Ticket #27942: 27942.4.patch

src/wp-includes/formatting.php

@@ -3706 +3706 @@
                         if ( is_wp_error( $value ) ) {
                                 $error = $value->get_error_message();
                         } else {
-                                $value = wp_kses_post( $value );
                                 $value = esc_html( $value );
                         }
                         break;

tests/phpunit/tests/formatting/BlogInfo.php

@@ -31 +31 @@
                         array( 'pt_PT_ao1990', 'pt-PT-ao1990' ),
                 );
         }
+
+        /**
+         * @ticket 27942
+         */
+        function test_bloginfo_blogname() {
+                $old_value = get_option( 'blogname' );
+
+                $options = array(
+                        'foo' => 'foo',
+                        '<em>foo</em>' => '&lt;em&gt;foo&lt;/em&gt;',
+                        '<script>foo</script>' => '&lt;script&gt;foo&lt;/script&gt;',
+                        '&lt;foo&gt;' => '&lt;foo&gt;',
+                        '<foo' => '&lt;foo',
+                );
+
+                foreach ( $options as $value => $expected ) {
+                        $sanitized_value = sanitize_option( 'blogname', $value );
+                        update_option( 'blogname', $sanitized_value );
+
+                        $this->assertEquals( $expected, $sanitized_value );
+                        $this->assertEquals( $expected, get_bloginfo( 'blogname' ) );
+                        $this->assertEquals( $expected, get_bloginfo( 'blogname', 'display' ) );
+                }
+
+                update_option( 'blogname', $old_value );
+        }
 }