XSS in wp-admin/options.php

[Denis-de-Bernardy]

There are quite a few lines in there, such as:

<th scope='row'><label for='$option->option_name'>$option->option_name</label></th>

[nacin]

I just patched this, then realized we esc_attr() at the top of the loop, so we're secure here.

I'm going to move the esc_attr() down further so it's more obvious.

[nacin]

(In [13471]) Make it more obvious we're escaping values in options.php. fixes #12417

[Denis-de-Bernardy]

I think you broke the label tag, in r13471.

[nacin]

Correct. Second changeset didn't get posted here. r13472