback_message; ?>
     14        <?php echo $feedback_message; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Notice markup assembled by get_feedback_message() from escaped parts. ?>
    1515
    1616        <p><?php esc_html_e( 'This is the list of our current Cross-Locale PTEs.', 'rosetta' ); ?></p>

  • sites/trunk/global.wordpress.org/public_html/wp-content/mu-plugins/roles/views/edit-cross-locale-pte.php

    r15179 r15190  
    1010        <h2><?php esc_html_e( 'Edit Cross-Locale PTE', 'rosetta' ); ?></h2>
    1111
    12         <?php echo $feedback_message; ?>
     12        <?php echo $feedback_message; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Notice markup assembled by get_feedback_message() from escaped parts. ?>
    1313
    1414        <p><?php
    … …  
    1717                        esc_html__( 'You are currently editing the user %s.', 'rosetta' ),
    1818                        sprintf( '<a href="%1$s">%2$s</a>',
    19                                 'https://profiles.wordpress.org/' . $user->user_nicename . '/',
    20                                 $user->user_login
     19                                esc_url( 'https://profiles.wordpress.org/' . $user->user_nicename . '/' ),
     20                                esc_html( $user->user_login )
    2121                        )
    2222                );

  • sites/trunk/global.wordpress.org/public_html/wp-content/mu-plugins/roles/views/edit-translation-editor.php

    r15179 r15190  
    1010        <h2><?php esc_html_e( 'Edit Translation Editor', 'rosetta' ); ?></h2>
    1111
    12         <?php echo $feedback_message; ?>
     12        <?php echo $feedback_message; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Notice markup assembled by get_feedback_message() from escaped parts. ?>
    1313
    1414        <p><?php
    … …  
    1818                        esc_html__( 'You are currently editing the user %s.', 'rosetta' ),
    1919                        sprintf( '<a href="%1$s">%2$s</a>',
    20                                 'https://profiles.wordpress.org/' . $user->user_nicename . '/',
    21                                 $user->user_login
     20                                esc_url( 'https://profiles.wordpress.org/' . $user->user_nicename . '/' ),
     21                                esc_html( $user->user_login )
    2222                        )
    2323                );

  • sites/trunk/global.wordpress.org/public_html/wp-content/mu-plugins/roles/views/translation-editors.php

    r15179 r15190  
    1111        </h2>
    1212
    13         <?php echo $feedback_message; ?>
     13        <?php echo $feedback_message; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Notice markup assembled by get_feedback_message() from escaped parts. ?>
    1414
    1515        <form method="get">

  • sites/trunk/global.wordpress.org/public_html/wp-content/mu-plugins/showcase/rosetta-showcase.php

    r15179 r15190  
    209209                                        /* translators: %s: post title */
    210210                                        esc_attr( sprintf( __( '&#8220;%s&#8221; (Edit)', 'rosetta' ), $title ) ),
     211                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Title markup assembled above from escaped parts.
    211212                                        $title
    212213                                );

  • sites/trunk/global.wordpress.org/public_html/wp-content/themes/rosetta/download.php

    r15179 r15190  
    2525                        <h3 id="latest"><?php esc_html_e( 'Latest release', 'rosetta' ); ?></h3>
    2626                        <table class="releases latest">
    27                                 <?php echo rosetta_release_row( $releases['latest'], 'alt' ); ?>
     27                                <?php echo rosetta_release_row( $releases['latest'], 'alt' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Release table row markup assembled by rosetta_release_row(). ?>
    2828                        </table>
    2929<?php

  • sites/trunk/global.wordpress.org/public_html/wp-content/themes/rosetta/footer.php

    r11495 r15190  
    44__('Code is Poetry.', 'rosetta');
    55
     6// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    67echo do_blocks( '<!-- wp:wporg/global-footer /-->' );

  • sites/trunk/global.wordpress.org/public_html/wp-content/themes/rosetta/front-page.php

    r15179 r15190  
    99                        <div class="section">
    1010                                <div class="col-12" role="main">
    11                                         <h3>The <?php echo $rosetta->rosetta->get_glotpress_locale()->english_name; ?> translation of WordPress is inactive</h3>
     11                                        <h3>The <?php echo esc_html( $rosetta->rosetta->get_glotpress_locale()->english_name ); ?> translation of WordPress is inactive</h3>
    1212                                        <p><a href="https://wordpress.org/download/">Download the English version instead</a>.</p>
    13                                         <p>If you&#8217;re interested in translating WordPress to <?php echo $rosetta->rosetta->get_glotpress_locale()->english_name; ?>,
     13                                        <p>If you&#8217;re interested in translating WordPress to <?php echo esc_html( $rosetta->rosetta->get_glotpress_locale()->english_name ); ?>,
    1414                                        join <a href="https://make.wordpress.org/polyglots/">the Polyglots team</a> and find out how.</p>
    1515                                </div>
    … …  
    3333                                        printf(
    3434                                                '<img class="shot" %ssrc="%s" alt="" />',
     35                                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Image dimension attribute pair built above from the image size.
    3536                                                $hw,
    3637                                                esc_url( $header_image )

  • sites/trunk/global.wordpress.org/public_html/wp-content/themes/rosetta/header.php

    r11495 r15190  
    1616}
    1717
     18// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    1819echo do_blocks( '<!-- wp:wporg/global-header /-->' );

  • sites/trunk/global.wordpress.org/public_html/wp-content/themes/rosetta/inc/template-tags.php

    r15188 r15190  
    2323                /* translators: 1: post date 2: post author */
    2424                esc_html__( 'Posted on %1$s by %2$s.', 'rosetta' ),
     25                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Date, author and category markup assembled above from escaped parts.
    2526                $time_string,
     27                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Date, author and category markup assembled above from escaped parts.
    2628                $author_string
    2729        );
    … …  
    3840                        /* translators: %s: list of categories */
    3941                        esc_html__( 'Filed under %s.', 'rosetta' ),
     42                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Date, author and category markup assembled above from escaped parts.
    4043                        $categories_string
    4144                );

  • sites/trunk/jobs.wordpress.net/public_html/wp-content/plugins/jobswp/jobswp-template.php

    r15179 r15190  
    115115                </div>';
    116116
     117        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Field and help-text markup assembled by the template helpers.
    117118        echo $output;
    118119}
    … …  
    149150
    150151        if ( $help_text ) {
     152                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Field and help-text markup assembled by the template helpers.
    151153                echo '<div class="job-help-text">' . $help_text . "</div>\n";
    152154        }

  • sites/trunk/jobs.wordpress.net/public_html/wp-content/plugins/jobswp/jobswp.php

    r15185 r15190  
    431431                        return;
    432432
     433                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Close-link markup assembled by _get_close_link().
    433434                echo $this->_get_close_link( $post, 'button button-large alignright' );
    434435        }

  • sites/trunk/jobs.wordpress.net/public_html/wp-content/themes/jobswp/content-list.php

    r15179 r15190  
    77
    88                        $evenodd = abs( $evenodd - 1 );
    9                         echo '<div class="row row-'. $evenodd . '">';
     9                        echo '<div class="row row-' . esc_attr( $evenodd ) . '">';
    1010
    1111                        echo '<div class="job-date">' . get_the_date( 'M j' ) . '</div>';
    … …  
    1313                        echo '<a href="'; the_permalink(); echo '" rel="bookmark">'; the_title(); echo '</a></div>';
    1414                        echo '<div class="job-type">';
    15                         echo jobswp_get_job_meta( get_the_ID(), 'jobtype' );
     15                        echo esc_html( jobswp_get_job_meta( get_the_ID(), 'jobtype' ) );
    1616                        echo '</div>';
    1717                        echo '<div class="job-location">';
    18                         echo jobswp_get_job_meta( get_the_ID(), 'location' );
     18                        echo esc_html( jobswp_get_job_meta( get_the_ID(), 'location' ) );
    1919                        echo '</div>';
    2020

  • sites/trunk/jobs.wordpress.net/public_html/wp-content/themes/jobswp/inc/template-tags.php

    r15179 r15190  
    3131
    3232        ?>
    33         <nav role="navigation" id="<?php echo esc_attr( $nav_id ); ?>" class="<?php echo $nav_class; ?>">
     33        <nav role="navigation" id="<?php echo esc_attr( $nav_id ); ?>" class="<?php echo esc_attr( $nav_class ); ?>">
    3434                <h1 class="screen-reader-text"><?php esc_html_e( 'Post navigation', 'jobswp' ); ?></h1>
    3535

  • sites/trunk/phpcs.xml.dist

    r15179 r15190  
    2121        <exclude-pattern>*/plugins/theme-directory/lib/*</exclude-pattern>
    2222        <exclude-pattern>*/plugins/wpf-stripe/stripe-php/*</exclude-pattern>
     23        <!-- Near-verbatim copy of vendor/google/cloud-storage/src/StreamWrapper.php; kept diffable against upstream. -->
     24        <exclude-pattern>*/plugins/photo-directory/inc/google-cloud-storage-stream-metadata.php</exclude-pattern>
    2325
    2426        <!-- Exclude generated wp-scripts asset files. -->
    … …  
    150152                                <!-- Returns selected() markup or an esc_attr()'d value attribute; see jobs.wordpress.net plugins/jobswp/jobswp-template.php. -->
    151153                                <element value="jobswp_field_value"/>
     154                                <!-- Returns esc_html( $text ); see themes/pub/wporg-main/functions.php. -->
     155                                <element value="esc_html___"/>
    152156                        </property>
    153157                </properties>

  • sites/trunk/profiles.wordpress.org/public_html/wp-content/plugins/wporg-profiles-activity-handler/wporg-profiles-activity-handler.php

    r15126 r15190  
    188188
    189189                        if ( $missing ) {
     190                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text API response, or written to the error log.
    190191                                die( '-1 Required argument(s) are missing: ' . implode( ', ', $missing ) );
    191192                        }
    … …  
    214215                                        $status = $result->get_error_data()['status'] ?? 500;
    215216                                        status_header( $status );
     217                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text API response, or written to the error log.
    216218                                        trigger_error( $result->get_error_message(), E_USER_WARNING );
     219                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text API response, or written to the error log.
    217220                                        die( '-1 ' . $result->get_error_message() );
    218221                                }
    … …  
    221224                        } catch ( Exception $exception ) {
    222225                                status_header( 500 );
     226                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text API response, or written to the error log.
    223227                                trigger_error( $exception->getMessage(), E_USER_WARNING );
     228                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text API response, or written to the error log.
    224229                                die( '-1 ' . $exception->getMessage() );
    225230                        }
    … …  
    381386
    382387                        if ( ! $user ) {
     388                                // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Plain-text API response; the interpolated user ID is intval()'d above.
    383389                                throw new Exception( '-1 Activity reported for unrecognized user ID: ' . $activity['user_id'] );
    384390                        }

  • sites/trunk/profiles.wordpress.org/public_html/wp-content/plugins/wporg-profiles-association-handler/wporg-profiles-association-handler.php

    r15026 r15190  
    180180                                $status = $result->get_error_data()['status'] ?? 500;
    181181                                status_header( $status );
     182                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text API response, or written to the error log.
    182183                                die( '-1 ' . $result->get_error_message() );
    183184                        }

  • sites/trunk/profiles.wordpress.org/public_html/wp-content/plugins/wporg-profiles-profile-handler/wporg-profiles-handler.php

    r15026 r15190  
    5555                                $status = $result->get_error_data()['status'] ?? 500;
    5656                                status_header( $status );
     57                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text API response, or written to the error log.
    5758                                trigger_error( $result->get_error_message(), E_USER_WARNING );
     59                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text API response, or written to the error log.
    5860                                die( '-1 ' . $result->get_error_message() );
    5961                        }
    … …  
    6264                } catch ( Exception $exception ) {
    6365                        status_header( 500 );
     66                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text API response, or written to the error log.
    6467                        trigger_error( $exception->getMessage(), E_USER_WARNING );
     68                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text API response, or written to the error log.
    6569                        die( '-1 ' . $exception->getMessage() );
    6670                }

  • sites/trunk/trac.wordpress.org/bin/mysql-migrate.php

    r155 r15190  
    5555}
    5656
     57// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI migration progress written to the console, not HTML.
    5758echo "Done. " . ( microtime( true ) - $start ) . " seconds.\n";
    5859

  • sites/trunk/trac.wordpress.org/bin/sqlite-migrate.php

    r3595 r15190  
    6565        $query = $sqlite->prepare( $sql );
    6666        $results = $mysql->get_results( "SELECT * FROM $table" );
     67        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI migration progress written to the console, not HTML.
    6768        printf( "Processing $table with %d results.\n", count( $results ) );
    6869
    … …  
    8384}
    8485
     86// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI migration progress written to the console, not HTML.
    8587echo "Done.. " . ( microtime( true ) - $start ) . " seconds.\n";
    8688

  • sites/trunk/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-redirects.php

    r14971 r15190  
    273273                // Headers should not have been sent at this point in time.
    274274                // On some pages, such as wp-cron.php the request has been terminated prior to WordPress loading, and so headers were "sent".
    275                 echo "<a href='$location'>$location</a>";
     275                printf( '<a href="%1$s">%2$s</a>', esc_url( $location ), esc_html( $location ) );
    276276        }
    277277        exit;

  • sites/trunk/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-seo/robots.php

    r9861 r15190  
    2929                }
    3030
    31                 echo '<meta name="robots" content="' . $noindex . '" />' . "\n";
     31                echo '<meta name="robots" content="' . esc_attr( $noindex ) . '" />' . "\n";
    3232        }
    3333}

  • sites/trunk/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-well-known.php

    r13988 r15190  
    4040        ?>
    4141Contact: https://hackerone.com/wordpress
    42 Expires: <?php echo gmdate( 'Y-m-d', $expires ); ?>T15:00:00.000Z
     42Expires: <?php echo esc_html( gmdate( 'Y-m-d', $expires ) ); ?>T15:00:00.000Z
    4343Acknowledgments: https://hackerone.com/wordpress/thanks
    4444Canonical: https://wordpress.org/.well-known/security.txt

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/handbook/inc/admin-notices.php

    r15179 r15190  
    8888                                /* translators: 1: example landing page title that includes post type name, 2: comma-separated list of acceptable post slugs */
    8989                                wp_kses_post( __( '<strong>Welcome to your new handbook!</strong> It is recommended that the first post you create is the landing page for the handbook. You can title it anything you like (suggestions: <code>%1$s</code> or <code>Welcome</code>). However, you must ensure that it has one of the following slugs: %2$s. The slug will ultimately be omitted from the page&#8216;s permalink URL, but will still appear in the permalinks for sub-pages.', 'wporg' ) ),
    90                                 WPorg_Handbook::get_name( $current_screen->post_type ),
     90                                esc_html( WPorg_Handbook::get_name( $current_screen->post_type ) ),
     91                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Slug list is deliberately <code>-wrapped markup, built above.
    9192                                implode( ', ', $suggested_slugs )
    9293                        );
    … …  
    128129                        /* translators: 1: example landing page title that includes post type name, 2: comma-separated list of acceptable post slugs */
    129130                        wp_kses_post( __( '<strong>Warning:</strong> A landing page for this handbook has not been created or is not published. You can title it anything you like (suggestions: <code>%1$s</code> or <code>Welcome</code>). However, you must ensure that it has one of the following slugs: %2$s. The slug will ultimately be omitted from the page&#8216;s permalink URL, but will still appear in the permalinks for its sub-pages. Without this page your handbook&#8216;s URL will show a seemingly random handbook page.', 'wporg' ) ),
    130                         WPorg_Handbook::get_name( $handbook_post_type ),
     131                        esc_html( WPorg_Handbook::get_name( $handbook_post_type ) ),
     132                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Slug list is deliberately <code>-wrapped markup, built above.
    131133                        implode( ', ', $suggested_slugs )
    132134                );
    … …  
    174176                                /* translators: 1: URL to remote manifest. 2: cron interval. */
    175177                                wp_kses_post( __( '<strong>This is an imported handbook!</strong> This handbook is imported according to a <a href="%1$s">remote manifest</a>. Any local changes will be overwritten during the next import, so make any changes at the remote location. Import interval: <strong>%2$s</strong>.', 'wporg' ) ),
    176                                 $handbook_config['manifest'],
    177                                 $interval_display
     178                                esc_url( $handbook_config['manifest'] ),
     179                                esc_html( $interval_display )
    178180                        );
    179181                        echo "</p></div>\n";
    … …  
    225227                                /* translators: %s: cron interval. */
    226228                                wp_kses_post( __( '<strong>Misconfigured cron interval!</strong> This imported handbook has a misconfigured cron interval. The config defines an interval of <strong>%s</strong>, which has not been defined. The fallback import interval shown in a notice above includes the default cron interval currently in use.', 'wporg' ) ),
    227                                 $interval_display
     229                                esc_html( $interval_display )
    228230                        );
    229231                        echo "</p></div>\n";

