Hardening: Add escaping to the language attributes used on `html` elements.
Merges [42259] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@42281 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42110 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
parent
f19b2b4635
commit
cc28f09509
|
@ -2912,11 +2912,13 @@ function get_language_attributes( $doctype = 'html' ) {
|
|||
$attributes[] = 'dir="rtl"';
|
||||
|
||||
if ( $lang = get_bloginfo( 'language' ) ) {
|
||||
if ( get_option('html_type') == 'text/html' || $doctype == 'html' )
|
||||
$attributes[] = "lang=\"$lang\"";
|
||||
if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
|
||||
$attributes[] = 'lang="' . esc_attr( $lang ) . '"';
|
||||
}
|
||||
|
||||
if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' )
|
||||
$attributes[] = "xml:lang=\"$lang\"";
|
||||
if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
|
||||
$attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
|
||||
}
|
||||
}
|
||||
|
||||
$output = implode(' ', $attributes);
|
||||
|
|
Loading…
Reference in New Issue