From 22068f006cde456af9c3e49a8b49b53afc834260 Mon Sep 17 00:00:00 2001 From: John Blackbourn Date: Wed, 29 Nov 2017 16:22:33 +0000 Subject: [PATCH] Hardening: Add escaping to the language attributes used on `html` elements. Merges [42259] to the 4.6 branch. Built from https://develop.svn.wordpress.org/branches/4.6@42277 git-svn-id: http://core.svn.wordpress.org/branches/4.6@42106 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/general-template.php | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/wp-includes/general-template.php b/wp-includes/general-template.php index a5d5ea7dba..a246fda33c 100644 --- a/wp-includes/general-template.php +++ b/wp-includes/general-template.php @@ -3048,12 +3048,14 @@ function get_language_attributes( $doctype = 'html' ) { if ( function_exists( 'is_rtl' ) && is_rtl() ) $attributes[] = 'dir="rtl"'; - if ( $lang = get_bloginfo('language') ) { - if ( get_option('html_type') == 'text/html' || $doctype == 'html' ) - $attributes[] = "lang=\"$lang\""; + if ( $lang = get_bloginfo( 'language' ) ) { + if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) { + $attributes[] = 'lang="' . esc_attr( $lang ) . '"'; + } - if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' ) - $attributes[] = "xml:lang=\"$lang\""; + if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) { + $attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"'; + } } $output = implode(' ', $attributes);