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/handbook/inc/glossary.php

    r9331 r15190  
    116116
    117117        static function page_content() {
     118                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Shortcode output rendered by the handbook glossary.
    118119                echo self::shortcode();
    119120        }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/handbook/inc/widgets.php

    r15179 r15190  
    5252                ?>
    5353                <p>
    54                         <input class="widefat" id="<?php echo esc_attr( $this->get_field_id('show_home') ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'show_home' ) ); ?>" type="checkbox" value="1" <?php echo $checked ?> />
     54                        <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'show_home' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'show_home' ) ); ?>" type="checkbox" value="1" <?php echo $checked; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Widget form markup with the escaped field ids assembled on the same line. ?> />
    5555                        <label for="<?php echo esc_attr( $this->get_field_id( 'show_home' ) ); ?>"><?php esc_html_e( 'List the home page', 'wporg' ); ?></label>
    5656                </p>

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/handbook/phpunit/bootstrap.php

    r15020 r15190  
    2525
    2626if ( ! file_exists( $_tests_dir . '/includes/functions.php' ) ) {
     27        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Test bootstrap console output, not HTML.
    2728        echo "Could not find $_tests_dir/includes/functions.php\n";
    2829        exit( 1 );

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/official-wordpress-events/official-wordpress-events.php

    r15170 r15190  
    551551                if ( ! $successful_response || ! $body_is_valid ) {
    552552                        trigger_error(
     553                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Written to the error log, not rendered.
    553554                                "This function had to abort because the request failed. If it didn't, it would mark scheduled events as postponed. Failed response: " . var_export( $response, true ),
    554555                                E_USER_WARNING
    … …  
    889890                                __METHOD__,
    890891                                esc_html( parse_url( site_url(), PHP_URL_HOST ) ),
     892                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Written to the error log, not rendered.
    891893                                sanitize_text_field( $error )
    892894                        ), E_USER_WARNING );
    … …  
    924926
    925927                if ( 'cli' === php_sapi_name() ) {
     928                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI console output; the guard above restricts this to php_sapi_name() === 'cli'.
    926929                        echo "\n" . $message;
    927930                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/phpunit-test-reporter/parts/result-set-all.php

    r14061 r15190  
    22use PTR\Display;
    33
     4// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Display::get_display_css() returns the report stylesheet.
    45echo Display::get_display_css(); ?>
    56
    … …  
    2627            href="<?php echo esc_url( sprintf( 'https://core.trac.wordpress.org/changeset/%d', $rev_id ) ); ?>"
    2728            title="<?php echo esc_attr( apply_filters( 'the_title', $revision->post_title ) ); ?>">
    28             r<?php echo $rev_id; ?>
     29                        r<?php echo esc_html( $rev_id ); ?>
    2930          </a>
    3031        </td>
    … …  
    3233        <td>
    3334            <span class="ptr-status-badge ptr-status-badge-passed">
    34                                 <?php echo $num_passed; ?>
     35                                        <?php echo (int) $num_passed; ?>
    3536            </span>
    3637        </td>
    3738        <td>
    3839            <span class="ptr-status-badge ptr-status-badge-failed">
    39                                 <?php echo $num_failed; ?>
     40                                        <?php echo (int) $num_failed; ?>
    4041            </span>
    4142        </td>

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/phpunit-test-reporter/parts/result-set-single.php

    r14061 r15190  
    22use PTR\Display;
    33
     4// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Display::get_display_css() returns the report stylesheet.
    45echo Display::get_display_css();
    56
    … …  
    1112<div class="ptr-test-reporter-single-revision">
    1213        <a href="<?php echo esc_url( sprintf( 'https://core.trac.wordpress.org/changeset/%d', $rev_id ) ); ?>">
    13                 r<?php echo $rev_id; ?>
     14                r<?php echo esc_html( $rev_id ); ?>
    1415        </a>: <?php echo esc_attr( apply_filters( 'the_title', $revision->post_title ) ); ?>
    1516</div>

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/phpunit-test-reporter/parts/single-result.php

    r15181 r15190  
    3131} ?>
    3232
    33 <?php echo Display::get_display_css(); ?>
     33<?php echo Display::get_display_css(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Display::get_display_css() returns the report stylesheet, and the link markup is built here. ?>
    3434
    3535<?php

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-support-reps.php

    r6287 r15190  
    108108                $result = Tools::remove_plugin_support_rep( $plugin_slug, $support_rep );
    109109
    110                 wp_die( $result );
     110                wp_die( esc_html( $result ) );
    111111        }
    112112}

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-locale-banner.php

    r14686 r15190  
    212212                        header( 'Content-Type: text/plain' );
    213213                        if ( ! empty( $result['suggest_string'] ) ) {
    214                                 echo '<p>' . $result['suggest_string'] . '</p>';
     214                                echo '<p>' . wp_kses_post( $result['suggest_string'] ) . '</p>';
    215215                        }
    216216

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin-blueprint.php

    r14575 r15190  
    8484
    8585                // We already have a json string, returning would double-encode it.
    86                 die( $blueprint['contents'] );
     86                die( $blueprint['contents'] ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Blueprint JSON served to WordPress Playground; escaping would corrupt it.
    8787        }
    8888
    … …  
    115115                                                if ( $output ) {
    116116                                                        header( 'Access-Control-Allow-Origin: https://playground.wordpress.net' );
     117                                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Blueprint JSON served to WordPress Playground; escaping would corrupt it.
    117118                                                        die( $output );
    118119                                                }
    … …  
    136137                                        if ( $output ) {
    137138                                                header( 'Access-Control-Allow-Origin: https://playground.wordpress.net' );
     139                                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Blueprint JSON served to WordPress Playground; escaping would corrupt it.
    138140                                                die( $output );
    139141                                        }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin.php

    r15179 r15190  
    400400                                <div class="star-rating">
    401401                                <?php
    402                                         /* Core has .star-rating .star colour styling, which is why we use a custom wrapper and template */
    403                                         echo Template::dashicons_stars( array(
    404                                                 'rating'   => $review->post_rating,
    405                                                 'template' => '<span class="star %1$s"></span>',
    406                                         ) );
     402                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Core has .star-rating .star colour styling, so this uses a custom wrapper and template; dashicons_stars() returns that markup.
     403                                        echo Template::dashicons_stars(
     404                                                array(
     405                                                        'rating'   => (int) $review->post_rating,
     406                                                        'template' => '<span class="star %1$s"></span>',
     407                                                )
     408                                        );
    407409                                ?>
    408410                                </div>
    … …  
    423425                                        /* translators: 1: Review author, 2: Review date. */
    424426                                        esc_html__( 'By %1$s on %2$s', 'wporg-plugins' ),
     427                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Star and byline markup built by Template helpers from escaped values.
    425428                                        $review_author_markup,
     429                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Star and byline markup built by Template helpers from escaped values.
    426430                                        '<span class="review-date">' . date_i18n( get_option( 'date_format' ), strtotime( $review->post_modified ) ) . '</span>'
    427431                                );
    … …  
    430434                </div>
    431435        </div>
    432         <div class="review-body"><?php echo $review->post_content; ?></div>
     436        <div class="review-body"><?php echo wp_kses_post( $review->post_content ); ?></div>
    433437</div>
    434438<?php

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-svn-access.php

    r6287 r15190  
    4747                foreach ( $svn_access as $slug => $users ) {
    4848                        $slug = ltrim( $slug, '/' );
     49                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Generates SVN authz config text, not HTML.
    4950                        echo "\n[/$slug]\n";
    5051
    5152                        foreach ( $users as $user => $access ) {
     53                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Generates SVN authz config text, not HTML.
    5254                                echo "$user = $access\n";
    5355                        }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/bin/check-block.php

    r14987 r15190  
    7272        $plugin = get_post();
    7373
     74        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    7475        echo "Checking $plugin->post_name\n";
    7576
    … …  
    99100}
    100101
     102// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    101103echo "Good plugins:\n" . join( "\n", $good_plugins ) . "\n\n";
     104// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    102105echo "Problem plugins:\n" . join( "\n", $error_plugins ) . "\n\n";
    103106

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/bin/email-bulk-security-vulnerabilities.php

    r12763 r15190  
    229229        if ( ! $plugin ) {
    230230                $stats['error']++;
     231                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    231232                echo "ERROR: Plugin not found: $plugin_slug\n\n";
    232233                continue;
    … …  
    235236        if ( 'publish' != $plugin->post_status ) {
    236237                $stats['error']++;
     238                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    237239                echo "ERROR: Plugin not published: $plugin_slug\n\n";
    238240                continue;
    … …  
    267269                $body = str_replace( 'LINK<br /><br />DETAILS', '<pre>' . $vuln_desc . '</pre>', $body );
    268270
     271                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    269272                echo "Subject: $subject\n\n";
     273                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    270274                echo "To: $to\n";
     275                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    271276                echo "CC: $cc_list\n";
     277                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    272278                echo str_replace( "<br />", "\n", $body );
    273279
    … …  
    293299                $body = str_replace( 'REPORT<br /><br />OPTIONAL_ADDITIONAL', '<pre>' . $vuln_desc . '</pre>', $body );
    294300
     301                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    295302                echo "Subject: $subject\n\n";
     303                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    296304                echo "To: $to\n";
     305                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    297306                echo "CC: $cc_list\n";
     307                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    298308                echo str_replace( "<br />", "\n", $body );
    299309

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/bin/import-plugin-to-glotpress.php

    r6287 r15190  
    8686}
    8787
     88// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    8889echo "Processing I18N Import for $plugin_slug...\n";
    8990try {
    … …  
    121122        }
    122123
     124        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    123125        echo "OK. Took {$runtime}s\n";
    124126} catch ( Exception $e ) {
    … …  
    148150        }
    149151
     152        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    150153        echo "Failed. Took {$runtime}s\n";
    151154

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/bin/import-plugin.php

    r8728 r15190  
    6969
    7070        if ( is_wp_error( $create_result ) ) {
     71                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    7172                echo "Failed. {$plugin_slug} post was not be found, and failed to be created.\n";
    7273                fwrite( STDERR, "[{$plugin_slug}] Plugin Import Failed: " . $create_result->get_error_message() . "\n" );
    … …  
    7879if ( $opts['async'] ) {
    7980        Jobs\Plugin_Import::queue( $plugin_slug, array( 'tags_touched' => $changed_tags ) );
     81        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    8082        echo "Queueing Import for $plugin_slug... OK\n";
    8183        die();
    8284}
    8385
     86// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    8487echo "Processing Import for $plugin_slug... ";
    8588try {
    8689        $importer = new CLI\Import();
    8790        $importer->import_from_svn( $plugin_slug, $changed_tags );
     91        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    8892        echo 'OK. Took ' . round( microtime( 1 ) - $start_time, 2 ) . "s\n";
    8993} catch ( \Exception $e ) {
     94        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    9095        echo 'Failed. Took ' . round( microtime( 1 ) - $start_time, 2 ) . "s\n";
    9196

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/bin/process-blocks.php

    r9896 r15190  
    5252        $plugin = get_post();
    5353
     54        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    5455        echo $plugin->post_name;
    5556        echo "\n";
    … …  
    9394echo number_format( $count_with_files ) . " have asset files\n";
    9495echo "\n";
     96// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    9597echo "Plugins missing blocks:\n" . join( "\n", $plugins_missing_blocks ) . "\n\n";
     98// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    9699echo "Plugins missing assets:\n" . join( "\n", $plugins_missing_assets ) . "\n\n";

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/bin/quick-stats.php

    r6287 r15190  
    4343        foreach ( $top as $row ) {
    4444                // $vals = array_values( (array) $row );
    45                 echo $row[0] . "\t\t\t" . number_format( $row[1] ) . "\n";
     45                echo $row[0] . "\t\t\t" . number_format( $row[1] ) . "\n"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    4646        }
    4747
     48        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    4849        echo "Top $n Total: " . number_format( array_reduce( $top, __NAMESPACE__ . '\callback_sum' ) ) . "\n";
    4950
    5051        $tail_n = count( $tail );
     52        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    5153        echo "Other $tail_n: " . number_format( array_reduce( $tail, __NAMESPACE__ . '\callback_sum' ) ) . "\n";
    5254

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/bin/rebuild-update_source-table.php

    r7072 r15190  
    4646
    4747foreach ( $slugs as $i => $slug ) {
     48        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    4849        echo ++$i . '/' . count( $slugs ) . "\t" . $slug . "\n";
    4950

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/bin/rebuild-zip.php

    r15063 r15190  
    9797}
    9898
     99// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    99100echo "Rebuilding ZIPs for $plugin_slug... ";
    100101try {
    … …  
    123124        }
    124125
     126        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    125127        echo 'OK. Took ' . round( microtime( 1 ) - $start_time, 2 ) . "s\n";
    126128} catch ( Exception $e ) {
    127129        fwrite( STDERR, "{$plugin_slug}: Zip Rebuild failed: " . $e->getMessage() . "\n" );
     130        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    128131        echo 'Failed. Took ' . round( microtime( 1 ) - $start_time, 2 ) . "s\n";
    129132        exit( 1 );

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/bin/resync-ratings.php

    r7030 r15190  
    4848        }
    4949
     50        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI script; the php_sapi_name() guard above exits for web requests and this is console output.
    5051        echo $i . '/' . count( $slugs ) . "\t" . $post->post_name . "\n";
    5152

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php

    r15102 r15190  
    13521352                                status_header( 200 );
    13531353                                header( 'Content-type: text/plain' );
     1354                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Generated markup: a text/plain readme and GeoPattern SVG, neither of which survives escaping.
    13541355                                echo file_get_contents( __DIR__ . '/readme/readme.txt' );
    13551356                                die();
    … …  
    15061507                header( 'Expires: ' . gmdate( 'D, d M Y H:i:s \G\M\T', time() + YEAR_IN_SECONDS ) );
    15071508
     1509                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Generated markup: a text/plain readme and GeoPattern SVG, neither of which survives escaping.
    15081510                echo $icon->toSVG();
    15091511                die();

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-search.php

    r14809 r15190  
    9797                ];
    9898                $export = preg_replace(array_keys($patterns), array_values($patterns), $export);
     99                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Local var_export() debug helper; the export is PHP source, not HTML.
    99100                if ((bool)$return) return $export; else echo $export;
    100101        }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-template.php

    r15036 r15190  
    176176                }
    177177
     178                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Meta tags assembled above from esc_attr()-escaped values.
    178179                echo implode( "\n", $metas );
    179180        }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/cli/class-import.php

    r15169 r15190  
    202202                                $this->warnings['invalid_update_uri'] = $headers->UpdateURI;
    203203
     204                                // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    204205                                throw new Exception( Readme_Validator::instance()->translate_code_to_message( 'invalid_update_uri' ) );
    205206                        }
    … …  
    227228                        $this->warnings['unmet_dependencies'] = $unmet_dependencies;
    228229
     230                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    229231                        throw new Exception( Readme_Validator::instance()->translate_code_to_message( 'unmet_dependencies', $unmet_dependencies ) );
    230232                }
    … …  
    241243                foreach ( $svn_tags_deleted as $svn_deleted_tag ) {
    242244                        if ( Plugin_Directory::remove_release( $plugin, $svn_deleted_tag ) ) {
     245                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI context, callers write the message to STDERR.
    243246                                echo "Plugin tag {$svn_deleted_tag} deleted; release removed.\n";
    244247                        }
    … …  
    366369                        $release = Plugin_Directory::get_release( $plugin, $stable_tag );
    367370                        if ( ! $release ) {
     371                                // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    368372                                throw new Exception( "Plugin release {$stable_tag} not found." );
    369373                        }
    … …  
    429433                                do_action( 'wporg_plugins_import_release_pending', $plugin, $release, $data );
    430434
     435                                // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    431436                                throw new Exception( "Plugin release {$stable_tag} not confirmed." );
    432437                        }
    … …  
    717722
    718723                        if ( $versions_to_build ) {
     724                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI context, callers write the message to STDERR.
    719725                                echo "Building ZIPs for {$plugin_slug}: " . implode( ', ', $versions_to_build ) . "\n";
    720726                        }
    … …  
    867873
    868874                if ( ! $svn_info['result'] ) {
     875                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    869876                        throw new Exception( 'Could not find stable SVN URL: ' . ( $svn_info['errors'] ? implode( ' ', reset( $svn_info['errors'] ) ) : 'Unknown error' ) );
    870877                }
    … …  
    885892                 */
    886893                if ( ! wp_list_filter( SVN::ls( $stable_url, true ), [ 'kind' => 'file' ] ) ) {
     894                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    887895                        throw new Exception( "Could not create SVN export of {$stable_url}: Path appears not to have any files." );
    888896                }
    … …  
    902910                        }
    903911
     912                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    904913                        throw new Exception( 'Could not create SVN export: ' . ( $svn_export['errors'] ? implode( ' ', reset( $svn_export['errors'] ) ) : 'Unknown error' ) );
    905914                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/cli/class-svn-watcher.php

    r15083 r15190  
    2424                $last_rev_processed = $this->get_option( $svn_rev_option_name );
    2525                if ( ! $last_rev_processed ) {
     26                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    2627                        throw new Exception( "Unknown Revision to parse from, please check the value of {$svn_rev_option_name} in the options table." );
    2728                }
    … …  
    9394                                wp_schedule_single_event( time() + 30, 'plugin_directory_check_cronjobs' );
    9495
     96                                // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    9597                                throw new Exception( 'Could not fetch plugins.svn logs: ' . implode( ', ', $logs['errors'] ) );
    9698                        } else {

