WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Hardening: Add escaping to the language attributes used on `html` elements. 

Merges [42259] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@42293


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42122 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
John Blackbourn 2017-11-29 16:33:54 +00:00
parent f345c93563
commit 63cc2673a1
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
wp-includes/general-template.php
View File

@ -2523,11 +2523,13 @@ function language_attributes($doctype = 'html') {
$attributes[] = 'dir="rtl"';
if ( $lang = get_bloginfo( 'language' ) ) {
if ( get_option('html_type') == 'text/html' || $doctype == 'html' )
$attributes[] = "lang=\"$lang\"";
if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
$attributes[] = 'lang="' . esc_attr( $lang ) . '"';
}
if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' )
$attributes[] = "xml:lang=\"$lang\"";
if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
$attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
}
}
$output = implode(' ', $attributes);