WordPress.org

Make WordPress Core

Ticket #22327: 22327.patch

File 22327.patch, 1.0 KB (added by johnjamesjacoby, 6 years ago)
  • wp-admin/includes/template.php

     
    10771077
    10781078        foreach ( (array) $wp_settings_sections[$page] as $section ) {
    10791079                if ( $section['title'] )
    1080                         echo "<h3>{$section['title']}</h3>\n";
     1080                        echo '<h3>' . esc_html( $section['title'] ) . "</h3>\n";
    10811081
    10821082                if ( $section['callback'] )
    10831083                        call_user_func( $section['callback'], $section );
     
    11131113        foreach ( (array) $wp_settings_fields[$page][$section] as $field ) {
    11141114                echo '<tr valign="top">';
    11151115                if ( !empty($field['args']['label_for']) )
    1116                         echo '<th scope="row"><label for="' . $field['args']['label_for'] . '">' . $field['title'] . '</label></th>';
     1116                        echo '<th scope="row"><label for="' . esc_attr( $field['args']['label_for'] ) . '">' . esc_html( $field['title'] ) . '</label></th>';
    11171117                else
    1118                         echo '<th scope="row">' . $field['title'] . '</th>';
     1118                        echo '<th scope="row">' . esc_html( $field['title'] ) . '</th>';
    11191119                echo '<td>';
    11201120                call_user_func($field['callback'], $field['args']);
    11211121                echo '</td>';