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/cli/i18n/class-code-import.php

    r14627 r15190  
    3333                $files = SVN::ls( $svn_url );
    3434                if ( ! $files ) {
     35                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    3536                        throw new Exception( "Plugin has no files in {$tag}." );
    3637                }
    … …  
    4647                $valid = $this->is_plugin_valid( $export_directory );
    4748                if ( is_wp_error( $valid ) ) {
     49                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    4850                        throw new Exception( 'Plugin is not compatible with language packs: ' . $valid->get_error_message() );
    4951                }
    … …  
    6769                $result = $this->set_glotpress_for_plugin( $this->plugin, 'code' );
    6870                if ( is_wp_error( $result ) ) {
     71                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    6972                        throw new Exception( $result->get_error_message() );
    7073                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/cli/i18n/class-readme-import.php

    r14814 r15190  
    2828                $files = SVN::ls( $svn_url );
    2929                if ( ! $files ) {
     30                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    3031                        throw new Exception( "Plugin has no files in {$tag}." );
    3132                }
    … …  
    145146                $result = $this->set_glotpress_for_plugin( $this->plugin, 'readme' );
    146147                if ( is_wp_error( $result ) ) {
     148                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    147149                        throw new Exception( $result->get_error_message() );
    148150                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-plugin-scan.php

    r15115 r15190  
    109109                        $local_path = self::export_plugin_locally( $plugin->post_name, $tag );
    110110                        if ( ! $local_path ) {
     111                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI cron log output, not HTML.
    111112                                echo "Failed to export plugin {$plugin->post_name} tag {$tag} for scanning.\n";
    112113                                continue;
    … …  
    152153        public static function notify_plugin_authors( $plugin, $results, $tag ) {
    153154                ob_start();
     155
     156                // phpcs:disable WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text email body composed in an output buffer; escaping would corrupt it.
    154157
    155158                printf(
    … …  
    196199                }
    197200
     201                // phpcs:enable WordPress.Security.EscapeOutput.OutputNotEscaped
     202
    198203                $body = ob_get_clean();
    199204
    … …  
    204209                if ( wp_doing_cron() ) {
    205210                        // During cron, output the body to the log.
    206                         echo "\n==== Plugin Check Results for {$plugin->post_name} EMAIL ====\n";
     211                        echo "\n==== Plugin Check Results for {$plugin->post_name} EMAIL ====\n"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI cron log output, not HTML.
     212                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI cron log output, not HTML.
    207213                        echo $body;
    208214                }
    … …  
    354360                if ( wp_doing_cron() ) {
    355361                        // During cron, output the body to the log.
    356                         echo "\n==== Plugin Check Results for {$plugin->post_name} {$tag} SLACK LOG ====\n";
     362                        echo "\n==== Plugin Check Results for {$plugin->post_name} {$tag} SLACK LOG ====\n"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI cron log output, not HTML.
    357363                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI cron log output, not HTML.
    358364                        echo $fallback . "\n" . $table;
    … …  
    476482                if ( wp_doing_cron() ) {
    477483                        // During cron, output the body to the log.
    478                         echo "\n==== Plugin Check Results for {$plugin_slug} ====\n";
     484                        echo "\n==== Plugin Check Results for {$plugin_slug} ====\n"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI cron log output, not HTML.
     485                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI cron log output, not HTML.
    479486                        echo "Total Time: {$total_time}s\nReturn Code:{$return_code}.\n";
     487                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI cron log output, not HTML.
    480488                        if ( $stderr ) echo "STDERR: {$stderr}\n";
     489                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI cron log output, not HTML.
    481490                        if ( $output ) echo "OUTPUT: {$output}\n";
    482491                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload-handler.php

    r15183 r15190  
    10541054
    10551055                if ( ! $success ) {
     1056                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Written to the error log by trigger_error(), not rendered.
    10561057                        trigger_error( "Helpscout update failed: $http_response_code: " . var_export( $result, true ), E_USER_WARNING );
    10571058                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/standalone/class-plugins-info-api.php

    r14800 r15190  
    357357                                $json = function_exists( 'wp_json_encode' ) ? wp_json_encode( $response ) : json_encode( $response );
    358358                                if ( 'jsonp' == $this->format ) {
     359                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    359360                                        echo "{$this->jsonp}($json)";
    360361                                } else {
     362                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    361363                                        echo $json;
    362364                                }
    … …  
    364366
    365367                        case 'php':
     368                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    366369                                echo serialize( $response ? (object) $response : $response );
    367370                                break;
    … …  
    446449                }
    447450
     451                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    448452                echo str_repeat( "\t", $tabs );
    449453                switch ( $type = gettype( $data ) ) {
    … …  
    455459                        case 'float':
    456460                                list( $start, $close ) = $xml_tag( $key, $type, false );
     461                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    457462                                echo "$start$data$close";
    458463                                break;
    459464                        case 'NULL':
    460465                                list( $start, $close ) = $xml_tag( $key, $type, true );
     466                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    461467                                echo $start;
    462468                                break;
    … …  
    464470                                if ( empty( $data ) ) {
    465471                                        list( $start, $close ) = $xml_tag( $key, $type, true );
     472                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    466473                                        echo $start;
    467474                                        break;
    … …  
    469476
    470477                                list( $start, $close ) = $xml_tag( $key, $type, false );
     478                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    471479                                echo "$start\n";
    472480                                foreach ( $data as $k => $v ) {
    473481                                        $this->php_to_xml( $v, $tabs + 1, is_int( $k ) ? '' : $k );
    474482                                }
     483                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    475484                                echo str_repeat( "\t", $tabs );
     485                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    476486                                echo $close;
    477487                                break;
    … …  
    483493
    484494                                        list( $start, $close ) = $xml_tag( $key, $type, true );
     495                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    485496                                        echo $start;
    486497                                        break;
    … …  
    489500                                list( $start, $close ) = $xml_tag( $key, $type, false );
    490501                                if ( $tabs ) {
     502                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    491503                                        echo $start;
    492504                                }
    … …  
    494506                                        $this->php_to_xml( $v, $tabs + 1, $k );
    495507                                }
     508                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    496509                                echo str_repeat( "\t", $tabs );
    497510                                if ( $tabs ) {
     511                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (JSON, JSONP, serialized PHP or XML); escaping would corrupt the format.
    498512                                        echo $close;
    499513                                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/bootstrap.php

    r14720 r15190  
    3131
    3232if ( ! file_exists( $_tests_dir . '/includes/functions.php' ) ) {
     33        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Test harness console output, not HTML.
    3334        echo "Could not find $_tests_dir/includes/functions.php\n";
    3435        exit( 1 );

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/tests/wporg-plugin-api-performance.php

    r14720 r15190  
    6868                global $wporg_plugin_api_performance;
    6969
     70                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Test harness console output, not HTML.
    7071                echo 'Performance summary for ' . get_called_class() . ":\n";
    7172                foreach ( $wporg_plugin_api_performance[ get_called_class() ] as $type => $deltas ) {
     73                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Test harness console output, not HTML.
    7274                        echo "$type: " . self::averages( $deltas ) . "\n";
    7375                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/zip/class-builder.php

    r15063 r15190  
    9393                        }
    9494                        if ( ! $res['result'] ) {
     95                                // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    9596                                throw new Exception( __METHOD__ . ": Failed to create {$plugin_folder}." );
    9697                        }
    9798                } else {
     99                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    98100                        throw new Exception( __METHOD__ . ': Failed to create checkout of ' . PLUGIN_ZIP_SVN_URL . '.' );
    99101                }
    … …  
    414416                        ! wp_list_filter( $remote_files, [ 'kind' => 'file' ] )
    415417                ) {
     418                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    416419                        throw new Exception( __METHOD__ . ": Could not create SVN export of {$this->plugin_version_svn_url}: Path appears not to have any files." );
    417420                }
    … …  
    425428                }
    426429                if ( ! $res['result'] ) {
     430                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    427431                        throw new Exception( __METHOD__ . ': ' . ( $res['errors'][0]['error_message'] ?? 'unknown error' ), 404 );
    428432                }
    … …  
    490494
    491495                if ( $return_value ) {
     496                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- CLI context, callers write the message to STDERR.
    492497                        throw new Exception( __METHOD__ . ': ZIP generation failed, return code: ' . $return_value, 503 );
    493498                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/zip/class-serve.php

    r13071 r15190  
    139139                }
    140140                if ( ! $version ) {
     141                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Caught by serve(), which discards the message and renders a generic error.
    141142                        throw new Exception( __METHOD__ . ": A version for $plugin_slug cannot be determined." );
    142143                }
    … …  
    164165
    165166                if ( ! $post_id ) {
     167                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Caught by serve(), which discards the message and renders a generic error.
    166168                        throw new Exception( __METHOD__ . ": A post_id for $plugin_slug cannot be determined." );
    167169                }
    … …  
    218220                } else {
    219221                        header( 'Content-Type: text/plain' );
     222                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Served as text/plain per the header above; not rendered as HTML.
    220223                        echo "This is a request for $file, this server isn't currently configured to serve files.\n";
    221224                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-ratings-compat.php

    r15188 r15190  
    225225        <div>
    226226                <div style="font-weight:bold;"><?php esc_html_e( 'Average Rating', 'wporg-forums' ); ?></div>
    227                 <?php echo do_blocks( '<!-- wp:wporg/ratings-stars /-->' ); ?>
     227                <?php echo do_blocks( '<!-- wp:wporg/ratings-stars /-->' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup. ?>
    228228                <div class="reviews-submit-link">
    229229                <?php
    … …  
    263263                        );
    264264                ?></div>
    265                 <?php echo do_blocks( '<!-- wp:wporg/ratings-bars /-->' ); ?>
     265                <?php echo do_blocks( '<!-- wp:wporg/ratings-bars /-->' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup. ?>
    266266        </div>
    267267</div>

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/support-helphub/inc/helphub-front-page-blocks/includes/widget-front-end.php

    r9092 r15190  
    88?>
    99<?php
    10 echo $args['before_widget']; // WPCS: XSS OK.
     10// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Widget wrapper markup supplied by register_sidebar().
     11echo $args['before_widget'];
    1112?>
    1213
    … …  
    4243
    4344<?php
    44 echo $args['after_widget']; // WPCS: XSS OK.
     45// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Widget wrapper markup supplied by register_sidebar().
     46echo $args['after_widget'];

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/support-helphub/inc/helphub-manager/class-helphub-manager.php

    r9159 r15190  
    203203                                                        <?php foreach ( $helphub_roles as $role => $label ) : ?>
    204204
    205                                                                 <option <?php selected( $user_role, $role ); ?> value="<?php echo esc_attr( $role ); ?>"><?php echo $label; ?></option>
     205                                                                <option <?php selected( $user_role, $role ); ?> value="<?php echo esc_attr( $role ); ?>"><?php echo $label; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Select markup with the escaped value assembled on the same line. ?></option>
    206206
    207207                                                        <?php endforeach; ?>

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/support-helphub/inc/helphub-post-types/classes/class-helphub-post-types-post-type.php

    r14527 r15190  
    555555                } // End if().
    556556
     557                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Markup assembled above from escaped parts.
    557558                echo $html;
    558559                /* @codingStandardsIgnoreLine */

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/theme-directory/admin-edit.php

    r15179 r15190  
    512512                case 'ticket':
    513513                        if ( $theme->ticket ) {
    514                                 printf( '<a href="%1$s">%2$s</a>', esc_url( 'https://themes.trac.wordpress.org/ticket/' . $theme->ticket ), '#' . $theme->ticket );
     514                                printf( '<a href="%1$s">%2$s</a>', esc_url( 'https://themes.trac.wordpress.org/ticket/' . $theme->ticket ), esc_html( '#' . $theme->ticket ) );
    515515                        }
    516516                        break;
    517517                case 'theme-url':
    518518                case 'author-url':
    519                         echo make_clickable( $theme->$column );
     519                        echo wp_kses_post( make_clickable( $theme->$column ) );
    520520                        break;
    521521                default:
    522                         echo $theme->$column;
     522                        echo esc_html( $theme->$column );
    523523        }
    524524}
    … …  
    587587                }
    588588                ?>
    589                 <p><?php echo $text; ?> -
    590                         <select name="wporg_themes_status[<?php echo base64_encode( $version ); // base64 because version numbers don't work so well as parts of keys ?>]">
     589                <p><?php echo $text; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Version label built above with esc_html() and an (int)-cast ticket id. ?> -
     590                        <select name="wporg_themes_status[<?php echo esc_attr( base64_encode( $version ) ); // base64 because version numbers don't work so well as parts of keys. ?>]">
    591591                                <option value="new" <?php selected( $status, 'new' ); ?>><?php esc_html_e( 'New', 'wporg-themes' ); ?></option>
    592592                                <?php if ( 'approved' === $status ) : ?>

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/theme-directory/class-wporg-themes-upload.php

    r15179 r15190  
    10281028
    10291029                        // Output the Theme Check results. This is the only HTML that this function outputs.
    1030                         echo $theme_check_output;
     1030                        echo wp_kses_post( $theme_check_output );
    10311031
    10321032                        if ( ! $result && $args['block_on_themecheck'] ) {
    … …  
    14431443                /* translators: %s: Scan verdict. */
    14441444                echo '<h2>' . sprintf( esc_html__( 'Results of Automated Theme Scanning: %s', 'wporg-themes' ), vsprintf( '<span class="%1$s">%2$s</span>', array_map( 'esc_html', $verdict ) ) ) . '</h2>';
    1445                 echo '<ul class="tc-result">' . display_themechecks() . '</ul>';
     1445                echo '<ul class="tc-result">' . wp_kses_post( display_themechecks() ) . '</ul>';
    14461446                echo '<div class="notice notice-info"><p>' . esc_html__( 'Note: While the automated theme scan is based on the Theme Review Guidelines, it is not a complete review. A successful result from the scan does not guarantee that the theme will pass review. All submitted themes are reviewed manually before approval.', 'wporg-themes' ) . '</p></div>';
    14471447

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/theme-directory/jobs/class-svn-import.php

    r15115 r15190  
    5959
    6060                if ( ! $last_revision ) {
     61                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Written to the error log by trigger_error(), not rendered.
    6162                        trigger_error( "Theme Importing aborting, no starting revision known. Set 'svn_import_last_revision' option. Latest Revision: [{$latest_revision}]", E_USER_WARNING );
    6263                        return;
    … …  
    145146                                        return;
    146147                                } else {
     148                                        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Cron import task; the message is logged, not rendered.
    147149                                        throw new Exception( 'Theme Import Failure: ' . $return->get_error_code() . ' ' . $return->get_error_message() );
    148150                                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/theme-directory/rest-api.php

    r15082 r15190  
    3838
    3939        if ( defined( 'THEMES_API_VERSION' ) && '1.0' === THEMES_API_VERSION ) {
     40                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- API response body (serialized PHP); escaping would corrupt the format.
    4041                echo serialize( $result );
    4142                exit;

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/theme-directory/rest-api/class-internal.php

    r14896 r15190  
    7474                echo "* = r\n";
    7575                foreach ( array_unique( $all_access_users ) as $u ) {
     76                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Generates SVN authz config text, not HTML.
    7677                        echo "{$u} = rw\n";
    7778                }
    … …  
    8788                        printf(
    8889                                "[%s]\n%s = rw\n\n",
     90                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Generates SVN authz config text, not HTML.
    8991                                '/' . $r->slug,
     92                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Generates SVN authz config text, not HTML.
    9093                                $r->user
    9194                        );

