WP4.0-beta1 - string concatenation for $page_title in add_submenu_page() is broken

[harmr]

within my plugin "Maps Marker Pro" I add a object page to show the plugin´s admin pages within the WordPress admin navigation by the following code:

$page = add_object_page('Maps Marker', 'Maps Marker', $capabilities, 'leafletmapsmarker_markers', array(&$this, 'lmm_list_markers'), LEAFLET_PLUGIN_URL . 'inc/img/icon-menu-page' . $mp6_icon . '.png' );

subpages are then added via add_submenu_page:

if ($lmm_options['misc_whitelabel_backend'] == 'enabled') {
	$menu_name = esc_attr__('Maps','lmm');
} else {
	$menu_name = '<span style="font-size:92%;">Maps Marker Pro</span>';
}
...
$page2 = add_submenu_page('leafletmapsmarker_markers', $menu_name . ' - ' . __('List all markers', 'lmm'), '<img src="' . LEAFLET_PLUGIN_URL . 'inc/img/icon-menu-list' . $mp6_icon . '.png"> ' . __('List all markers', 'lmm'), $lmm_options[ 'capabilities_edit' ], 'leafletmapsmarker_markers', array(&$this, 'lmm_list_markers') );
$page3 = add_submenu_page('leafletmapsmarker_markers', $menu_name . ' - ' . __('add/edit marker', 'lmm'), '<img src="' . LEAFLET_PLUGIN_URL . 'inc/img/icon-menu-add' . $mp6_icon . '.png"> ' . __('Add new marker', 'lmm'), $lmm_options[ 'capabilities_edit' ], 'leafletmapsmarker_marker', array(&$this, 'lmm_marker') );
...

Since WP4.0-beta1 string concentation for

$menu_name . ' - ' . __('List all markers', 'lmm')

does not work anymore - within the nav menu, the title is echoed, see attached screenshots for a comparison.

I checked the function add_submenu_page() within /wp-admin/includes/plugin.php but it didnt seem to have changed with WP4.0-beta1, so I am probably missing something here.

working nav submenu in WP 3.9.1:

broken nav submenu in WP 4.0-beta1:

Is this a bug with WordPress or is string concatenation as I am doing it here not supported anymore?
thanx for any hint!

[SergeyBiryukov]

Confirmed, thank you for the report. The code results in broken markup:

<li class="wp-first-item <span style="font-size:92%;">Maps Marker Pro</span> - List all markers">

Introduced in [28778].

1. Both $item[3] and $sub_item[3] are reserved for page title, see [27151] and add_submenu_page()​.
2. We should definitely use sanitize_html_class() there.

See 28817.patch​.

[SergeyBiryukov]

Well, sanitize_html_class() doesn't allow for multiple classes. Let's at least use esc_attr().

[SergeyBiryukov]

In 29083:

Avoid inadvertently adding admin page titles as classes for admin menu submenu items.

fixes #28817.