Changeset 43366

Timestamp:

06/16/2018 01:54:50 PM (6 years ago)

Author:

johnbillion

Message:

Options, Meta APIs: Use the correct escaping function when outputting the meta box context.

Props khaihong, abdullahramzan, leanderiversen, aryamaaru, lbenicio, palmiak

Fixes #44274

Merges [43365] to the 4.9 branch.

Location:

branches/4.9

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/template.php (modified) (1 diff)

branches/4.9/src/wp-admin/includes/template.php

@@ -1019 +1019 @@
     $hidden = get_hidden_meta_boxes( $screen );
 
-    printf('<div id="%s-sortables" class="meta-box-sortables">', htmlspecialchars($context));
+    printf( '<div id="%s-sortables" class="meta-box-sortables">', esc_attr( $context ) );
 
     // Grab the ones the user has manually sorted. Pull them out of their previous context/priority and into the one the user chose