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/theme-directory/theme-directory.php

    r15179 r15190  
    380380        $user = new WP_User($value);
    381381
    382         echo "<input type='text' id='post_author_username' value='{$user->user_login}' />";
    383         echo "<input type='hidden' id='post_author_override' name='post_author_override' value='{$value}' />";
     382        printf( '<input type="text" id="post_author_username" value="%s" />', esc_attr( $user->user_login ) );
     383        printf( '<input type="hidden" id="post_author_override" name="post_author_override" value="%s" />', esc_attr( $value ) );
    384384?>
    385385        <script>
    386386        jQuery( document ).ready( function( $ ) {
    387387                $( "#post_author_username" ).autocomplete( {
    388                         source: ajaxurl + '?action=author-lookup&_ajax_nonce=<?php echo wp_create_nonce( 'wporg_themes_author_lookup' ); ?>',
     388                        source: ajaxurl + '?action=author-lookup&_ajax_nonce=<?php echo esc_js( wp_create_nonce( 'wporg_themes_author_lookup' ) ); ?>',
    389389                        minLength: 2,
    390390                        delay: 700,

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wp-i18n-teams/views/all-locales.php

    r15179 r15190  
    2121                        $string = translate_nooped_plural( $nooped_plural, $locale_data['status_counts'][ $status ] );
    2222                        $string = sprintf( $string, sprintf( '<strong class="i18n-label %s">%s</strong>', $status, $locale_data['status_counts'][ $status ] ) );
    23                         printf( ' <a href="#%s" class="i18n-filter" data-filter="%s">%s</a>', $status, $status, $string );
     23                        printf( ' <a href="#%s" class="i18n-filter" data-filter="%s">%s</a>', esc_attr( $status ), esc_attr( $status ), wp_kses_post( $string ) );
    2424                }
    2525        ?>
    … …  
    4949                        $string = translate_nooped_plural( $nooped_plural, $locale_data['status_counts'][ $status ] );
    5050                        $string = sprintf( $string, sprintf( '<strong class="i18n-label %s">%s</strong>', $status, $locale_data['status_counts'][ $status ] ) );
    51                         printf( ' <a href="#%s" class="i18n-filter" data-filter="%s">%s</a>', $status, $status, $string );
     51                        printf( ' <a href="#%s" class="i18n-filter" data-filter="%s">%s</a>', esc_attr( $status ), esc_attr( $status ), wp_kses_post( $string ) );
    5252                }
    5353        ?>
    … …  
    8282                                $classes .= ' ' . $locale_data[ $locale->wp_locale ]['language_pack_status'];
    8383                                ?>
    84                                 <tr class="<?php echo trim( $classes ); ?>">
     84                                <tr class="<?php echo esc_attr( trim( $classes ) ); ?>">
    8585                                        <td data-column-title="<?php esc_attr_e( 'Locale', 'wporg' ); ?>" class="no-right-border">
    8686                                                <?php if ( $locale_data[ $locale->wp_locale ]['rosetta_site_url'] ) : ?>
    … …  
    112112                                                <?php
    113113                                                if ( isset( $language_packs_data[ $locale->wp_locale ] ) ) {
    114                                                         echo max( $language_packs_data[ $locale->wp_locale ] );
     114                                                        echo esc_html( max( $language_packs_data[ $locale->wp_locale ] ) );
    115115                                                } else {
    116116                                                        esc_html_e( 'No&nbsp;LP', 'wporg' );
    … …  
    126126                                                        $locale_slug = false !== strpos( $locale->slug, '/' ) ? $locale->slug : $locale->slug . '/default';
    127127                                                        ?>
    128                                                         <a href="https://translate.wordpress.org/locale/<?php echo $locale_slug; ?>/wp/dev">
    129                                                                 <?php echo $percentages[ $locale->wp_locale ] . '%'; ?>
     128                                                        <a href="https://translate.wordpress.org/locale/<?php echo esc_attr( $locale_slug ); ?>/wp/dev">
     129                                                                <?php echo esc_html( $percentages[ $locale->wp_locale ] . '%' ); ?>
    130130                                                        </a>
    131131                                                        <?php
    … …  
    138138                                        </td>
    139139                                        <td class="center no-left-border nowrap">
    140                                                 <a href="https://translate.wordpress.org/locale/<?php echo $locale->slug; ?>">
    141                                                         <?php echo $locale->slug; ?>
     140                                                <a href="https://translate.wordpress.org/locale/<?php echo esc_attr( $locale->slug ); ?>">
     141                                                        <?php echo esc_html( $locale->slug ); ?>
    142142                                                </a>
    143143                                        </td>

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wp-i18n-teams/views/locale-details.php

    r15179 r15190  
    2222                        <?php
    2323                        if ( $locale_data['sites'] ) :
     24                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Anchor list assembled above from esc_url() and esc_html() escaped parts.
    2425                                echo implode( ', ', array_map( function( $site ) {
    2526                                        return sprintf(
    … …  
    3637                <li>
    3738                        <strong><?php esc_html_e( 'Latest release:', 'wporg' ); ?></strong>
    38                         <?php echo $locale_data['latest_release'] ? $locale_data['latest_release'] : '&mdash;'; ?>
     39                        <?php echo $locale_data['latest_release'] ? esc_html( $locale_data['latest_release'] ) : '&mdash;'; ?>
    3940                </li>
    4041                <li>
    … …  
    4849                <li>
    4950                        <strong><?php esc_html_e( 'Translation Projects:', 'wporg' ); ?></strong>
    50                         <a href="https://translate.wordpress.org/locale/<?php echo $locale->slug; ?>">translate.wordpress.org/locale/<?php echo $locale->slug; ?></a>
     51                        <a href="https://translate.wordpress.org/locale/<?php echo esc_attr( $locale->slug ); ?>">translate.wordpress.org/locale/<?php echo esc_html( $locale->slug ); ?></a>
    5152                </li>
    5253        </ul>
    … …  
    156157                        );
    157158                }
     159                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Anchor list assembled above from esc_url() and esc_html() escaped parts.
    158160                echo wp_sprintf( '%l.', $translators );
    159161                ?>
    … …  
    175177                        );
    176178                }
     179                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Anchor list assembled above from esc_url() and esc_html() escaped parts.
    177180                echo wp_sprintf( '%l.', $translators );
    178181                ?>

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-badge-management/admin.php

    r15188 r15190  
    121121                }
    122122                echo '</ul>';
    123                 echo '<textarea rows="10" style="width:100%">' . implode( ', ', wp_list_pluck( $users, 'user_login' ) ) . '</textarea>';
     123                echo '<textarea rows="10" style="width:100%">' . esc_textarea( implode( ', ', wp_list_pluck( $users, 'user_login' ) ) ) . '</textarea>';
    124124        } else {
    125125                echo '<p><em>No users have this badge.</em></p>';
    … …  
    155155
    156156                if ( $messages ) {
     157                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Notice built from a literal format string with intval()-cast counts.
    157158                        echo '<div id="message" class="updated notice is-dismissible"><p>' . implode( '<br>', $messages ) . '</p></div>';
    158159                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-bbp-term-subscription/inc/class-plugin.php

    r14760 r15190  
    153153                echo '<div class="notice notice-info notice-alt with-dashicon">';
    154154                echo '<span class="dashicons dashicons-email-alt"></span>';
    155                 echo "<p>{$message}</p>";
     155                printf( '<p>%s</p>', wp_kses_post( $message ) );
    156156                echo '</div>';
    157157        }
    … …  
    207207                                                        '&nbsp<a href="%6$s">%7$s</a>' .
    208208                                                '</form>',
    209                                                 get_bloginfo('name'),
     209                                                esc_html( get_bloginfo( 'name' ) ),
    210210                                                sprintf(
    211211                                                        /* translators: 1: Plugin, Theme, or Tag name. */
    212212                                                        esc_html__( 'Do you wish to unsubscribe from future emails for %s?', 'wporg-forums' ),
    213                                                         $term->name
     213                                                        esc_html( $term->name )
    214214                                                ),
    215215                                                esc_attr( $_SERVER['REQUEST_URI'] ),

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-bbp-topic-resolution/inc/class-plugin.php

    r15179 r15190  
    233233                $user_id = get_current_user_id();
    234234                if ( bbp_is_topic_edit() || ! $this->user_can_resolve( $user_id, $topic_id ) ) {
    235                         printf( esc_html__( 'Status: %s', 'wporg-forums' ), $resolutions[ $resolution ] );
     235                        /* translators: %s: Resolution status. */
     236                        printf( esc_html__( 'Status: %s', 'wporg-forums' ), esc_html( $resolutions[ $resolution ] ) );
    236237
    237238                // Display the form to update the topic resolution.

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-bbp-user-badges/inc/class-plugin.php

    r15044 r15190  
    256256
    257257                if ( $output ) {
     258                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Badge markup assembled by format_badge() from escaped parts.
    258259                        echo $this->format_badge( $output['type'], $output['label'], $output['help'] );
    259260                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-cli/inc/class-markdown-import.php

    r15024 r15190  
    192192                $response = self::update_post_from_markdown_source( $post_id );
    193193                if ( is_wp_error( $response ) ) {
     194                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI import error; the message is written to the console.
    194195                        wp_die( $response->get_error_message() );
    195196                }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-github-invite/admin.php

    r15188 r15190  
    6666                        printf(
    6767                                '<div class="notice notice-%s is-dismissable"><p>%s</p></div>',
    68                                 $class,
    69                                 $message
     68                                esc_attr( $class ),
     69                                wp_kses_post( $message )
    7070                        );
    7171                }
    … …  
    8181                        <tr>
    8282                                <th scope="row"><label for="invite">GitHub Email, GitHub URL, WordPress.org user slug, or WordPress.org Profile URL</label></th>
    83                                 <td><input type="text" name="invite" id="invite" class="regular-text" placeholder="https://profiles.wordpress.org/<?php echo wp_get_current_user()->user_nicename; ?>/"></td>
     83                                <td><input type="text" name="invite" id="invite" class="regular-text" placeholder="https://profiles.wordpress.org/<?php echo esc_attr( wp_get_current_user()->user_nicename ); ?>/"></td>
    8484                        </tr>
    8585                        <tr>
    … …  
    120120                                                                %s
    121121                                                        </p>',
    122                                                         $pending->login ?: $pending->email,
     122                                                        esc_html( $pending->login ?: $pending->email ),
    123123                                                        esc_html( human_time_diff( strtotime( $pending->created_at ) ) ),
    124124                                                        $cancel_url ? '<a class="button" href="' . esc_url( $cancel_url ) . '">Cancel</a>' : ''

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-gp-customizations/inc/cli/class-duplicate-translations.php

    r14672 r15190  
    155155                                                $result['translation_set_id'],
    156156                                        );
     157                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI query output written to the console, not HTML.
    157158                                        echo $prepared_query . "\n";
    158159                                        // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-gp-customizations/templates/footer.php

    r11494 r15190  
    33<?php
    44
     5// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    56echo do_blocks( '<!-- wp:wporg/global-footer /-->' );

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-gp-customizations/templates/header.php

    r15188 r15190  
    11<?php
    22
     3// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    34echo do_blocks( '<!-- wp:wporg/global-header /-->' );
    45

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-gp-help/wporg-gp-help.php

    r13164 r15190  
    2727        function after_hello() {
    2828                if ( is_user_logged_in() || $this->is_notice_hidden() ) {
     29                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Help link markup built here from a class constant.
    2930                        echo '<em><a class="secondary" href="' . self::handbook_link . '">Need help?</a></em>';
    3031                }
    … …  
    5152                        <p>
    5253                                New to Translating WordPress?
    53                                 Read through our <a href="<?php echo self::handbook_link; ?>" target="_blank">Translator Handbook</a> to get started.
     54                                Read through our <a href="<?php echo esc_url( self::handbook_link ); ?>" target="_blank">Translator Handbook</a> to get started.
    5455                                <a id="hide-help-notice" class="secondary" style="float: right;" href="<?php echo esc_url( $hide_url ); ?>">Hide</a>
    5556                        </p>

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-gp-profiles/tests/e2e.php

    r11975 r15190  
    3636                add_action( 'gp_pre_can_user', __NAMESPACE__ . '\grant_editor_capabilities', 10, 2 );
    3737                call_user_func( __NAMESPACE__ . "\\test_$case", $translator );
     38                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Test script console output, not HTML.
    3839                echo "\nThe daily digest count should have been bumped on https://profiles.wordpress.org/$translator->user_nicename/, and/or the reviewer. \n";
    3940
    4041        } catch ( Exception $exception ) {
     42                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Test script console output, not HTML.
    4143                echo $exception->getMessage();
    4244        }

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-gp-rosetta-roles/inc/admin/list-table/class-translators.php

    r15179 r15190  
    160160                        ?>
    161161                        <label class="screen-reader-text" for="cb-select-<?php echo (int) $user->ID; ?>"><?php esc_html_e( 'Select translator', 'wporg-translate' ); ?></label>
    162                         <input id="cb-select-<?php echo $user->ID; ?>" type="checkbox" name="translators[]" value="<?php echo $user->ID; ?>">
     162                        <input id="cb-select-<?php echo (int) $user->ID; ?>" type="checkbox" name="translators[]" value="<?php echo (int) $user->ID; ?>">
    163163                        <?php
    164164                }
    … …  
    185185                }
    186186
     187                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Avatar and edit-link markup assembled above from escaped parts.
    187188                echo "$avatar $edit";
    188189        }
    … …  
    194195         */
    195196        public function column_name( $user ) {
    196                 echo "$user->first_name $user->last_name";
     197                echo esc_html( "$user->first_name $user->last_name" );
    197198        }
    198199
    … …  
    203204         */
    204205        public function column_email( $user ) {
    205                 echo "<a href='" . esc_url( "mailto:$user->user_email" ) . "'>$user->user_email</a>";
     206                printf( '<a href="%1$s">%2$s</a>', esc_url( "mailto:$user->user_email" ), esc_html( $user->user_email ) );
    206207        }
    207208
    … …  
    218219                , $user->ID ) );
    219220
    220                 echo implode( ', ', $locales );
     221                echo implode( ', ', array_map( 'esc_html', $locales ) );
    221222        }
    222223}

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-gp-translation-suggestions/templates/other-languages-suggestions.php

    r12765 r15190  
    1010
    1111                        echo '<span class="translation-suggestion__translation">';
     12                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- esc_translation() escapes the markup and double-encodes existing entities so the translation renders exactly as written.
    1213                                echo esc_translation( $suggestion['translation'] );
    1314
    … …  
    2627                                                        printf(
    2728                                                                ' | By <a href="https://profiles.wordpress.org/%s">%s</a>',
    28                                                                 $user->user_nicename,
     29                                                                esc_html( $user->user_nicename ),
    2930                                                                esc_html( $user->display_name )
    3031                                                        );
    … …  
    3536                        echo '</span>';
    3637
     38                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- esc_translation() escapes the markup and double-encodes existing entities so the translation renders exactly as written.
    3739                        echo '<span aria-hidden="true" class="translation-suggestion__translation-raw">' . esc_translation( $suggestion['translation'] ) . '</span>';
    3840

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-gp-translation-suggestions/templates/translation-memory-suggestions.php

    r12765 r15190  
    1717                        echo '</span>';
    1818                        echo '<span class="translation-suggestion__translation">';
     19                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- esc_translation() escapes the markup and double-encodes existing entities so the translation renders exactly as written.
    1920                                echo esc_translation( $suggestion['translation'] );
    2021
    … …  
    2425                        echo '</span>';
    2526
     27                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- esc_translation() escapes the markup and double-encodes existing entities so the translation renders exactly as written.
    2628                        echo '<span aria-hidden="true" class="translation-suggestion__translation-raw">' . esc_translation( $suggestion['translation'] ) . '</span>';
    2729

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-markdown/inc/class-editor.php

    r13074 r15190  
    6868                        '<div class="notice notice-warning"><p>%s</p><p><a href="%s">%s</a></p></div>',
    6969                        'This page is maintained on GitHub. Content, title, and slug edits here will be discarded on next sync.',
     70                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Edit link markup assembled above from escaped parts.
    7071                        $this->get_markdown_edit_link( $post->ID ),
    7172                        'Edit on GitHub'

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-profiles-wp-activity-notifier/tests/e2e.php

    r12019 r15190  
    3939        restore_current_blog();
    4040
     41        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Test script console output, not HTML.
    4142        echo "\nThere should be new activity on https://profiles.wordpress.org/$user->user_nicename/ \n";
    4243}

  • sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-trac-watcher/svn.php

    r15103 r15190  
    9191                $last_revision = 0;
    9292                // When setting up a new table, this needs to be commented out to force the import.
    93                 trigger_error( "Can't find max row for {$db_table} to import {$svn_url} revisions.", E_USER_WARNING );
     93                trigger_error( "Can't find max row for {$db_table} to import {$svn_url} revisions.", E_USER_WARNING ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Written to the error log by trigger_error(), not rendered.
    9494                return false;
    9595        }

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-breathe-2024/archive-component.php

    r14020 r15190  
    1313        <div id="primary" class="content-area">
    1414                <div role="main">
    15                 <h1><?php printf( 'WordPress %s Components', $trac_name ); ?></h1>
     15                <h1><?php printf( 'WordPress %s Components', esc_html( $trac_name ) ); ?></h1>
    1616
    1717<?php
    1818        if ( $cached = get_transient( 'trac_components_page' ) ) {
     19                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Component page content plus the table the component_table_row action renders.
    1920                echo $cached;
    2021        } else {
    … …  
    3435                $cache = ob_get_clean();
    3536                set_transient( 'trac_components_page', $cache, 300 );
     37                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Component page content plus the table the component_table_row action renders.
    3638                echo $cache;
    3739        }

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-breathe-2024/footer.php

    r14020 r15190  
    1414<?php
    1515
     16// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    1617echo do_blocks( '<!-- wp:wporg/global-footer /-->' );

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-breathe-2024/functions.php

    r15179 r15190  
    399399                        ><span><?php esc_html_e( 'Hide welcome box', 'wporg' ); ?></span></button>
    400400                </div>
    401                 <div class="entry-content clear" id="make-welcome-content" data-cookie="<?php echo $cookie; ?>" data-hash="<?php echo $content_hash; ?>">
     401                <div class="entry-content clear" id="make-welcome-content" data-cookie="<?php echo esc_attr( $cookie ); ?>" data-hash="<?php echo esc_attr( $content_hash ); ?>">
    402402                        <script type="text/javascript">
    403403                                const elContent = document.getElementById( 'make-welcome-content' );
    … …  
    726726
    727727        ?>
    728         <nav role="navigation" id="<?php echo esc_attr( $nav_id ); ?>" class="<?php echo $nav_class; ?>">
     728        <nav role="navigation" id="<?php echo esc_attr( $nav_id ); ?>" class="<?php echo esc_attr( $nav_class ); ?>">
    729729                <h2 class="screen-reader-text"><?php esc_html_e( 'Post navigation', 'wporg' ); ?></h2>
    730730

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-breathe-2024/header.php

    r14638 r15190  
    33\WordPressdotorg\skip_to( '#primary' );
    44
     5// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    56echo do_blocks( '<!-- wp:wporg/global-header {"style":{"border":{"bottom":{"color":"var:preset|color|white-opacity-15","style":"solid","width":"1px"}}}} /-->' );
    67
    78if ( is_front_page() && is_home() ) {
     9        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    810        echo do_blocks( '<!-- wp:wporg/local-navigation-bar {"className":"has-display-contents","backgroundColor":"charcoal-2","style":{"elements":{"link":{"color":{"text":"var:preset|color|white"},":hover":{"color":{"text":"var:preset|color|white"}}}}},"textColor":"white","fontSize":"small"} -->
    911
    … …  
    2628        $before_name = ob_get_clean();
    2729
     30        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    2831        echo do_blocks(
    2932                sprintf(

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-breathe-2024/o2-comment.php

    r14020 r15190  
    1313
    1414// Remove `rel` attributes on comment urls.
    15 echo str_replace( 'rel="external nofollow" ', '', $comment_template );
     15echo str_replace( 'rel="external nofollow" ', '', $comment_template ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- o2 comment template markup with the rel attribute stripped.

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-registration.php

    r15179 r15190  
    6767        if ( null !== ( $pre_register_error = apply_filters( 'wporg_login_pre_registration', null, $user_login, $user_email, $meta ) ) ) {
    6868                if ( is_wp_error( $pre_register_error ) ) {
     69                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Registration error markup assembled from escaped parts.
    6970                        wp_die( $pre_register_error );
    7071                }

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-main/front-page.php

    r15188 r15190  
    1313 * @package WordPressdotorg\Theme
    1414 */
    15 
    16 // phpcs:disable WordPress.XSS.EscapeOutput.UnsafePrintingFunction, WordPress.XSS.EscapeOutput.OutputNotEscaped
    1715
    1816namespace WordPressdotorg\MainTheme;
    … …  
    8280                }
    8381        </style>
    84         <?php echo do_blocks( $banner_blocks ); ?>
     82        <?php echo do_blocks( $banner_blocks ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup. ?>
    8583
    8684        <header id="masthead" class="site-header" role="banner">
    … …  
    246244
    247245                                        the_title( sprintf( '<h5><a href="%s" rel="bookmark">', esc_url( get_permalink() ) ), '</a></h5>' );
     246                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Thumbnail markup and the_excerpt filter output; escaping would print the markup.
    248247                                        echo '<div class="entry-summary">' . apply_filters( 'the_excerpt', get_the_excerpt() ) . '</div>';
    249248                                }
    … …  
    322321                                                                '<div class="col-3"><a href="%1$s">%2$s</a></div>',
    323322                                                                esc_url( $post_url ),
     323                                                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Thumbnail markup and the_excerpt filter output; escaping would print the markup.
    324324                                                                $thumbnail
    325325                                                        );
    … …  
    344344                                                                '<li><a href="%1$s"><img src="https://s.w.org/images/notableusers/%2$s-2x.png?version=2" alt="%2$s" width="130" height="57" /></a></li>',
    345345                                                                esc_url( $user_links[ $slug ] ),
    346                                                                 $slug
     346                                                                esc_attr( $slug )
    347347                                                        );
    348348                                                endforeach;

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-main/header-child-page.php

    r11448 r15190  
    2020                <header id="masthead" class="site-header col-12" role="banner">
    2121                        <div class="site-branding">
    22                                 <p class="site-title"><a href="<?php echo esc_url( get_permalink( get_post()->post_parent ) ); ?>" rel="bookmark"><?php echo get_the_title( get_post()->post_parent ); ?></a></p>
     22                                <p class="site-title"><a href="<?php echo esc_url( get_permalink( get_post()->post_parent ) ); ?>" rel="bookmark"><?php echo esc_html( get_the_title( get_post()->post_parent ) ); ?></a></p>
    2323
    2424                                <?php if ( ! empty( $menu_items ) ) : ?>

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-main/header-top-level-page.php

    r11448 r15190  
    3535                                <h1 class="site-title">
    3636                                        <a href="<?php echo esc_url( get_permalink() ); ?>" rel="bookmark">
    37                                                 <?php echo get_the_title(); ?>
     37                                                <?php echo esc_html( get_the_title() ); ?>
    3838                                        </a>
    3939                                </h1>

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-main/page-about-requirements.php

    r11866 r15190  
    4646                                                        <?php
    4747                                                        /* translators: 1: URL to PHP; 2: PHP Version */
    48                                                         printf( wp_kses_post( __( '<a href="%1$s">PHP</a> version %2$s or greater.', 'wporg' ) ), 'https://www.php.net/', RECOMMENDED_PHP );
     48                                                        printf( wp_kses_post( __( '<a href="%1$s">PHP</a> version %2$s or greater.', 'wporg' ) ), esc_url( 'https://www.php.net/' ), esc_html( RECOMMENDED_PHP ) );
    4949                                                        ?>
    5050                                                </li>
    … …  
    8282                                                        /* translators: 1: PHP Version including; 2: MySQL Version */
    8383                                                        wp_kses_post( __( 'Note: If you are in a legacy environment where you only have older PHP or MySQL versions, WordPress also works with PHP %1$s+ and MySQL %2$s+, but these versions have reached official End Of Life and as such <strong>may expose your site to security vulnerabilities</strong>.', 'wporg' ) ),
    84                                                         MINIMUM_PHP,
     84                                                        esc_html( MINIMUM_PHP ),
    8585                                                        '5.0'
    8686                                                );
    … …  
    9999                                                                <?php
    100100                                                                /* translators: PHP Version */
    101                                                                 printf( esc_html__( 'PHP %s or greater', 'wporg' ), RECOMMENDED_PHP );
     101                                                                printf( esc_html__( 'PHP %s or greater', 'wporg' ), esc_html( RECOMMENDED_PHP ) );
    102102                                                                ?>
    103103                                                        </li>

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-main/page-download.php

    r15179 r15190  
    8787                        "fileFormat": "application/zip",
    8888                        "downloadUrl": "<?php echo esc_url( $latest_release_zip_url ); ?>",
    89                         "dateModified": "<?php echo gmdate( 'Y-m-d\TH:i:s\+00:00', $latest_release_zip_ts ); ?>",
     89                        "dateModified": "<?php echo esc_attr( gmdate( 'Y-m-d\TH:i:s\+00:00', $latest_release_zip_ts ) ); ?>",
    9090                        "applicationCategory": "WebApplication",
    9191                        "offers": {
    … …  
    245245                                                                /* translators: 1: PHP version; 2: URL to PHP website; 3: URL to MySQL website; 4: MySQL version; 5: URL to MariaDB website; 6: MariaDB version */
    246246                                                                wp_kses_post( __( 'We recommend servers running version %1$s or greater of <a href="%2$s">PHP</a> and <a href="%3$s">MySQL</a> version %4$s <em>OR</em> <a href="%5$s">MariaDB</a> version %6$s or greater.', 'wporg' ) ),
    247                                                                 RECOMMENDED_PHP,
     247                                                                esc_html( RECOMMENDED_PHP ),
    248248                                                                'https://www.php.net/',
    249249                                                                'https://www.mysql.com/',

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-main/page-hosting.php

    r14853 r15190  
    3838                                <img
    3939                                    alt=""
    40                                     src="https://s.w.org/hosting/pressable.png?<?php echo $hosting_cache_buster; ?>"
     40                                                                        src="https://s.w.org/hosting/pressable.png?<?php echo esc_attr( $hosting_cache_buster ); ?>"
    4141                                    height="100"
    4242                                    width="100"
    … …  
    6060                                                                <img
    6161                                                                        alt=""
    62                                                                         src="https://s.w.org/hosting/bluehost.png?<?php echo $hosting_cache_buster; ?>"
     62                                                                        src="https://s.w.org/hosting/bluehost.png?<?php echo esc_attr( $hosting_cache_buster ); ?>"
    6363                                                                        height="100"
    6464                                                                        width="100"
    … …  
    8282                                <img
    8383                                    alt=""
    84                                     src="https://s.w.org/hosting/hostinger.png?<?php echo $hosting_cache_buster; ?>"
     84                                                                        src="https://s.w.org/hosting/hostinger.png?<?php echo esc_attr( $hosting_cache_buster ); ?>"
    8585                                    height="100"
    8686                                    width="100"
    … …  
    105105                                                                <img
    106106                                                                        alt=""
    107                                                                         src="https://s.w.org/hosting/dreamhost.png?<?php echo $hosting_cache_buster; ?>"
     107                                                                        src="https://s.w.org/hosting/dreamhost.png?<?php echo esc_attr( $hosting_cache_buster ); ?>"
    108108                                                                        height="100"
    109109                                                                        width="100"

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-openverse/header.php

    r11496 r15190  
    1414\WordPressdotorg\skip_to( '#content' );
    1515
     16// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    1617echo do_blocks( '<!-- wp:wporg/global-header /-->' );
    1718

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/build/blocks/archive-page/render.php

    r13792 r15190  
    1313$archive_description = get_the_archive_description();
    1414
     15// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    1516echo do_blocks( <<<BLOCKS
    1617<!-- wp:group {"align":"wide","style":{"spacing":{"padding":{"top":"var:preset|spacing|40"}}},"layout":{"type":"default"}} -->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/build/blocks/category-navigation/render.php

    r13692 r15190  
    1919        FILTERS;
    2020
     21        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    2122        echo do_blocks( $filter_blocks );
    2223
    … …  
    2425}
    2526
     27// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    2628echo do_blocks( '<!-- wp:navigation {"menuSlug":"section-bar","ariaLabel":"'. esc_attr( 'Category menu', 'wporg-plugins' ) .'","overlayMenu":"never","layout":{"type":"flex","orientation":"horizontal","justifyContent":"left","flexWrap":"nowrap"},"fontSize":"small","className":"is-style-button-list"} /-->' );

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/build/blocks/filter-bar/render.php

    r13927 r15190  
    77$search_button      = esc_attr__( 'Search plugins', 'wporg-plugins' );
    88
     9// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    910echo do_blocks( <<<BLOCKS
    1011        <!-- wp:group {"align":"wide","className":"wporg-filter-bar wporg-plugins__filters wporg-plugins__filters__no-count","layout":{"type":"flex","flexWrap":"wrap","justifyContent":"space-between"}} -->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/build/blocks/front-page/render.php

    r14487 r15190  
    2020);
    2121
     22// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    2223echo do_blocks( '<!-- wp:template-part {"slug":"grid-controls"} /-->' );
    2324
    … …  
    8384                <section class="plugin-section">
    8485                        <header class="section-header">
    85                                 <?php echo $title; ?>
     86                                <?php echo $title; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() output and Template::get_plugin_icon() markup; escaping would print the markup. ?>
    8687                                <a class="section-link" href="<?php echo esc_url( home_url( "browse/$browse/" ) ); ?>">
    8788                                        <?php
    … …  
    9697
    9798                        <?php
     99                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    98100                        echo do_blocks( <<<BLOCKS
    99101                        <!-- wp:query {"tagName":"div","className":"plugin-cards"} -->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/build/blocks/plugin-card/render.php

    r15153 r15190  
    1212        <div class="entry">
    1313                <div class="entry-thumbnail">
    14                         <?php echo Template::get_plugin_icon( get_post(), 'html' ); ?>
     14                        <?php echo Template::get_plugin_icon( get_post(), 'html' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() output and Template::get_plugin_icon() markup; escaping would print the markup. ?>
    1515                </div>
    1616

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/build/blocks/search-page/render.php

    r13691 r15190  
    22namespace WordPressdotorg\Theme\Plugins_2024\SearchPage;
    33
     4// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    45echo do_blocks( <<<BLOCKS
    56        <!-- wp:template-part {"slug":"grid-controls"} /-->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/embed-plugin.php

    r15153 r15190  
    121121                <p class="wp-embed-heading">
    122122                        <a href="<?php the_permalink(); ?>" target="_top">
    123                                 <?php echo Template::get_plugin_icon( $post, 'html' ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?>
     123                                <?php echo Template::get_plugin_icon( $post, 'html' ); /* phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped */ ?>
    124124                                <?php the_title(); ?>
    125125                        </a>

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/inc/template-tags.php

    r15179 r15190  
    5959 */
    6060function the_plugin_banner( $post = null ) {
    61         echo Template::get_plugin_banner( $post, 'html' ); // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped
     61        echo Template::get_plugin_banner( $post, 'html' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
    6262}
    6363
    … …  
    8080                        if ( $is_favorited ) {
    8181                                /* translators: %s: plugin name */
    82                                 printf( esc_html__( 'Unfavorite %s', 'wporg-plugins' ), get_the_title() );
     82                                printf( esc_html__( 'Unfavorite %s', 'wporg-plugins' ), esc_html( get_the_title() ) );
    8383                        } else {
    8484                                /* translators: %s: plugin name */
    85                                 printf( esc_html__( 'Favorite %s', 'wporg-plugins' ), get_the_title() );
     85                                printf( esc_html__( 'Favorite %s', 'wporg-plugins' ), esc_html( get_the_title() ) );
    8686                        }
    8787                        ?>
    … …  
    310310        printf(
    311311                '<div class="plugin-notice notice notice-warning notice-alt"><p>%s</p></div>',
    312                 $message
     312                wp_kses_post( $message )
    313313        );
    314314}
    … …  
    565565        $close_button_text = sprintf( __( 'I understand, please close %s.', 'wporg-plugins' ), get_the_title() );
    566566        ?>
    567         <div class="wp-block-button is-small"><button class="show-dialog wp-block-button__link" onclick="this.parentNode.nextElementSibling.showModal()"><?php echo $close_button_text; ?></button></div>
     567        <div class="wp-block-button is-small"><button class="show-dialog wp-block-button__link" onclick="this.parentNode.nextElementSibling.showModal()"><?php echo esc_html( $close_button_text ); ?></button></div>
    568568        <dialog>
    569569                <a onclick="this.parentNode.close()" class="close dashicons dashicons-no-alt"></a>
    … …  
    580580                                                /* translators: %s: The plugin name. */
    581581                                                esc_html__( 'Yes, I wish to close %s.', 'wporg-plugins' ),
    582                                                 '<code>' . get_the_title() . '</code>'
     582                                                '<code>' . esc_html( get_the_title() ) . '</code>'
    583583                                        ); ?>
    584584                                </label>

