Changeset 29083 for trunk/src/wp-admin/menu-header.php

Timestamp:

07/11/2014 01:09:32 AM (11 years ago)

Author:

SergeyBiryukov

Message:

Avoid inadvertently adding admin page titles as classes for admin menu submenu items.

fixes #28817.

File:

• trunk/src/wp-admin/menu-header.php (modified) (3 diffs)

trunk/src/wp-admin/menu-header.php

@@ -74 +74 @@
 
         if ( ! empty( $item[4] ) )
-            $class[] = $item[4];
+            $class[] = esc_attr( $item[4] );
 
         $class = $class ? ' class="' . join( ' ', $class ) . '"' : '';
@@ -137 +137 @@
             $first = true;
 
-            // 0 = menu_title, 1 = capability, 2 = menu_slug, 3 = classes
+            // 0 = menu_title, 1 = capability, 2 = menu_slug, 3 = page_title, 4 = classes
             foreach ( $submenu_items as $sub_key => $sub_item ) {
                 if ( ! current_user_can( $sub_item[1] ) )
@@ -168 +168 @@
                 }
 
-                if ( ! empty( $sub_item[3] ) ) {
-                    $class[] = $sub_item[3];
+                if ( ! empty( $sub_item[4] ) ) {
+                    $class[] = esc_attr( $sub_item[4] );
                 }