Ticket #37623: 37623.2.diff

src/wp-admin/includes/update.php

@@ -631 +631 @@
 function wp_print_admin_notice_templates() {
         ?>
         <script id="tmpl-wp-updates-admin-notice" type="text/html">
-                <div <# if ( data.id ) { #>id="{{ data.id }}"<# } #> class="notice {{ data.className }}"><p>{{ data.message }}</p></div>
+                <div <# if ( data.id ) { #>id="{{ data.id }}"<# } #> class="notice {{ data.className }}"><p>{{{ data.message }}}</p></div>
         </script>
         <script id="tmpl-wp-bulk-updates-admin-notice" type="text/html">
                 <div id="{{ data.id }}" class="{{ data.className }} notice <# if ( data.errors ) { #>notice-error<# } else { #>notice-success<# } #>">

src/wp-admin/js/updates.js

@@ -1602 +1602 @@
 
                 // Messages are escaped, remove HTML tags to make them more readable.
                 error = error.replace( /<[\/a-z][^<>]*>/gi, '' );
+                error = _.escape( error );
                 errorMessage = errorMessage.replace( '%s', error );
 
                 // Add admin notice.