Make WordPress Core


Ignore:
Timestamp:
11/29/2017 04:21:22 PM (6 years ago)
Author:
johnbillion
Message:

Hardening: Add escaping to the language attributes used on html elements.

Merges [42259] to the 4.6 branch.

Location:
branches/4.6
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.6

  • branches/4.6/src/wp-includes/general-template.php

    r38473 r42277  
    30493049        $attributes[] = 'dir="rtl"';
    30503050
    3051     if ( $lang = get_bloginfo('language') ) {
    3052         if ( get_option('html_type') == 'text/html' || $doctype == 'html' )
    3053             $attributes[] = "lang=\"$lang\"";
    3054 
    3055         if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' )
    3056             $attributes[] = "xml:lang=\"$lang\"";
     3051    if ( $lang = get_bloginfo( 'language' ) ) {
     3052        if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
     3053            $attributes[] = 'lang="' . esc_attr( $lang ) . '"';
     3054        }
     3055
     3056        if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
     3057            $attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
     3058        }
    30573059    }
    30583060
Note: See TracChangeset for help on using the changeset viewer.