Changeset 51115 for trunk/src/wp-admin/includes/class-wp-users-list-table.php

Timestamp:

06/08/2021 10:20:42 PM (3 years ago)

Author:

whyisjake

Message:

Administration: Escape the values of data-colname.

Adds a esc_attr wrapper to strip_all_tags.

See [33016].

Fixes #40401.

Props rellect, SergeyBiryukov, hareesh-pillai, audrasjb.

File:

• trunk/src/wp-admin/includes/class-wp-users-list-table.php (modified) (1 diff)

trunk/src/wp-admin/includes/class-wp-users-list-table.php

@@ -532 +532 @@
             }
 
-            $data = 'data-colname="' . wp_strip_all_tags( $column_display_name ) . '"';
+            $data = 'data-colname="' . esc_attr( wp_strip_all_tags( $column_display_name ) ) . '"';
 
             $attributes = "class='$classes' $data";