Hardening: Add escaping to the language attributes used on `html` elements.

Merges [42259] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42281


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42110 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
John Blackbourn 2017-11-29 16:26:31 +00:00
parent f19b2b4635
commit cc28f09509
1 changed files with 7 additions and 5 deletions

View File

@ -2912,11 +2912,13 @@ function get_language_attributes( $doctype = 'html' ) {
$attributes[] = 'dir="rtl"';
if ( $lang = get_bloginfo( 'language' ) ) {
if ( get_option('html_type') == 'text/html' || $doctype == 'html' )
$attributes[] = "lang=\"$lang\"";
if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
$attributes[] = 'lang="' . esc_attr( $lang ) . '"';
}
if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' )
$attributes[] = "xml:lang=\"$lang\"";
if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
$attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
}
}
$output = implode(' ', $attributes);