Changeset 51115 for trunk/src/wp-admin/includes/class-wp-list-table.php

Timestamp:

06/08/2021 10:20:42 PM (4 years ago)

Author:

whyisjake

Message:

Administration: Escape the values of data-colname.

Adds a esc_attr wrapper to strip_all_tags.

See [33016].

Fixes #40401.

Props rellect, SergeyBiryukov, hareesh-pillai, audrasjb.

File:

• trunk/src/wp-admin/includes/class-wp-list-table.php (modified) (1 diff)

trunk/src/wp-admin/includes/class-wp-list-table.php

@@ -1426 +1426 @@
 
             // Comments column uses HTML in the display name with screen reader text.
-            // Instead of using esc_attr(), we strip tags to get closer to a user-friendly string.
-            $data = 'data-colname="' . wp_strip_all_tags( $column_display_name ) . '"';
+            // Strip tags to get closer to a user-friendly string.
+            $data = 'data-colname="' . esc_attr( wp_strip_all_tags( $column_display_name ) ) . '"';
 
             $attributes = "class='$classes' $data";