From aea22e6fdfbd90ad33a4d37753ef1574b601f200 Mon Sep 17 00:00:00 2001
From: audrasjb <audrasjb@git.wordpress.org>
Date: Mon, 17 Oct 2022 11:26:11 +0000
Subject: [PATCH] Customize: Escape blogname option in underscores templates.

Props xknown, martinkrcho.

Built from https://develop.svn.wordpress.org/trunk@54526


git-svn-id: http://core.svn.wordpress.org/trunk@54081 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 .../customize/class-wp-customize-header-image-control.php   | 6 +++---
 .../customize/class-wp-customize-site-icon-control.php      | 2 +-
 wp-includes/media-template.php                              | 2 +-
 wp-includes/version.php                                     | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/wp-includes/customize/class-wp-customize-header-image-control.php b/wp-includes/customize/class-wp-customize-header-image-control.php
index 98bf8af6d0..a48a97c996 100644
--- a/wp-includes/customize/class-wp-customize-header-image-control.php
+++ b/wp-includes/customize/class-wp-customize-header-image-control.php
@@ -131,10 +131,10 @@ class WP_Customize_Header_Image_Control extends WP_Customize_Image_Control {
 			<# } else { #>
 
 			<button type="button" class="choice thumbnail"
-				data-customize-image-value="{{{data.header.url}}}"
+				data-customize-image-value="{{data.header.url}}"
 				data-customize-header-image-data="{{JSON.stringify(data.header)}}">
 				<span class="screen-reader-text"><?php _e( 'Set image' ); ?></span>
-				<img src="{{{data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}" />
+				<img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" />
 			</button>
 
 			<# if ( data.type === 'uploaded' ) { #>
@@ -159,7 +159,7 @@ class WP_Customize_Header_Image_Control extends WP_Customize_Image_Control {
 
 				<# } else { #>
 
-			<img src="{{{data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}" />
+			<img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" />
 
 				<# } #>
 			<# } else { #>
diff --git a/wp-includes/customize/class-wp-customize-site-icon-control.php b/wp-includes/customize/class-wp-customize-site-icon-control.php
index 7b689657fa..942000a57d 100644
--- a/wp-includes/customize/class-wp-customize-site-icon-control.php
+++ b/wp-includes/customize/class-wp-customize-site-icon-control.php
@@ -68,7 +68,7 @@ class WP_Customize_Site_Icon_Control extends WP_Customize_Cropped_Image_Control
 							<div class="favicon">
 								<img src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>" />
 							</div>
-							<span class="browser-title" aria-hidden="true"><# print( '<?php bloginfo( 'name' ); ?>' ) #></span>
+							<span class="browser-title" aria-hidden="true"><# print( '<?php echo esc_js( get_bloginfo( 'name' ) ); ?>' ) #></span>
 						</div>
 						<img class="app-icon-preview" src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as an app icon' ); ?>" />
 					</div>
diff --git a/wp-includes/media-template.php b/wp-includes/media-template.php
index 826649be39..8de6170da9 100644
--- a/wp-includes/media-template.php
+++ b/wp-includes/media-template.php
@@ -1497,7 +1497,7 @@ function wp_print_media_templates() {
 			<div class="favicon">
 				<img id="preview-favicon" src="{{ data.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>" />
 			</div>
-			<span class="browser-title" aria-hidden="true"><# print( '<?php bloginfo( 'name' ); ?>' ) #></span>
+			<span class="browser-title" aria-hidden="true"><# print( '<?php echo esc_js( get_bloginfo( 'name' ) ); ?>' ) #></span>
 		</div>
 
 		<strong aria-hidden="true"><?php _e( 'As an app icon' ); ?></strong>
diff --git a/wp-includes/version.php b/wp-includes/version.php
index c002a08019..8be439b902 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.1-RC1-54525';
+$wp_version = '6.1-RC1-54526';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.