WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Hardening: Add escaping to the language attributes used on `html` elements. 

Merges [42259] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42281


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42110 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
John Blackbourn 2017-11-29 16:26:31 +00:00
parent f19b2b4635
commit cc28f09509
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
wp-includes/general-template.php
View File

@ -2911,12 +2911,14 @@ function get_language_attributes( $doctype = 'html' ) {
if ( function_exists( 'is_rtl' ) && is_rtl() ) if ( function_exists( 'is_rtl' ) && is_rtl() )
$attributes[] = 'dir="rtl"'; $attributes[] = 'dir="rtl"';
if ( $lang = get_bloginfo('language') ) { if ( $lang = get_bloginfo( 'language' ) ) {
if ( get_option('html_type') == 'text/html' || $doctype == 'html' ) if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
$attributes[] = "lang=\"$lang\""; $attributes[] = 'lang="' . esc_attr( $lang ) . '"';
}
if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' ) if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
$attributes[] = "xml:lang=\"$lang\""; $attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
}
} }
$output = implode(' ', $attributes); $output = implode(' ', $attributes);