Changeset 42259

Timestamp:

11/29/2017 03:54:05 PM (7 years ago)

Author:

johnbillion

Message:

Hardening: Add escaping to the language attributes used on html elements.

File:

• trunk/src/wp-includes/general-template.php (modified) (1 diff)

trunk/src/wp-includes/general-template.php

@@ -3569 +3569 @@
         $attributes[] = 'dir="rtl"';
 
-    if ( $lang = get_bloginfo('language') ) {
-        if ( get_option('html_type') == 'text/html' || $doctype == 'html' )
-            $attributes[] = "lang=\"$lang\"";
-
-        if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' )
-            $attributes[] = "xml:lang=\"$lang\"";
+    if ( $lang = get_bloginfo( 'language' ) ) {
+        if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
+            $attributes[] = 'lang="' . esc_attr( $lang ) . '"';
+        }
+
+        if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
+            $attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
+        }
     }