Add more sanitization in _cleanup_header_comment

[seanklein]

The _cleanup_header_comment function is used in multiple places, but one in particular can cause some problems on the Page edit screen (or any screen that uses page templates). The get_page_templates function (which gets the list of page templates to display in a <select> box on the page edit screen) uses to cleanup the page templates retrieved from a file.

Unfortunately the function does not sanitize enough, and if (for instance) JavaScript existed in the page template name it would be run on the Page Edit screen.

To test, add some JavaScript (with <script> tags) to the "Template Name:" line of a page template, and load the Page edit screen.

[kawauso]

It appears to be used in get_file_data() (which is sanitized properly where used), get_file_description() and get_page_templates().

The attached patch sanitizes uses of the latter two with esc_html(), apart from get_page_templates() in wp_getPageTemplates(). Not really sure what to do with that.

It also standardises trim() usage on get_file_description($file) and makes the $filedesc logic actually understandable.

[Mte90]

patch refreshed

[Mte90]

Patch refreshed but I am not sure if there are other part that require this sanitization because it is very old that ticket.

[johnbillion]

In 41399:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Props kawauso, Mte90 for initial patches

Fixes #13377

[johnbillion]

In 41412:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41399], with additions, to the 4.8 branch.

See #13377

[johnbillion]

In 41413:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41412] to the 4.7 branch

See #13377

[johnbillion]

In 41414:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41413] to the 4.6 branch

See #13377

[johnbillion]

In 41415:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41414] into the 4.5. branch

See #13377

[johnbillion]

In 41416:

General: Remove context added in [41414] in order to avoid a string change in a point release.

See #13377

[johnbillion]

In 41434:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41415] and [41416] into the 4.4 branch.

See #13377

[johnbillion]

In 41444:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41434] with changes to the 4.3 branch.

See #13377

[johnbillion]

In 41445:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41434] with changes to the 4.2 branch.

See #13377

[johnbillion]

In 41446:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41434] with changes to the 4.1 branch.

See #13377

[johnbillion]

In 41447:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41434] with changes to the 4.0 branch.

See #13377

[johnbillion]

In 41449:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41434] with changes to the 3.9 branch.

See #13377

[johnbillion]

In 41452:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41434] with changes to the 3.8 branch.

See #13377

[johnbillion]

In 41456:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41434] with changes to the 3.7 branch.

See #13377