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/src/blocks/archive-page/render.php

    r13792 r15190  
    1313$archive_description = get_the_archive_description();
    1414
     15// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    1516echo do_blocks( <<<BLOCKS
    1617<!-- wp:group {"align":"wide","style":{"spacing":{"padding":{"top":"var:preset|spacing|40"}}},"layout":{"type":"default"}} -->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/src/blocks/category-navigation/render.php

    r13692 r15190  
    1919        FILTERS;
    2020
     21        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    2122        echo do_blocks( $filter_blocks );
    2223
    … …  
    2425}
    2526
     27// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    2628echo do_blocks( '<!-- wp:navigation {"menuSlug":"section-bar","ariaLabel":"'. esc_attr( 'Category menu', 'wporg-plugins' ) .'","overlayMenu":"never","layout":{"type":"flex","orientation":"horizontal","justifyContent":"left","flexWrap":"nowrap"},"fontSize":"small","className":"is-style-button-list"} /-->' );

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/src/blocks/filter-bar/render.php

    r13927 r15190  
    77$search_button      = esc_attr__( 'Search plugins', 'wporg-plugins' );
    88
     9// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    910echo do_blocks( <<<BLOCKS
    1011        <!-- wp:group {"align":"wide","className":"wporg-filter-bar wporg-plugins__filters wporg-plugins__filters__no-count","layout":{"type":"flex","flexWrap":"wrap","justifyContent":"space-between"}} -->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/src/blocks/front-page/render.php

    r14487 r15190  
    2020);
    2121
     22// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    2223echo do_blocks( '<!-- wp:template-part {"slug":"grid-controls"} /-->' );
    2324
    … …  
    8384                <section class="plugin-section">
    8485                        <header class="section-header">
    85                                 <?php echo $title; ?>
     86                                <?php echo $title; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() output and Template::get_plugin_icon() markup; escaping would print the markup. ?>
    8687                                <a class="section-link" href="<?php echo esc_url( home_url( "browse/$browse/" ) ); ?>">
    8788                                        <?php
    … …  
    9697
    9798                        <?php
     99                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    98100                        echo do_blocks( <<<BLOCKS
    99101                        <!-- wp:query {"tagName":"div","className":"plugin-cards"} -->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/src/blocks/plugin-card/render.php

    r15153 r15190  
    1212        <div class="entry">
    1313                <div class="entry-thumbnail">
    14                         <?php echo Template::get_plugin_icon( get_post(), 'html' ); ?>
     14                        <?php echo Template::get_plugin_icon( get_post(), 'html' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() output and Template::get_plugin_icon() markup; escaping would print the markup. ?>
    1515                </div>
    1616

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/src/blocks/search-page/render.php

    r13691 r15190  
    22namespace WordPressdotorg\Theme\Plugins_2024\SearchPage;
    33
     4// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    45echo do_blocks( <<<BLOCKS
    56        <!-- wp:template-part {"slug":"grid-controls"} /-->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/template-parts/plugin-single.php

    r14932 r15190  
    3434                                <div class="entry-thumbnail">
    3535                                        <?php
    36                                         // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped
     36                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Template::get_plugin_icon() returns the icon markup.
    3737                                        echo Template::get_plugin_icon( $post, 'html' );
    3838                                        ?>

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/template-parts/section-blocks.php

    r12319 r15190  
    7575                        <li class="<?php echo esc_attr( $block_classes ); ?>">
    7676                                <?php if ( false !== strpos( $block_icon, '<svg' ) ) : ?>
    77                                         <span class="block-icon" <?php echo $block_style; ?>>
     77                                        <span class="block-icon" <?php echo $block_style; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Style attribute built above from sanitize_hex_color() values. ?>>
    7878                                                <?php echo wp_kses( str_replace( '<svg ', '<svg role="img" aria-hidden="true" focusable="false" ', $block_icon ), $allowed_svg ); ?>
    7979                                        </span>
    8080                                <?php elseif ( $block_icon ) : ?>
    81                                         <span class="block-icon dashicons dashicons-<?php echo esc_attr( $block_icon ); ?>" <?php echo $block_style; ?>></span>
     81                                        <span class="block-icon dashicons dashicons-<?php echo esc_attr( $block_icon ); ?>" <?php echo $block_style; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Style attribute built above from sanitize_hex_color() values. ?>></span>
    8282                                <?php else : ?>
    8383                                        <span class="block-icon dashicons dashicons-block-default"></span>

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/template-parts/section.php

    r12319 r15190  
    1818<div id="<?php echo esc_attr( $prefix . $section_slug ); ?>" class="<?php echo esc_attr( $classes ); ?>">
    1919        <h2 id="<?php echo esc_attr( $section_slug . '-header' ); ?>"><?php echo esc_html( $section_title ); ?></h2>
    20         <?php echo $section_content; ?>
     20        <?php echo $section_content; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Rendered readme section markup. ?>
    2121</div>

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-showcase/404.php

    r15179 r15190  
    6161                                                                                        </div>\n";
    6262
     63                                                                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Markup assembled in this file from literal strings.
    6364                                                                                echo $output;
    6465                                                                        }

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-showcase/comments.php

    r15179 r15190  
    1414        <li id="comment-<?php comment_ID() ?>" <?php if ($i % 2) echo "class='altc'"; ?>>
    1515        <?php comment_text() ?>
    16         <p><cite><?php printf(
    17                 /* translators: 1: comment type, 2: comment author link, 3: comment date */
    18                 esc_html__( '%1$s from %2$s on %3$s', 'wporg-showcase' ),
    19                 comment_type( __( 'Comment', 'wporg-showcase' ), __( 'Trackback', 'wporg-showcase' ), __( 'Pingback', 'wporg-showcase' ) ),
    20                 comment_author_link(),
    21                 comment_date()
    22         ); ?></cite> <?php edit_comment_link( __( 'Edit This', 'wporg-showcase' ), ' |' ); ?></p>
     16        <p><cite>
     17                <?php
     18                $comment_type_labels = array(
     19                        'comment'   => __( 'Comment', 'wporg-showcase' ),
     20                        'trackback' => __( 'Trackback', 'wporg-showcase' ),
     21                        'pingback'  => __( 'Pingback', 'wporg-showcase' ),
     22                );
     23                $comment_type_key = get_comment_type();
     24                printf(
     25                        /* translators: 1: Comment type, 2: Comment author link, 3: Comment date. */
     26                        esc_html__( '%1$s from %2$s on %3$s', 'wporg-showcase' ),
     27                        esc_html( $comment_type_labels[ $comment_type_key ] ?? $comment_type_labels['comment'] ),
     28                        wp_kses_post( get_comment_author_link() ),
     29                        esc_html( get_comment_date() )
     30                );
     31                ?>
     32                </cite> <?php edit_comment_link( __( 'Edit This', 'wporg-showcase' ), ' |' ); ?></p>
    2333        </li>
    2434

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-showcase/feed-extras.php

    r15170 r15190  
    1212
    1313?>
    14 <?php echo '<?xml version="1.0" encoding="'.get_option('blog_charset').'"?'.'>'; ?>
     14<?php echo '<?xml version="1.0" encoding="' . get_option( 'blog_charset' ) . '"?' . '>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- RSS feed body: the XML declaration and core feed values, not HTML. ?>
    1515
    1616<rss version="2.0"
    … …  
    2929        <link><?php bloginfo_rss('url') ?></link>
    3030        <description><?php bloginfo_rss("description") ?></description>
    31         <pubDate><?php echo mysql2date('D, d M Y H:i:s +0000', get_lastpostmodified('GMT'), false); ?></pubDate>
     31        <pubDate><?php echo mysql2date( 'D, d M Y H:i:s +0000', get_lastpostmodified( 'GMT' ), false ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- RSS feed body: the XML declaration and core feed values, not HTML. ?></pubDate>
    3232        <?php the_generator( 'rss2' ); ?>
    33         <language><?php echo get_option('rss_language'); ?></language>
    34         <sy:updatePeriod><?php echo apply_filters( 'rss_update_period', 'hourly' ); ?></sy:updatePeriod>
    35         <sy:updateFrequency><?php echo apply_filters( 'rss_update_frequency', '1' ); ?></sy:updateFrequency>
     33        <language><?php echo get_option( 'rss_language' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- RSS feed body: the XML declaration and core feed values, not HTML. ?></language>
     34        <sy:updatePeriod><?php echo apply_filters( 'rss_update_period', 'hourly' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- RSS feed body: the XML declaration and core feed values, not HTML. ?></sy:updatePeriod>
     35        <sy:updateFrequency><?php echo apply_filters( 'rss_update_frequency', '1' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- RSS feed body: the XML declaration and core feed values, not HTML. ?></sy:updateFrequency>
    3636        <?php do_action('rss2_head'); ?>
    3737        <?php while( have_posts()) : the_post(); ?>
    … …  
    4040                <link><?php the_permalink_rss() ?></link>
    4141                <comments><?php comments_link(); ?></comments>
    42                 <pubDate><?php echo mysql2date('D, d M Y H:i:s +0000', get_post_time('Y-m-d H:i:s', true), false); ?></pubDate>
     42                <pubDate><?php echo mysql2date( 'D, d M Y H:i:s +0000', get_post_time( 'Y-m-d H:i:s', true ), false ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- RSS feed body: the XML declaration and core feed values, not HTML. ?></pubDate>
    4343                <dc:creator><?php the_author() ?></dc:creator>
    4444                <?php the_category_rss() ?>

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-showcase/footer.php

    r11496 r15190  
    11<?php
    22
     3// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    34echo do_blocks( '<!-- wp:wporg/global-footer /-->' );

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-showcase/functions.php

    r15179 r15190  
    152152
    153153        if ( ! empty( $_GET['p'] ) && strlen( $_GET['p'] ) > 0 ) {
    154                 echo "<p>" . $content . "</p>";
     154                echo '<p>' . esc_html( $content ) . '</p>';
    155155        } else if ( ( strlen( $content ) > $max_char ) && ( $espacio = strpos( $content, " ", $max_char ) ) ) {
    156156                $content = substr( $content, 0, $espacio );
    157                 echo "<p>" . $content . "..." . "</p>";
    158         } else {
    159                 echo "<p>" . $content . "</p>";
     157                echo '<p>' . esc_html( $content ) . '...</p>';
     158        } else {
     159                echo '<p>' . esc_html( $content ) . '</p>';
    160160        }
    161161}
    … …  
    179179
    180180        $out .= '</ul>';
     181        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Markup assembled in this file from already-escaped parts.
    181182        echo $out;
    182183}

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-showcase/header.php

    r15170 r15190  
    33\WordPressdotorg\skip_to( '#pagebody' );
    44
     5// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    56echo do_blocks( '<!-- wp:wporg/global-header /-->' );
    67

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-showcase/page-submit.php

    r15179 r15190  
    7575
    7676<form action="/showcase/submit-a-wordpress-site/#return" method="post" id="submitform">
    77         <input type="hidden" name="comment_post_ID" value="<?php echo $post->ID; ?>" />
     77        <input type="hidden" name="comment_post_ID" value="<?php echo (int) $post->ID; ?>" />
    7878
    7979        <p><label for="submitname"><?php esc_html_e( 'Your Name', 'wporg-showcase' ); ?></label><br />

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-showcase/single.php

    r15117 r15190  
    5454                                                                                        </div>\n";
    5555
     56                                                                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Markup assembled in this file from literal strings.
    5657                                                                                echo $output;
    5758                                                                        }

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-support-2024/archive-forum.php

    r15179 r15190  
    2828        </main>
    2929
    30         <?php echo do_blocks(
     30        <?php
     31        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
     32        echo do_blocks(
    3133                sprintf(
    3234                        '<!-- wp:group {"align":"full","style":{"spacing":{"padding":{"right":"var:preset|spacing|edge-space","left":"var:preset|spacing|edge-space","top":"var:preset|spacing|40","bottom":"var:preset|spacing|40"}},"border":{"bottom":{"color":"var:preset|color|white-opacity-15","style":"solid","width":"1px"}},"elements":{"link":{"color":{"text":"var:preset|color|white"}}}},"backgroundColor":"charcoal-2","textColor":"white","className":"forums-homepage-footer","layout":{"type":"constrained"}} -->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-support-2024/archive.php

    r13604 r15190  
    1919
    2020                        <div>
    21                         <?php echo do_blocks(
     21                        <?php
     22                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
     23                        echo do_blocks(
    2224                                sprintf(
    2325                                        '<!-- wp:group {"style":{"spacing":{"blockGap":"var:preset|spacing|10"}},"className":"is-style-cards-grid","layout":{"type":"grid","minimumColumnWidth":"32.3%%"},"fontSize":"small"} -->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-support-2024/bbpress/form-topic.php

    r15188 r15190  
    3737                                        bbp_is_single_view() && 'reviews' === bbp_get_view_id()
    3838                                ) {
     39                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    3940                                        echo do_blocks(
    4041                                                sprintf(

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-support-2024/bbpress/loop-forums-homepage.php

    r15179 r15190  
    55        <h2 class="has-heading-5-font-size"><?php esc_html_e( 'Forums', 'wporg-forums' ); ?></h2>
    66
    7         <?php echo do_blocks(
     7        <?php
     8        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
     9        echo do_blocks(
    810                sprintf(
    911                        '<!-- wp:group {"style":{"spacing":{"blockGap":"var:preset|spacing|10"}},"className":"bbp-forums is-style-cards-grid","layout":{"type":"grid","minimumColumnWidth":"32.3%%"},"fontSize":"small"} -->
    … …  
    2022        <h2 class="has-heading-5-font-size"><?php esc_html_e( 'Topics', 'wporg-forums' ); ?></h2>
    2123
    22         <?php echo do_blocks(
     24        <?php
     25        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
     26        echo do_blocks(
    2327                sprintf(
    2428                        '<!-- wp:group {"style":{"spacing":{"blockGap":"var:preset|spacing|10"}},"className":"is-style-cards-grid","layout":{"type":"grid","minimumColumnWidth":"32.3%%"},"fontSize":"small"} -->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-support-2024/bbpress/loop-single-forum-homepage.php

    r14598 r15190  
    11<?php
    22
     3// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    34echo do_blocks(
    45        sprintf( '

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-support-2024/footer.php

    r11496 r15190  
    1212<?php
    1313
     14// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    1415echo do_blocks( '<!-- wp:wporg/global-footer /-->' );

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-support-2024/front-page.php

    r13604 r15190  
    1818
    1919                                        <section class="helphub-front-page">
    20                                                 <?php echo do_blocks(
     20                                                <?php
     21                                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
     22                                                echo do_blocks(
    2123                                                        sprintf(
    2224                                                                '<!-- wp:heading -->
    … …  
    4648                                <section id="forum-welcome">
    4749
    48                                         <?php echo do_blocks( '<!-- wp:pattern {"slug":"wporg-support/welcome-cards"} /-->' ); ?>
     50                                        <?php echo do_blocks( '<!-- wp:pattern {"slug":"wporg-support/welcome-cards"} /-->' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup. ?>
    4951
    5052                                </section>

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-support-2024/functions.php

    r15188 r15190  
    527527        $columns_to_fill = 3 - ( $forums_count % 3 );
    528528
     529        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    529530        echo do_blocks(
    530531                sprintf(

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-support-2024/header.php

    r14965 r15190  
    1414\WordPressdotorg\skip_to( '#content' );
    1515
     16// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    1617echo do_blocks( '<!-- wp:wporg/global-header {"style":{"border":{"bottom":{"color":"var:preset|color|white-opacity-15","style":"solid","width":"1px"}}}} /-->' );
    1718
    … …  
    4243}
    4344
     45// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    4446echo do_blocks( $is_forums_home || is_front_page() || $is_homepage
    4547        ? '<!-- wp:pattern {"slug":"wporg-support/local-nav-home"} /-->'
    … …  
    5658                <?php if ( is_front_page() || $is_homepage ) :
    5759
     60                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    5861                        echo do_blocks(
    5962                                sprintf(
    … …  
    97100                elseif ( $is_forums_home ) :
    98101
     102                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    99103                        echo do_blocks(
    100104                                sprintf(
    … …  
    138142
    139143                        if ( ! $is_user_profile && ! is_404() ) {
     144                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    140145                                echo do_blocks(
    141146                                        sprintf(
    … …  
    159164
    160165                        if ( ! ( $is_user_profile || $is_reviews || $is_plugin || $is_theme || $is_single_forum ) ) {
     166                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    161167                                echo do_blocks(
    162168                                        '<!-- wp:group {"style":{"spacing":{padding":{"left":"var:preset|spacing|edge-space","right":"var:preset|spacing|edge-space"}}}} -->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-support-2024/page-homepage.php

    r15179 r15190  
    2525
    2626                <section id="forum-welcome">
    27                         <?php echo do_blocks( '<!-- wp:pattern {"slug":"wporg-support/welcome-cards"} /-->' ); ?>
     27                        <?php echo do_blocks( '<!-- wp:pattern {"slug":"wporg-support/welcome-cards"} /-->' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup. ?>
    2828                </section>
    2929
    … …  
    3535                        <h2 class="has-heading-5-font-size"><?php esc_html_e( 'Topics', 'wporg-forums' ); ?></h2>
    3636
    37                         <?php echo do_blocks( '<!-- wp:pattern {"slug":"wporg-support/forums-views"} /-->' ); ?>
     37                        <?php echo do_blocks( '<!-- wp:pattern {"slug":"wporg-support/forums-views"} /-->' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup. ?>
    3838                </section>
    3939

