Changeset 29083

Timestamp:

07/11/2014 01:09:32 AM (10 years ago)

Author:

SergeyBiryukov

Message:

Avoid inadvertently adding admin page titles as classes for admin menu submenu items.

fixes #28817.

Location:

trunk/src/wp-admin

Files:

• menu-header.php (modified) (3 diffs)
• menu.php (modified) (1 diff)

trunk/src/wp-admin/menu-header.php

@@ -74 +74 @@
 
         if ( ! empty( $item[4] ) )
-            $class[] = $item[4];
+            $class[] = esc_attr( $item[4] );
 
         $class = $class ? ' class="' . join( ' ', $class ) . '"' : '';
@@ -137 +137 @@
             $first = true;
 
-            // 0 = menu_title, 1 = capability, 2 = menu_slug, 3 = classes
+            // 0 = menu_title, 1 = capability, 2 = menu_slug, 3 = page_title, 4 = classes
             foreach ( $submenu_items as $sub_key => $sub_item ) {
                 if ( ! current_user_can( $sub_item[1] ) )
@@ -168 +168 @@
                 }
 
-                if ( ! empty( $sub_item[3] ) ) {
-                    $class[] = $sub_item[3];
+                if ( ! empty( $sub_item[4] ) ) {
+                    $class[] = esc_attr( $sub_item[4] );
                 }
 

trunk/src/wp-admin/menu.php

@@ -149 +149 @@
 
     $customize_url = add_query_arg( 'return', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), 'customize.php' );
-    $submenu['themes.php'][6] = array( __( 'Customize' ), 'edit_theme_options', $customize_url, 'hide-if-no-customize' );
+    $submenu['themes.php'][6] = array( __( 'Customize' ), 'edit_theme_options', $customize_url, '', 'hide-if-no-customize' );
     unset( $customize_url );
     if ( current_theme_supports( 'menus' ) || current_theme_supports( 'widgets' ) ) {