Make WordPress Core


Ignore:
Timestamp:
11/29/2017 04:35:08 PM (6 years ago)
Author:
johnbillion
Message:

Hardening: Add escaping to the language attributes used on html elements.

Merges [42259] to the 4.1 branch.

Location:
branches/4.1
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.1

  • branches/4.1/src/wp-includes/general-template.php

    r31435 r42297  
    25142514        $attributes[] = 'dir="rtl"';
    25152515
    2516     if ( $lang = get_bloginfo('language') ) {
    2517         if ( get_option('html_type') == 'text/html' || $doctype == 'html' )
    2518             $attributes[] = "lang=\"$lang\"";
    2519 
    2520         if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' )
    2521             $attributes[] = "xml:lang=\"$lang\"";
     2516    if ( $lang = get_bloginfo( 'language' ) ) {
     2517        if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
     2518            $attributes[] = 'lang="' . esc_attr( $lang ) . '"';
     2519        }
     2520
     2521        if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
     2522            $attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
     2523        }
    25222524    }
    25232525
Note: See TracChangeset for help on using the changeset viewer.