Changeset 30081 for trunk/src/wp-content/themes/twentyfifteen/inc/custom-header.php

Timestamp:

10/28/2014 11:07:32 PM (11 years ago)

Author:

lancewillett

Message:

Twenty Fifteen: only escape HTML attribute output with esc_attr(). See #30133, props ocean90.

File:

• trunk/src/wp-content/themes/twentyfifteen/inc/custom-header.php (modified) (1 diff)

trunk/src/wp-content/themes/twentyfifteen/inc/custom-header.php

@@ -150 +150 @@
  */
 function twentyfifteen_admin_header_image() {
-    $style                   = sprintf( ' style="color: #%s;"', get_header_textcolor() );
+    $style                   = sprintf( ' style="color: #%s;"', esc_attr( get_header_textcolor() ) );
     $color_scheme            = twentyfifteen_get_color_scheme();
     $header_background_color = get_theme_mod( 'header_background_color', $color_scheme[1] );
 ?>
     <div id="headimg" style="background-image: url(<?php header_image(); ?>); background-color: <?php echo esc_attr( $header_background_color ); ?>;">
-        <h1 class="displaying-header-text"><a id="name"<?php echo esc_attr( $style ); ?> onclick="return false;" href="<?php echo esc_url( home_url( '/' ) ); ?>"><?php bloginfo( 'name' ); ?></a></h1>
-        <div id="desc" class="displaying-header-text"<?php echo esc_attr( $style ); ?>><?php bloginfo( 'description' ); ?></div>
+        <h1 class="displaying-header-text"><a id="name"<?php echo $style; ?> onclick="return false;" href="<?php echo esc_url( home_url( '/' ) ); ?>"><?php bloginfo( 'name' ); ?></a></h1>
+        <div id="desc" class="displaying-header-text"<?php echo $style; ?>><?php bloginfo( 'description' ); ?></div>
     </div>
 <?php