WordPress.org

Make WordPress Core

Ticket #22327: 22327.patch

File 22327.patch, 1.0 KB (added by johnjamesjacoby, 18 months ago)
  • wp-admin/includes/template.php

     
    10771077 
    10781078        foreach ( (array) $wp_settings_sections[$page] as $section ) { 
    10791079                if ( $section['title'] ) 
    1080                         echo "<h3>{$section['title']}</h3>\n"; 
     1080                        echo '<h3>' . esc_html( $section['title'] ) . "</h3>\n"; 
    10811081 
    10821082                if ( $section['callback'] ) 
    10831083                        call_user_func( $section['callback'], $section ); 
     
    11131113        foreach ( (array) $wp_settings_fields[$page][$section] as $field ) { 
    11141114                echo '<tr valign="top">'; 
    11151115                if ( !empty($field['args']['label_for']) ) 
    1116                         echo '<th scope="row"><label for="' . $field['args']['label_for'] . '">' . $field['title'] . '</label></th>'; 
     1116                        echo '<th scope="row"><label for="' . esc_attr( $field['args']['label_for'] ) . '">' . esc_html( $field['title'] ) . '</label></th>'; 
    11171117                else 
    1118                         echo '<th scope="row">' . $field['title'] . '</th>'; 
     1118                        echo '<th scope="row">' . esc_html( $field['title'] ) . '</th>'; 
    11191119                echo '<td>'; 
    11201120                call_user_func($field['callback'], $field['args']); 
    11211121                echo '</td>';