WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Hardening: Add escaping to the language attributes used on `html` elements. 

Merges [42259] to the 4.8 branch.

Built from https://develop.svn.wordpress.org/branches/4.8@42269


git-svn-id: http://core.svn.wordpress.org/branches/4.8@42098 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
John Blackbourn 2017-11-29 16:14:07 +00:00
parent 2aba074c5b
commit c5713fc570
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
wp-includes/general-template.php
View File

@ -3153,11 +3153,13 @@ function get_language_attributes( $doctype = 'html' ) {
$attributes[] = 'dir="rtl"'; $attributes[] = 'dir="rtl"';
if ( $lang = get_bloginfo( 'language' ) ) { if ( $lang = get_bloginfo( 'language' ) ) {
if ( get_option('html_type') == 'text/html' || $doctype == 'html' ) if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
$attributes[] = "lang=\"$lang\""; $attributes[] = 'lang="' . esc_attr( $lang ) . '"';
}
if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' ) if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
$attributes[] = "xml:lang=\"$lang\""; $attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
}
} }
$output = implode(' ', $attributes); $output = implode(' ', $attributes);