WordPress.org

Make WordPress Core

Ticket #20125: 20125.diff

File 20125.diff, 788 bytes (added by tollmanz, 6 years ago)
  • wp-admin/includes/template.php

     
    12661266
    12671267        $output = '';
    12681268        foreach ( $settings_errors as $key => $details ) {
    1269                 $css_id = 'setting-error-' . $details['code'];
    1270                 $css_class = $details['type'] . ' settings-error';
     1269                $css_id = 'setting-error-' . esc_attr( $details['code'] );
     1270                $css_class = esc_attr( $details['type'] ) . ' settings-error';
    12711271                $output .= "<div id='$css_id' class='$css_class'> \n";
    1272                 $output .= "<p><strong>{$details['message']}</strong></p>";
     1272                $output .= "<p><strong>" . wp_kses_data( $details['message'] ) . "</strong></p>";
    12731273                $output .= "</div> \n";
    12741274        }
    12751275        echo $output;