WordPress.org

Make WordPress Core

Ticket #22327: 22327.2.patch

File 22327.2.patch, 597 bytes (added by johnjamesjacoby, 3 years ago)

esc_attr() only, to allow title's to include HTML

  • wp-admin/includes/template.php

     
    11131113        foreach ( (array) $wp_settings_fields[$page][$section] as $field ) { 
    11141114                echo '<tr valign="top">'; 
    11151115                if ( !empty($field['args']['label_for']) ) 
    1116                         echo '<th scope="row"><label for="' . $field['args']['label_for'] . '">' . $field['title'] . '</label></th>'; 
     1116                        echo '<th scope="row"><label for="' . esc_attr( $field['args']['label_for'] ) . '">' . $field['title'] . '</label></th>'; 
    11171117                else 
    11181118                        echo '<th scope="row">' . $field['title'] . '</th>'; 
    11191119                echo '<td>';