Sanitization: when falling back to (wait for it...) `$fallback` in `sanitize_html_class()`, sanitize it as well.

Props MikeHansenMe, wonderboymusic.
Fixes #30967.

Built from https://develop.svn.wordpress.org/trunk@34377


git-svn-id: http://core.svn.wordpress.org/trunk@34341 1a063a9b-81f0-0310-95a4-ce76da25c4cd

wp-includes/formatting.php

@@ -1600,9 +1600,9 @@ function sanitize_html_class( $class, $fallback = '' ) {
 	//Limit to A-Z,a-z,0-9,_,-
 	$sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $sanitized );
 
-	if ( '' == $sanitized )
-		$sanitized = $fallback;
-
+	if ( '' == $sanitized && $fallback ) {
+		return sanitize_html_class( $fallback );
+	}
 	/**
 	 * Filter a sanitized HTML class string.
 	 *

wp-includes/version.php

@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.4-alpha-34376';
+$wp_version = '4.4-alpha-34377';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.