Changeset 42289

Timestamp:

11/29/2017 04:29:35 PM (8 years ago)

Author:

johnbillion

Message:

Hardening: Add escaping to the language attributes used on html elements.

Merges [42259] to the 4.3 branch.

Location:

branches/4.3

Files:

• . (modified) (1 prop)
• src/wp-includes/general-template.php (modified) (1 diff)

branches/4.3/src/wp-includes/general-template.php

@@ -2628 +2628 @@
         $attributes[] = 'dir="rtl"';
 
-    if ( $lang = get_bloginfo('language') ) {
-        if ( get_option('html_type') == 'text/html' || $doctype == 'html' )
-            $attributes[] = "lang=\"$lang\"";
-
-        if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' )
-            $attributes[] = "xml:lang=\"$lang\"";
+    if ( $lang = get_bloginfo( 'language' ) ) {
+        if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
+            $attributes[] = 'lang="' . esc_attr( $lang ) . '"';
+        }
+
+        if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
+            $attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
+        }
     }