Changeset 48060

Timestamp:

06/16/2020 04:55:45 PM (4 years ago)

Author:

whyisjake

Message:

Themes: Add additional later escaping to post_class() and body_class() functions.

Additionally, this adds a few tests to test output.

Fixes #20009.

Props mfields, scribu, azaozz, obenland, dd32, nacin, jrf, jdgrimes, garyj, whyisjake.

Location:

trunk

Files:

• src/wp-includes/post-template.php (modified) (2 diffs)
• tests/phpunit/tests/post/bodyClass.php (added)
• tests/phpunit/tests/post/postClass.php (added)

trunk/src/wp-includes/post-template.php

@@ -455 +455 @@
 function post_class( $class = '', $post_id = null ) {
     // Separates classes with a single space, collates classes for post DIV.
-    echo 'class="' . join( ' ', get_post_class( $class, $post_id ) ) . '"';
+    echo 'class="' . esc_attr( join( ' ', get_post_class( $class, $post_id ) ) ) . '"';
 }
 
@@ -591 +591 @@
 function body_class( $class = '' ) {
     // Separates class names with a single space, collates class names for body element.
-    echo 'class="' . join( ' ', get_body_class( $class ) ) . '"';
+    echo 'class="' . esc_attr( join( ' ', get_body_class( $class ) ) ) . '"';
 }