From e6ede0c816bb3e49fb55565a19db2899d69430ee Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov.ru@gmail.com>
Date: Wed, 20 Oct 2021 19:18:01 +0000
Subject: [PATCH] Coding Standards: Improve escaping in
 `wp-admin/theme-install.php`.

* Rename a duplicate `$feature_name` variable to `$feature_group` for clarity.
* Escape the remaining `$feature_name` variable.

Follow-up to [27636], [35273].

Props sabbirshouvo, sabernhardt, mukesh27, afragen.
Fixes #54277.
Built from https://develop.svn.wordpress.org/trunk@51923


git-svn-id: http://core.svn.wordpress.org/trunk@51516 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/theme-install.php | 7 +++----
 wp-includes/version.php    | 2 +-
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/wp-admin/theme-install.php b/wp-admin/theme-install.php
index 4f0ba2ad66..cd3a607ea9 100644
--- a/wp-admin/theme-install.php
+++ b/wp-admin/theme-install.php
@@ -221,15 +221,14 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
 		// and to ensure tags are translated.
 		$feature_list = get_theme_feature_list( false );
 
-		foreach ( $feature_list as $feature_name => $features ) {
+		foreach ( $feature_list as $feature_group => $features ) {
 			echo '<fieldset class="filter-group">';
-			$feature_name = esc_html( $feature_name );
-			echo '<legend>' . $feature_name . '</legend>';
+			echo '<legend>' . esc_html( $feature_group ) . '</legend>';
 			echo '<div class="filter-group-feature">';
 			foreach ( $features as $feature => $feature_name ) {
 				$feature = esc_attr( $feature );
 				echo '<input type="checkbox" id="filter-id-' . $feature . '" value="' . $feature . '" /> ';
-				echo '<label for="filter-id-' . $feature . '">' . $feature_name . '</label>';
+				echo '<label for="filter-id-' . $feature . '">' . esc_html( $feature_name ) . '</label>';
 			}
 			echo '</div>';
 			echo '</fieldset>';
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 0b956e542e..8572d81edd 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.9-alpha-51922';
+$wp_version = '5.9-alpha-51923';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.