Skip to content

Photo Directory: make EXIF value handling consistent and escape metadata output #853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
obenland wants to merge 2 commits into from
Closed

Photo Directory: make EXIF value handling consistent and escape metadata output #853

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
82b60b9
Photo Directory: make EXIF value handling consistent and escape metad…
obenland Sep 1, 2026
8e1dfed
Photo Directory: use single quotes for the fallback filename string
obenland Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions wordpress.org/public_html/wp-content/plugins/photo-directory/inc/admin.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,8 +166,8 @@ public static function add_notice_if_flagged_or_unflagged() {
esc_attr( $notice_type ),
sprintf(
$notice,
'https://profiles.wordpress.org/' . $user->user_nicename . '/',
sanitize_text_field( $user->display_name )
esc_url( 'https://profiles.wordpress.org/' . $user->user_nicename . '/' ),
esc_html( $user->display_name )
)
);
}
Expand Down
2 changes: 1 addition & 1 deletion wordpress.org/public_html/wp-content/plugins/photo-directory/inc/flagged.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -286,7 +286,7 @@ public static function output_flagged_photos_count_to_author( $post ) {
. sprintf(
/* translators: %s: Count of user's flagged photos possibly linked to listing of their flagged photos. */
_n( 'Flagged: <strong>%s</strong>', 'Flagged: <strong>%s</strong>', $flagged_count, 'wporg-photos' ),
$flagged_link ? sprintf( '<a href="%s">%d</a>', $flagged_link, $flagged_count ) : $flagged_count
$flagged_link ? sprintf( '<a href="%s">%d</a>', esc_url( $flagged_link ), $flagged_count ) : $flagged_count
)
. "</div>\n";
}
Expand Down
4 changes: 2 additions & 2 deletions wordpress.org/public_html/wp-content/plugins/photo-directory/inc/moderation.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -759,8 +759,8 @@ public static function output_list_of_pending_submissions_for_user( $content, $u
foreach ( $pending as $post ) {
$content .= sprintf(
"<tr><td>%s</td><td>%s</td><td>%s</td></tr>\n",
get_post_meta( $post->ID, Registrations::get_meta_key( 'original_filename' ), true ) ?: __( "(unknown)", 'wporg-photos' ),
get_the_date( 'Y-m-d', $post ),
esc_html( get_post_meta( $post->ID, Registrations::get_meta_key( 'original_filename' ), true ) ?: __( '(unknown)', 'wporg-photos' ) ),
esc_html( get_the_date( 'Y-m-d', $post ) ),
esc_html( get_the_content( null, false, $post ) ?: __( '(none provided)', 'wporg-photos' ) ),
);
}
Expand Down
7 changes: 6 additions & 1 deletion wordpress.org/public_html/wp-content/plugins/photo-directory/inc/photo.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -956,6 +956,11 @@ public static function get_exif( $post_id, $exif_keys = [] ) {
break;
case 'iso':
$label = 'ISO';
// Cast to discard the arbitrary string EXIF can supply for this tag.
$value = (int) $value;
if ( 0 >= $value ) {
continue 2;
}
break;
case 'shutter_speed':
$label = 'Shutter Speed';
Expand Down Expand Up @@ -1124,7 +1129,7 @@ public static function get_moderator_link( $post = null ) {
$link = sprintf(
'<span id="photo-moderator"><a href="%s">%s</a></span>',
esc_url( 'https://profiles.wordpress.org/' . $moderator->user_nicename . '/' ),
sanitize_text_field( $moderator->display_name )
esc_html( $moderator->display_name )
);
}

Expand Down
10 changes: 5 additions & 5 deletions wordpress.org/public_html/wp-content/plugins/photo-directory/inc/template-tags.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ function show_colors( $post = 0, $echo = true ) {
'<span class="photo-color photo-color-%s"><a href="%s">%s</a></span>',
esc_attr( $color->slug ),
esc_url( get_term_link( $color->slug, Registrations::get_taxonomy( 'colors' ) ) ),
$color->name
esc_html( $color->name )
);
}
$output .= implode( ', ', $colors_output );
Expand Down Expand Up @@ -82,7 +82,7 @@ function show_categories( $post = 0, $echo = true ) {
'<a class="photo-category photo-category-%s" href="%s">%s</a>',
esc_attr( $cat->slug ),
esc_url( get_term_link( $cat->slug, Registrations::get_taxonomy( 'categories' ) ) ),
$cat->name
esc_html( $cat->name )
);
}
$output .= implode( ', ', $cats_output );
Expand Down Expand Up @@ -127,7 +127,7 @@ function show_tags( $post = 0, $echo = true ) {
'<li class="photo-tag photo-tag-%s"><a href="%s">%s</a></li>',
esc_attr( $tag->slug ),
esc_url( get_term_link( $tag->slug, Registrations::get_taxonomy( 'tags' ) ) ),
$tag->name
esc_html( $tag->name )
);
}

Expand Down Expand Up @@ -206,8 +206,8 @@ function show_exif( $post = 0, $echo = true ) {
$exif_output[] = sprintf(
'<li><span class="photo-exif photo-exif-%s">%s: <strong>%s</strong></span></li>',
esc_attr( $key ),
$item['label'],
$item['value']
esc_html( $item['label'] ),
esc_html( $item['value'] )
);
}
$output .= implode( "\n", $exif_output );
Expand Down