add esc_html before the admin title display

[lalitpendhare]

I have found esc_html is missing before the admin title on line number 67.

file location: "wp-admin/admin-header.php".

[lalitpendhare]

add esc_html before the admin title display on line 67

[adnan.limdi]

Hello Lalitpendhare, i think, you have created wrong patch file. so here i have update new patch file.

[SergeyBiryukov]

Hi @lalitpendhare, thanks for the ticket!

The title already runs through esc_html() a few lines above​, what's the reason for escaping it twice?

[swissspidy]

@adnan.limdi The diff was correct, just the file extension was off.

[adnan.limdi]

Replying to swissspidy:

@adnan.limdi The diff was correct, just the file extension was off.

yes @swissspidy you are right that's why i update it.

@SergeyBiryukov here apply_filters added that's why we have add esc_html(); again for improvement.

[subrataemfluence]

Hello @lalitpendhare, I agree with @SergeyBiryukov specially in the context of present coding pattern.

$admin_title = apply_filters( 'admin_title', $admin_title, $title );

Although the above line has apply_filters applied, the extra content parameter $admin_title is already being outputted using an esc_html above and not changing in between before this line is executed. So adding another esc_html will be kind of useless.

However, as @adnan.limdi mentioned, because there is an apply_filters and in future releases there could be a chance of $admin_title value gets change before the line in question, it is always safe to have esc_html applied at the point where the actual output is generated.

I personally feel what @lalitpendhare has recommended is good to integrate as an enhancement.

[andraganescu]

@SergeyBiryukov the reason is that the title passes through a filter and it might undo the effect of the esc_html above. Whenever there is such a possibility all throughout the codebase esc_html is used right at output time, like in this patch., therefore I think this is a good patch.

[SergeyBiryukov]

In 47474:

Administration: Escape admin title on output after the admin_title filter runs, not before.

Props lalitpendhare, adnan.limdi, subrataemfluence, andraganescu.
Fixes #41921.