From bd9421104a7920056d6095b00e1f94eb291b44dd Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov.ru@gmail.com>
Date: Fri, 19 Apr 2019 13:51:51 +0000
Subject: [PATCH] Networks and Sites: Use correct escaping function for classes
 added via ` ms_user_list_site_class` filter.

Props david.binda.
Fixes #46990. See #41146.
Built from https://develop.svn.wordpress.org/trunk@45252


git-svn-id: http://core.svn.wordpress.org/trunk@45061 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/includes/class-wp-ms-users-list-table.php | 2 +-
 wp-includes/version.php                            | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/wp-admin/includes/class-wp-ms-users-list-table.php b/wp-admin/includes/class-wp-ms-users-list-table.php
index cd109e6c83..e3d619ae80 100644
--- a/wp-admin/includes/class-wp-ms-users-list-table.php
+++ b/wp-admin/includes/class-wp-ms-users-list-table.php
@@ -352,7 +352,7 @@ class WP_MS_Users_List_Table extends WP_List_Table {
 			$site_classes = apply_filters( 'ms_user_list_site_class', $site_classes, $val->userblog_id, $val->site_id, $user );
 			if ( is_array( $site_classes ) && ! empty( $site_classes ) ) {
 				$site_classes = array_map( 'sanitize_html_class', array_unique( $site_classes ) );
-				echo '<span class="' . sanitize_html_class( implode( ' ', $site_classes ) ) . '">';
+				echo '<span class="' . esc_attr( implode( ' ', $site_classes ) ) . '">';
 			} else {
 				echo '<span>';
 			}
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 3621b164d3..d90e653ada 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -13,7 +13,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.2-beta3-45251';
+$wp_version = '5.2-beta3-45252';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.