Changeset 45252 for trunk/src/wp-admin/includes/class-wp-ms-users-list-table.php

Timestamp:

04/19/2019 01:50:32 PM (6 years ago)

Author:

SergeyBiryukov

Message:

Networks and Sites: Use correct escaping function for classes added via ms_user_list_site_class filter.

Props david.binda.
Fixes #46990. See #41146.

File:

• trunk/src/wp-admin/includes/class-wp-ms-users-list-table.php (modified) (1 diff)

trunk/src/wp-admin/includes/class-wp-ms-users-list-table.php

@@ -353 +353 @@
             if ( is_array( $site_classes ) && ! empty( $site_classes ) ) {
                 $site_classes = array_map( 'sanitize_html_class', array_unique( $site_classes ) );
-                echo '<span class="' . sanitize_html_class( implode( ' ', $site_classes ) ) . '">';
+                echo '<span class="' . esc_attr( implode( ' ', $site_classes ) ) . '">';
             } else {
                 echo '<span>';