Changeset 51923

Timestamp:

10/20/2021 07:17:00 PM (3 years ago)

Author:

SergeyBiryukov

Message:

Coding Standards: Improve escaping in wp-admin/theme-install.php.

• Rename a duplicate $feature_name variable to $feature_group for clarity.
• Escape the remaining $feature_name variable.

Follow-up to [27636], [35273].

Props sabbirshouvo, sabernhardt, mukesh27, afragen.
Fixes #54277.

File:

• trunk/src/wp-admin/theme-install.php (modified) (1 diff)

trunk/src/wp-admin/theme-install.php

@@ -222 +222 @@
         $feature_list = get_theme_feature_list( false );
 
-        foreach ( $feature_list as $feature_name => $features ) {
+        foreach ( $feature_list as $feature_group => $features ) {
             echo '<fieldset class="filter-group">';
-            $feature_name = esc_html( $feature_name );
-            echo '<legend>' . $feature_name . '</legend>';
+            echo '<legend>' . esc_html( $feature_group ) . '</legend>';
             echo '<div class="filter-group-feature">';
             foreach ( $features as $feature => $feature_name ) {
                 $feature = esc_attr( $feature );
                 echo '<input type="checkbox" id="filter-id-' . $feature . '" value="' . $feature . '" /> ';
-                echo '<label for="filter-id-' . $feature . '">' . $feature_name . '</label>';
+                echo '<label for="filter-id-' . $feature . '">' . esc_html( $feature_name ) . '</label>';
             }
             echo '</div>';