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-support-2024/sidebar.php

    r15188 r15190  
    9090                                <h2><?php esc_html_e( 'Topics', 'wporg-forums' ); ?></h2>
    9191
    92                                 <?php echo do_blocks(
     92                                <?php
     93                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
     94                                echo do_blocks(
    9395                                        sprintf(
    9496                                                '<!-- wp:group {"style":{"spacing":{"blockGap":"var:preset|spacing|10"}},"className":"topic-views is-style-cards-grid","layout":{"type":"grid"},"fontSize":"small"} -->

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-support-2024/template-parts/content-page.php

    r13567 r15190  
    1919                <div class="container">
    2020                        <?php
     21                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    2122                        echo do_blocks( '<!-- wp:wporg/table-of-contents /-->' );
    2223

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg/bin/build.php

    r6555 r15190  
    1414        }
    1515
     16        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI build progress written to the console, not HTML.
    1617        echo "Building $theme...";
    1718

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg/comments.php

    r15188 r15190  
    3535                                printf(
    3636                                        /* translators: 1: title. */
    37                                         esc_html_e( 'One thought on &ldquo;%1$s&rdquo;', 'wporg' ),
    38                                         '<span>' . get_the_title() . '</span>'
     37                                        esc_html__( 'One thought on &ldquo;%1$s&rdquo;', 'wporg' ),
     38                                        '<span>' . esc_html( get_the_title() ) . '</span>'
    3939                                );
    4040                        } else {
    41                                 printf( // WPCS: XSS OK.
     41                                printf(
    4242                                        /* translators: 1: comment count number, 2: title. */
    4343                                        esc_html( _nx( '%1$s thought on &ldquo;%2$s&rdquo;', '%1$s thoughts on &ldquo;%2$s&rdquo;', $comment_count, 'comments title', 'wporg' ) ),
    4444                                        esc_html( number_format_i18n( $comment_count ) ),
    45                                         '<span>' . get_the_title() . '</span>'
     45                                        '<span>' . esc_html( get_the_title() ) . '</span>'
    4646                                );
    4747                        }

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg/footer-wporg.php

    r11496 r15190  
    1212namespace WordPressdotorg\Theme;
    1313
     14// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    1415echo do_blocks( '<!-- wp:wporg/global-footer /-->' );

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg/footer.php

    r11496 r15190  
    1919<?php
    2020
     21// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    2122echo do_blocks( '<!-- wp:wporg/global-footer /-->' );
    2223

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg/header-wporg.php

    r11496 r15190  
    1212namespace WordPressdotorg\Theme;
    1313
     14// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_blocks() renders the block markup defined here; escaping it would print the markup.
    1415echo do_blocks( '<!-- wp:wporg/global-header /-->' );

  • sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg/inc/template-tags.php

    r15179 r15190  
    2828                        );
    2929
    30                         // phpcs:disable WordPress.XSS.EscapeOutput.OutputNotEscaped
     30                        // phpcs:disable WordPress.Security.EscapeOutput.OutputNotEscaped
    3131                        printf(
    3232                                /* translators: 1: post date 2: post author */
    … …  
    3535                                $author_string
    3636                        );
    37                         // phpcs:enable WordPress.XSS.EscapeOutput.OutputNotEscaped
     37                        // phpcs:enable WordPress.Security.EscapeOutput.OutputNotEscaped
    3838                }
    3939
    … …  
    9898                        esc_html_x( 'Posted on', 'Used before publish date.', 'wporg' ),
    9999                        esc_url( get_permalink() ),
    100                         get_entry_date() // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped
     100                        get_entry_date() // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
    101101                );
    102102        }
    … …  
    115115                                '<span class="cat-links"><span class="screen-reader-text">%1$s </span>%2$s</span>',
    116116                                esc_html_x( 'Categories', 'Used before category names.', 'wporg' ),
    117                                 $categories_list // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped
     117                                $categories_list // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
    118118                        );
    119119                }
    … …  
    124124                                '<span class="tags-links"><span class="screen-reader-text">%1$s </span>%2$s</span>',
    125125                                esc_html_x( 'Tags', 'Used before tag names.', 'wporg' ),
    126                                 $tags_list // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped
     126                                $tags_list // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
    127127                        );
    128128                }

  • sites/trunk/wordpress.tv/public_html/wp-content/themes/wptv2/anon-upload-template.php

    r15170 r15190  
    252252                        if ( post_password_required() ) {
    253253                                echo '<div class="pass-form">';
     254                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_the_password_form() returns core's form markup.
    254255                                echo get_the_password_form();
    255256                                echo '</div></div></div>';
    … …  
    257258                                return;
    258259                        } else {
    259                                 echo $message;
     260                                echo wp_kses_post( $message );
    260261                        }
    261262
    … …  
    335336                                                                printf(
    336337                                                                        '<li id="category-%1$d"><label class="selectit"><input value="%1$d" type="checkbox" name="post_category[]" id="in-category-%1$d" %2$s> %3$s</label></li>',
    337                                                                         $term->term_id,
     338                                                                        (int) $term->term_id,
    338339                                                                        isset( $selected_cats[ $term->term_id ] ) ? 'checked="checked" ' : '',
    339                                                                         $term->name,
     340                                                                        esc_html( $term->name ),
    340341                                                                );
    341342                                                        }
    … …  
    358359                                                                printf(
    359360                                                                        '<li id="category-%1$d"><label class="selectit"><input value="%1$d" type="checkbox" name="post_category[]" id="in-category-%1$d" %2$s> %3$s</label></li>',
    360                                                                         $term->term_id,
     361                                                                        (int) $term->term_id,
    361362                                                                        isset( $selected_cats[ $term->term_id ] ) ? 'checked="checked" ' : '',
    362                                                                         $term->name,
     363                                                                        esc_html( $term->name ),
    363364                                                                );
    364365                                                        }

  • sites/trunk/wordpress.tv/public_html/wp-content/themes/wptv2/archive.php

    r15179 r15190  
    4444                        $tax   = get_taxonomy( $wp_query->query_vars['taxonomy'] );
    4545                        $terms = get_term_by( 'slug', $wp_query->query_vars['term'], $wp_query->query_vars['taxonomy'] );
    46                         print( "$tax->label: $terms->name" );
     46                        printf( '%s: %s', esc_html( $tax->label ), esc_html( $terms->name ) );
    4747
    4848                elseif ( is_search() ) :
    … …  
    8484                                                                $excerpt .= ' &#8212; ' . get_the_excerpt();
    8585                                                        }
     86                                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- the_excerpt filter output is already the rendered excerpt.
    8687                                                        echo apply_filters( 'the_excerpt', $excerpt );
    8788                                                ?>

  • sites/trunk/wordpress.tv/public_html/wp-content/themes/wptv2/footer.php

    r8230 r15190  
    1111                <div class="container">
    1212                        <?php wp_nav_menu( array( 'theme_location' => 'footer', 'depth' => 1 ) ); ?>
    13                         <p class="automattic">An <a href="https://automattic.com/"><img src="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4NCjwhLS0gR2VuZXJhdG9yOiBBZG9iZSBJbGx1c3RyYXRvciAxNy4xLjAsIFNWRyBFeHBvcnQgUGx1Zy1JbiAuIFNWRyBWZXJzaW9uOiA2LjAwIEJ1aWxkIDApICAtLT4NCjwhRE9DVFlQRSBzdmcgUFVCTElDICItLy9XM0MvL0RURCBTVkcgMS4xLy9FTiIgImh0dHA6Ly93d3cudzMub3JnL0dyYXBoaWNzL1NWRy8xLjEvRFREL3N2ZzExLmR0ZCI+DQo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IkxvZ28iIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4Ig0KCSB2aWV3Qm94PSIwIDAgNDk0LjQgMzguMiIgZW5hYmxlLWJhY2tncm91bmQ9Im5ldyAwIDAgNDk0LjQgMzguMiIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+DQo8cGF0aCBmaWxsPSIjODg4ODg4IiBkPSJNMTc5LjMsMzguMmMtMTIuNiwwLTIwLjctOS4xLTIwLjctMTguNXYtMS4yYzAtOS42LDguMi0xOC41LDIwLjctMTguNWMxMi42LDAsMjAuOCw4LjksMjAuOCwxOC41djEuMg0KCUMyMDAuMSwyOS4xLDE5MS45LDM4LjIsMTc5LjMsMzguMnogTTE5My4zLDE4LjZjMC02LjktNS0xMy0xNC4xLTEzYy05LjEsMC0xNCw2LjEtMTQsMTN2MC45YzAsNi45LDUsMTMuMSwxNCwxMy4xDQoJYzkuMSwwLDE0LjEtNi4yLDE0LjEtMTMuMVYxOC42eiIvPg0KPHBhdGggZmlsbD0iIzg4ODg4OCIgZD0iTTM3LjEsMzYuOEwzMi40LDI4SDExLjZMNywzNi44SDBMMTkuMiwxLjNoNS41bDE5LjUsMzUuNUgzNy4xeiBNMjEuOCw4LjJsLTcuNywxNC45aDE1LjdMMjEuOCw4LjJ6Ii8+DQo8cGF0aCBmaWxsPSIjODg4ODg4IiBkPSJNNzQuNiwzOC4yYy0xMi43LDAtMTguNy02LjktMTguNy0xNi4yVjEuM2g2LjZ2MjAuOWMwLDYuNiw0LjMsMTAuNSwxMi41LDEwLjVjOC40LDAsMTEuOS0zLjksMTEuOS0xMC41VjEuMw0KCWg2LjdWMjJDOTMuNiwzMC44LDg3LjksMzguMiw3NC42LDM4LjJ6Ii8+DQo8cGF0aCBmaWxsPSIjODg4ODg4IiBkPSJNMTMwLjcsNi44djMwaC02Ljd2LTMwaC0xNS41VjEuM2gzNy43djUuNUgxMzAuN3oiLz4NCjxwYXRoIGZpbGw9IiM4ODg4ODgiIGQ9Ik0yNTkuNSwzNi44VjguN2wtMS44LDMuMWwtMTQuOSwyNWgtMy4zbC0xNC43LTI1bC0xLjgtMy4xdjI4LjFoLTYuNVYxLjNoOS4ybDE0LDI0LjRsMS43LDNsMS43LTNMMjU3LDEuMw0KCWg5LjF2MzUuNUgyNTkuNXoiLz4NCjxwYXRoIGZpbGw9IiM4ODg4ODgiIGQ9Ik0zMTYuNSwzNi44bC00LjctOC44SDI5MWwtNC41LDguOGgtN2wxOS4yLTM1LjVoNS41bDE5LjUsMzUuNUgzMTYuNXogTTMwMS4yLDguMmwtNy43LDE0LjloMTUuN0wzMDEuMiw4LjJ6DQoJIi8+DQo8cGF0aCBmaWxsPSIjODg4ODg4IiBkPSJNMzUwLjYsNi44djMwaC02Ljd2LTMwaC0xNS41VjEuM2gzNy43djUuNUgzNTAuNnoiLz4NCjxwYXRoIGZpbGw9IiM4ODg4ODgiIGQ9Ik0zOTkuNSw2Ljh2MzBoLTYuN3YtMzBoLTE1LjVWMS4zSDQxNXY1LjVIMzk5LjV6Ii8+DQo8cGF0aCBmaWxsPSIjODg4ODg4IiBkPSJNNDMxLjQsMzYuOFY0LjZjMi43LDAsMy43LTEuNCwzLjctMy40aDIuOHYzNS41SDQzMS40eiIvPg0KPHBhdGggZmlsbD0iIzg4ODg4OCIgZD0iTTQ5MC4yLDExLjNjLTMuMi0yLjktNy45LTUuNy0xNC4yLTUuN2MtOS41LDAtMTQuOCw2LjUtMTQuOCwxMy4zdjAuN2MwLDYuNyw1LjQsMTMsMTUuMywxMw0KCWM1LjksMCwxMC44LTIuOCwxMy45LTUuN2w0LDQuMmMtMy45LDMuOC0xMC41LDcuMS0xOC4zLDcuMWMtMTMuNCwwLTIxLjYtOC43LTIxLjYtMTguM3YtMS4yYzAtOS42LDguOS0xOC43LDIxLjktMTguNw0KCWM3LjUsMCwxNC4zLDMuMSwxOCw3LjFMNDkwLjIsMTEuM3oiLz4NCjxwYXRoIGZpbGw9IiM4ODg4ODgiIGQ9Ik0xODMuNiwxMi40YzEuMiwwLjgsMS41LDIuNCwwLjgsMy42bC02LjEsOS40Yy0wLjgsMS4yLTIuNCwxLjYtMy42LDAuOGwwLDBjLTEuMi0wLjgtMS41LTIuNC0wLjgtMy42DQoJbDYuMS05LjRDMTgwLjgsMTEuOSwxODIuNCwxMS42LDE4My42LDEyLjRMMTgzLjYsMTIuNHoiLz4NCjwvc3ZnPg0K" alt="Automattic" width="165" height="14" /></a> <?php $words = array( 'Production', 'Joint', 'Medley', 'Experiment', 'Ruckus', 'Invention', 'Creation', 'Thingamajig', 'Opus', 'Brainchild', 'Contraption' ); echo $words[ mt_rand( 0, count( $words) -1 ) ]; ?></p>
     13                        <p class="automattic">An <a href="https://automattic.com/"><img src="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4NCjwhLS0gR2VuZXJhdG9yOiBBZG9iZSBJbGx1c3RyYXRvciAxNy4xLjAsIFNWRyBFeHBvcnQgUGx1Zy1JbiAuIFNWRyBWZXJzaW9uOiA2LjAwIEJ1aWxkIDApICAtLT4NCjwhRE9DVFlQRSBzdmcgUFVCTElDICItLy9XM0MvL0RURCBTVkcgMS4xLy9FTiIgImh0dHA6Ly93d3cudzMub3JnL0dyYXBoaWNzL1NWRy8xLjEvRFREL3N2ZzExLmR0ZCI+DQo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IkxvZ28iIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4Ig0KCSB2aWV3Qm94PSIwIDAgNDk0LjQgMzguMiIgZW5hYmxlLWJhY2tncm91bmQ9Im5ldyAwIDAgNDk0LjQgMzguMiIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+DQo8cGF0aCBmaWxsPSIjODg4ODg4IiBkPSJNMTc5LjMsMzguMmMtMTIuNiwwLTIwLjctOS4xLTIwLjctMTguNXYtMS4yYzAtOS42LDguMi0xOC41LDIwLjctMTguNWMxMi42LDAsMjAuOCw4LjksMjAuOCwxOC41djEuMg0KCUMyMDAuMSwyOS4xLDE5MS45LDM4LjIsMTc5LjMsMzguMnogTTE5My4zLDE4LjZjMC02LjktNS0xMy0xNC4xLTEzYy05LjEsMC0xNCw2LjEtMTQsMTN2MC45YzAsNi45LDUsMTMuMSwxNCwxMy4xDQoJYzkuMSwwLDE0LjEtNi4yLDE0LjEtMTMuMVYxOC42eiIvPg0KPHBhdGggZmlsbD0iIzg4ODg4OCIgZD0iTTM3LjEsMzYuOEwzMi40LDI4SDExLjZMNywzNi44SDBMMTkuMiwxLjNoNS41bDE5LjUsMzUuNUgzNy4xeiBNMjEuOCw4LjJsLTcuNywxNC45aDE1LjdMMjEuOCw4LjJ6Ii8+DQo8cGF0aCBmaWxsPSIjODg4ODg4IiBkPSJNNzQuNiwzOC4yYy0xMi43LDAtMTguNy02LjktMTguNy0xNi4yVjEuM2g2LjZ2MjAuOWMwLDYuNiw0LjMsMTAuNSwxMi41LDEwLjVjOC40LDAsMTEuOS0zLjksMTEuOS0xMC41VjEuMw0KCWg2LjdWMjJDOTMuNiwzMC44LDg3LjksMzguMiw3NC42LDM4LjJ6Ii8+DQo8cGF0aCBmaWxsPSIjODg4ODg4IiBkPSJNMTMwLjcsNi44djMwaC02Ljd2LTMwaC0xNS41VjEuM2gzNy43djUuNUgxMzAuN3oiLz4NCjxwYXRoIGZpbGw9IiM4ODg4ODgiIGQ9Ik0yNTkuNSwzNi44VjguN2wtMS44LDMuMWwtMTQuOSwyNWgtMy4zbC0xNC43LTI1bC0xLjgtMy4xdjI4LjFoLTYuNVYxLjNoOS4ybDE0LDI0LjRsMS43LDNsMS43LTNMMjU3LDEuMw0KCWg5LjF2MzUuNUgyNTkuNXoiLz4NCjxwYXRoIGZpbGw9IiM4ODg4ODgiIGQ9Ik0zMTYuNSwzNi44bC00LjctOC44SDI5MWwtNC41LDguOGgtN2wxOS4yLTM1LjVoNS41bDE5LjUsMzUuNUgzMTYuNXogTTMwMS4yLDguMmwtNy43LDE0LjloMTUuN0wzMDEuMiw4LjJ6DQoJIi8+DQo8cGF0aCBmaWxsPSIjODg4ODg4IiBkPSJNMzUwLjYsNi44djMwaC02Ljd2LTMwaC0xNS41VjEuM2gzNy43djUuNUgzNTAuNnoiLz4NCjxwYXRoIGZpbGw9IiM4ODg4ODgiIGQ9Ik0zOTkuNSw2Ljh2MzBoLTYuN3YtMzBoLTE1LjVWMS4zSDQxNXY1LjVIMzk5LjV6Ii8+DQo8cGF0aCBmaWxsPSIjODg4ODg4IiBkPSJNNDMxLjQsMzYuOFY0LjZjMi43LDAsMy43LTEuNCwzLjctMy40aDIuOHYzNS41SDQzMS40eiIvPg0KPHBhdGggZmlsbD0iIzg4ODg4OCIgZD0iTTQ5MC4yLDExLjNjLTMuMi0yLjktNy45LTUuNy0xNC4yLTUuN2MtOS41LDAtMTQuOCw2LjUtMTQuOCwxMy4zdjAuN2MwLDYuNyw1LjQsMTMsMTUuMywxMw0KCWM1LjksMCwxMC44LTIuOCwxMy45LTUuN2w0LDQuMmMtMy45LDMuOC0xMC41LDcuMS0xOC4zLDcuMWMtMTMuNCwwLTIxLjYtOC43LTIxLjYtMTguM3YtMS4yYzAtOS42LDguOS0xOC43LDIxLjktMTguNw0KCWM3LjUsMCwxNC4zLDMuMSwxOCw3LjFMNDkwLjIsMTEuM3oiLz4NCjxwYXRoIGZpbGw9IiM4ODg4ODgiIGQ9Ik0xODMuNiwxMi40YzEuMiwwLjgsMS41LDIuNCwwLjgsMy42bC02LjEsOS40Yy0wLjgsMS4yLTIuNCwxLjYtMy42LDAuOGwwLDBjLTEuMi0wLjgtMS41LTIuNC0wLjgtMy42DQoJbDYuMS05LjRDMTgwLjgsMTEuOSwxODIuNCwxMS42LDE4My42LDEyLjRMMTgzLjYsMTIuNHoiLz4NCjwvc3ZnPg0K" alt="Automattic" width="165" height="14" /></a>
     14                        <?php
     15                        $words = array( 'Production', 'Joint', 'Medley', 'Experiment', 'Ruckus', 'Invention', 'Creation', 'Thingamajig', 'Opus', 'Brainchild', 'Contraption' );
     16                        echo esc_html( $words[ mt_rand( 0, count( $words ) - 1 ) ] );
     17                        ?>
     18                        </p>
    1419                </div>
    1520        </div><!-- #footer -->

