Changeset 50575 for trunk

Timestamp:

03/25/2021 12:25:37 AM (3 years ago)

Author:

peterwilsoncc

Message:

Script Loader: Escape HTML5 boolean attribute names.

Add escaping of boolean attribute names in wp_sanitize_script_attributes() for themes supporting HTML5 script elements.

Props tmatsuur, johnbillion, joyously.
Fixes #52894.

File:

• trunk/src/wp-includes/script-loader.php (modified) (1 diff)

trunk/src/wp-includes/script-loader.php

@@ -2354 +2354 @@
         if ( is_bool( $attribute_value ) ) {
             if ( $attribute_value ) {
-                $attributes_string .= $html5_script_support ? sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_name ) ) : ' ' . $attribute_name;
+                $attributes_string .= $html5_script_support ? sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_name ) ) : ' ' . esc_attr( $attribute_name );
             }
         } else {