Merge pull request #35 from WP-API/escape-errors

rmccue · web-flow · commit 677a3eac8d79 · 2017-07-11T17:29:21.000+10:00
Escape errors before rendering to HTML
diff --git a/inc/endpoints/class-authorization.php b/inc/endpoints/class-authorization.php
@@ -47,7 +47,7 @@ public function handle_request() {
 
 		if ( is_wp_error( $result ) ) {
 			// TODO: Handle it.
-			wp_die( $result->get_error_message() );
+			wp_die( esc_html( $result->get_error_message() ) );
 		}
 		exit;
 	}

Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ public function handle_request() {`
`47`	`47`
`48`	`48`	`if ( is_wp_error( $result ) ) {`
`49`	`49`	`// TODO: Handle it.`
`50`		`- wp_die( $result->get_error_message() );`
	`50`	`+ wp_die( esc_html( $result->get_error_message() ) );`
`51`	`51`	`}`
`52`	`52`	`exit;`
`53`	`53`	`}`