Changeset 13975

Timestamp:

04/03/2010 11:04:37 PM (15 years ago)

Author:

nacin

Message:

Ensure we're escaping css classes for front end nav menu.

File:

• trunk/wp-includes/classes.php (modified) (1 diff)

trunk/wp-includes/classes.php

@@ -1184 +1184 @@
         $indent = ( $depth ) ? str_repeat( "\t", $depth ) : '';
 
+        $classes = $value = '';
         if ( 'frontend' == $args->context ) {
             global $wp_query;
 
-            $css_class = array( 'menu-item', 'menu-item-type-'. $item->type, $item->classes );
+            $classes = array( 'menu-item', 'menu-item-type-'. $item->type, $item->classes );
 
             if ( 'custom' != $item->object )
-                $css_class[] = 'menu-item-object-'. $item->object;
+                $classes[] = 'menu-item-object-'. $item->object;
 
             if ( $item->object_id == $wp_query->get_queried_object_id() )
-                $css_class[] = 'current-menu-item';
+                $classes[] = 'current-menu-item';
 
             // @todo add classes for parent/child relationships
 
-            $css_class = join( ' ', apply_filters( 'nav_menu_css_class', array_filter( $css_class ), $item ) );
-        }
-
-        $maybe_value = ( 'backend' == $args->context ) ? ' value="'. $item->ID .'"' : '';
-        $maybe_classes = ( 'frontend' == $args->context ) ? ' class="'. $css_class .'"' : '';
-
-        $output .= $indent . '<li id="menu-item-'. $item->ID .'"'. $maybe_value . $maybe_classes .'>' . wp_get_nav_menu_item( $item, $args->context, $args );
+            $classes = join( ' ', apply_filters( 'nav_menu_css_class', array_filter( $classes ), $item ) );
+            $classes = ' class="' . esc_attr( $classes ) . '"';
+        } else {
+            $value = ' value="' . $item->ID . '"';
+        }
+
+        $output .= $indent . '<li id="menu-item-'. $item->ID . '"' . $value . $classes .'>' . wp_get_nav_menu_item( $item, $args->context, $args );
     }