Ticket #37623: 37623.4.diff

src/wp-admin/includes/update.php

@@ -631 +631 @@
 function wp_print_admin_notice_templates() {
         ?>
         <script id="tmpl-wp-updates-admin-notice" type="text/html">
-                <div <# if ( data.id ) { #>id="{{ data.id }}"<# } #> class="notice {{ data.className }}"><p>{{ data.message }}</p></div>
+                <div <# if ( data.id ) { #>id="{{ data.id }}"<# } #> class="notice {{ data.className }}"><p>{{{ data.message }}}</p></div>
         </script>
         <script id="tmpl-wp-bulk-updates-admin-notice" type="text/html">
                 <div id="{{ data.id }}" class="{{ data.className }} notice <# if ( data.errors ) { #>notice-error<# } else { #>notice-success<# } #>">

src/wp-admin/js/updates.js

@@ -1608 +1608 @@
                 wp.updates.addAdminNotice( {
                         id:        'unknown_error',
                         className: 'notice-error is-dismissible',
-                        message:   errorMessage
+                        message:   _.escape( errorMessage )
                 } );
 
                 // Remove the lock, and clear the queue.