  • sites/trunk/wordpress.tv/public_html/wp-content/themes/wptv2/functions.php

    r15179 r15190  
    482482                                        <?php
    483483                                                edit_comment_link( __( 'edit', 'wptv' ), '&nbsp;&nbsp;', '' );
     484                                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Rendered markup: core link helpers, the_content/the_title filter output, and widget before/after wrappers.
    484485                                                echo comment_reply_link( array(
    485486                                                        'depth'     => $depth,
    … …  
    534535                }
    535536
     537                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Rendered markup: core link helpers, the_content/the_title filter output, and widget before/after wrappers.
    536538                echo $video;
    537539
    … …  
    558560                        $ret = '<img src="' . $ret . '" alt="' . esc_attr( $post->post_title ) . '" />';
    559561                }
     562                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Rendered markup: core link helpers, the_content/the_title filter output, and widget before/after wrappers.
    560563                echo $ret;
    561564        }
    … …  
    695698                        if ( in_category( $category ) ) {
    696699                                $link = get_category_link( $category );
     700                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Rendered markup: core link helpers, the_content/the_title filter output, and widget before/after wrappers.
    697701                                echo $before . ' <a href="' . esc_url( $link ) . '">' . esc_html( $category->name ) . '</a>';
    698702                                break; // only one category is printed
    … …  
    715719                foreach ( $terms as $term ) {
    716720                        $link = get_term_link( $term, 'event' );
     721                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Rendered markup: core link helpers, the_content/the_title filter output, and widget before/after wrappers.
    717722                        echo $before . '<a href="' . esc_url( $link ) . '">' . esc_html( $term->name ) . '</a>' . $after;
    718723                        break; // only the first one event is printed
    … …  
    903908                <div>
    904909                        <h3>
    905                                 <?php echo apply_filters( 'the_title', $item->title ); ?>
     910                                <?php echo apply_filters( 'the_title', $item->title ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Rendered markup: core link helpers, the_content/the_title filter output, and widget before/after wrappers. ?>
    906911                                <a href="<?php echo esc_url( $item->url ); ?>" class="view-more"><?php esc_html_e( 'More &rarr;' ); ?></a>
    907912                        </h3>

  • sites/trunk/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-anon-upload/anon-upload.php

    r14472 r15190  
    7878                // For an XHR request, just send the redirect location, don't redirect to it.
    7979                if ( isset( $_GET['xhr'] ) ) {
    80                         die( $redir );
     80                        die( $redir ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- URL response with encoded query values, including description newlines.
    8181                }
    8282
    … …  
    450450                        <div id="anon-data-wrap" class="inside">
    451451
    452                                 <p>To change the default thumbnail image, <a href="https://wordpress.com/media/wordpress.tv/<?php echo $attachment_post->ID; ?>">go here and select Edit Thumbnail</a>.</p>
     452                                <p>To change the default thumbnail image, <a href="https://wordpress.com/media/wordpress.tv/<?php echo (int) $attachment_post->ID; ?>">go here and select Edit Thumbnail</a>.</p>
    453453
    454454                                <div class="wp_attachment_holder wp-clearfix">
    455455                                <?php
     456                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- wp_video_shortcode() returns the rendered video player markup.
    456457                                echo wp_video_shortcode( array( 'src' => wp_get_attachment_url( $attachment_post->ID ) ) )
    457458                                ?>
    … …  
    505506                                                                $cat = get_term_by( 'name', substr( $meta['recorded'], 0, 4 ), 'category' );
    506507                                                                if ( $cat ) {
    507                                                                         echo '<a href="#in-category-' . $cat->term_id . '" class="button-secondary anon-approve anon-cat-link" title="Click to approve">Approve</a>';
     508                                                                        echo '<a href="#in-category-' . esc_attr( $cat->term_id ) . '" class="button-secondary anon-approve anon-cat-link" title="Click to approve">Approve</a>';
    508509                                                                }
    509510                                                        ?>
    … …  
    521522                                                                foreach ( $cats as $cat ) {
    522523                                                                        if ( intval( $cat ) ) {
    523                                                                                 echo '<a href="#in-category-' . $cat . '-2" class="anon-cat-link" title="Click to approve">Unknown?</a>, ';
     524                                                                                echo '<a href="#in-category-' . esc_attr( $cat ) . '-2" class="anon-cat-link" title="Click to approve">Unknown?</a>, ';
    524525                                                                        }
    525526                                                                }

  • sites/trunk/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-oembed/wordpresstv-oembed.php

    r8230 r15190  
    135135                                echo "<oembed>\n";
    136136                                foreach ( $data as $tag => $value ) {
     137                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- XML response element; the value is htmlspecialchars()'d and the tag name is an internal key.
    137138                                        echo "  <{$tag}>" . htmlspecialchars( $value ) . "</{$tag}>\n";
    138139                                }

  • sites/trunk/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-rest/wordpresstv-rest.php

    r12045 r15190  
    265265        function error( $message, $http_code = 404 ) {
    266266                status_header( $http_code );
    267                 exit( $message );
     267                exit( esc_html( $message ) );
    268268        }
    269269}

  • sites/trunk/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-unisubs/wordpresstv-unisubs.php

    r8230 r15190  
    166166                                echo "<item>\n";
    167167                                foreach ( $data as $tag => $value ) {
     168                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- XML response element; the value is htmlspecialchars()'d and the tag name is an internal key.
    168169                                        echo "  <{$tag}>" . htmlspecialchars( $value ) . "</{$tag}>\n";
    169170                                }

  • sites/trunk/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-upload-subtitles/wordpresstv-upload-subtitles.php

    r12041 r15190  
    380380                        <strong>Content of the subtitles file</strong><br>
    381381
    382                         <div id="subs-content"><?php echo $file_content; ?></div>
     382                        <div id="subs-content"><?php echo $file_content; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- File contents are escaped above before inserting line breaks. ?></div>
    383383
    384384                        <div class="subs-info">
    … …  
    456456                        if ( $pending_subs ) {
    457457                                echo '<div class="updated"><p><a href="upload.php?post_mime_type=' . urlencode( 'application/ttml+xml' ) .
    458                                      '&amp;detached=1">Subtitles awaiting moderation (' . $pending_subs . ')</a></p></div>';
     458                                        '&amp;detached=1">Subtitles awaiting moderation (' . (int) $pending_subs . ')</a></p></div>';
    459459                        }
    460460                }

  • sites/trunk/wordpress.tv/public_html/wp-content/themes/wptv2/upload-subtitles-template.php

    r15179 r15190  
    170170                        <p><?php printf( wp_kses_post( __( 'Hey there! If you&#8217;re interested in subtitling or captioning videos for WordPress.tv, please fill out the <a href="%s">contact form</a>, and we&#8217;ll be in touch.', 'wptv' ) ), 'https://wordpress.tv/contact/' ); ?></p>
    171171                        <div class="pass-form">
    172                                 <?php echo get_the_password_form(); ?>
     172                                <?php echo get_the_password_form(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Core template markup and the_title-filtered value; escaping would print the markup. ?>
    173173                        </div>
    174174                </div>
    … …  
    244244<div class="container">
    245245        <div class="video-upload">
    246                 <?php echo $message; ?>
    247 
    248                 <p>Subtitling: <a href="<?php echo esc_url( get_permalink( $parent->ID ) ); ?>"><?php echo apply_filters( 'the_title', $parent->post_title ); ?></a></p>
     246                <?php echo wp_kses_post( $message ); ?>
     247
     248                <p>Subtitling: <a href="<?php echo esc_url( get_permalink( $parent->ID ) ); ?>"><?php echo apply_filters( 'the_title', $parent->post_title ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Core template markup and the_title-filtered value; escaping would print the markup. ?></a></p>
    249249
    250250                <form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" id="video-upload-form" enctype="multipart/form-data">

  • sites/trunk/wp15.wordpress.net/public_html/content/mu-plugins/locales.php

    r15179 r15190  
    5757
    5858                if ( ! $po_content || ! $mo_content || false === strpos( $po_content, 'Project-Id-Version: Meta - wp15.wordpress.net' ) ) {
     59                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Written to the error log by trigger_error(), not rendered.
    5960                        trigger_error( "Invalid PO/MO content for {$set->wp_locale}." );
    6061                        continue;

  • sites/trunk/wp15.wordpress.net/public_html/content/plugins/wp15-meetup-events/libraries/class-meetup-client.php

    r9874 r15190  
    227227
    228228                                if ( 'cli' === php_sapi_name() ) {
     229                                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI import progress written to the console, not HTML.
    229230                                        echo "\nRequest failed $attempt_count times. Pausing for $wait seconds before retrying.";
    230231                                }
    … …  
    236237                if ( $attempt_count === $max_attempts && 'cli' === php_sapi_name() ) {
    237238                        if ( 200 !== $response_code || is_wp_error( $response ) ) {
     239                                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI import progress written to the console, not HTML.
    238240                                echo "\nRequest failed $attempt_count times. Giving up.";
    239241                        }
    … …  
    317319
    318320                if ( 'cli' === php_sapi_name() ) {
     321                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI import progress written to the console, not HTML.
    319322                        echo "\nPausing for $period seconds to avoid rate-limiting.";
    320323                }

  • sites/trunk/wp15.wordpress.net/public_html/content/plugins/wp15-meetup-events/wp15-meetup-events.php

    r7248 r15190  
    4646
    4747        if ( is_wp_error( $potential_events ) ) {
     48                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Written to the error log by trigger_error(), not rendered.
    4849                trigger_error( $potential_events->get_error_message() );
    4950                return;

  • sites/trunk/wp15.wordpress.net/public_html/content/themes/twentyseventeen-wp15/functions.php

    r7177 r15190  
    300300        ?>
    301301        <meta property="og:type" content="website" />
    302         <meta property="og:title" content="<?php echo wp_get_document_title(); ?>" />
    303         <meta property="og:description" content="<?php echo internationalize_titles( 'WordPress turns 15 on May 27, 2018' ); ?>" />
     302        <meta property="og:title" content="<?php echo esc_attr( wp_get_document_title() ); ?>" />
     303        <meta property="og:description" content="<?php echo esc_attr( internationalize_titles( 'WordPress turns 15 on May 27, 2018' ) ); ?>" />
    304304        <meta property="og:url" content="https://wp15.wordpress.net/" />
    305         <meta property="og:site_name" content="<?php echo internationalize_titles( 'WP15' ); ?>" />
     305        <meta property="og:site_name" content="<?php echo esc_attr( internationalize_titles( 'WP15' ) ); ?>" />
    306306        <meta property="og:image" content="https://wp15.wordpress.net/content/uploads/2018/03/wp15-logo-square.png" />
    307         <meta property="og:locale" content="<?php echo get_locale(); ?>" />
     307        <meta property="og:locale" content="<?php echo esc_attr( get_locale() ); ?>" />
    308308        <meta name="twitter:card" content="summary" />
    309309        <meta name="twitter:url" content="https://wp15.wordpress.net/" />
    310         <meta name="twitter:title" content="<?php echo wp_get_document_title(); ?>" />
    311         <meta name="twitter:description" content="<?php echo internationalize_titles( 'WordPress turns 15 on May 27, 2018' ); ?>" />
     310        <meta name="twitter:title" content="<?php echo esc_attr( wp_get_document_title() ); ?>" />
     311        <meta name="twitter:description" content="<?php echo esc_attr( internationalize_titles( 'WordPress turns 15 on May 27, 2018' ) ); ?>" />
    312312        <meta name="twitter:image" content="https://wp15.wordpress.net/content/uploads/2018/03/wp15-logo-square.png" />
    313313        <?php

  • sites/trunk/wp15.wordpress.net/public_html/content/themes/twentyseventeen-wp15/page-swag.php

    r7187 r15190  
    6060                                                </p>
    6161
    62                                                 <?php echo wp_oembed_get( 'https://mercantile.wordpress.org/product/wordpress-15th-anniversary-mug/' ); ?>
    63                                                 <?php echo wp_oembed_get( 'https://mercantile.wordpress.org/product/wordpress-15th-anniversary-tshirt/' ); ?>
     62                                                <?php echo wp_oembed_get( 'https://mercantile.wordpress.org/product/wordpress-15th-anniversary-mug/' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- wp_oembed_get() returns the embed markup. ?>
     63                                                <?php echo wp_oembed_get( 'https://mercantile.wordpress.org/product/wordpress-15th-anniversary-tshirt/' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- wp_oembed_get() returns the embed markup. ?>
    6464
    6565                                        </div>
Note: See TracChangeset for help on using the changeset viewer.