Changeset 47474

Timestamp:

03/20/2020 02:18:53 AM (3 years ago)

Author:

SergeyBiryukov

Message:

Administration: Escape admin title on output after the admin_title filter runs, not before.

Props lalitpendhare, adnan.limdi, subrataemfluence, andraganescu.
Fixes #41921.

Location:

trunk/src/wp-admin

Files:

• admin-header.php (modified) (2 diffs)
• customize.php (modified) (1 diff)

trunk/src/wp-admin/admin-header.php

@@ -33 +33 @@
 
 get_admin_page_title();
-$title = esc_html( strip_tags( $title ) );
+$title = strip_tags( $title );
 
 if ( is_network_admin() ) {
     /* translators: Network admin screen title. %s: Network title. */
-    $admin_title = sprintf( __( 'Network Admin: %s' ), esc_html( get_network()->site_name ) );
+    $admin_title = sprintf( __( 'Network Admin: %s' ), get_network()->site_name );
 } elseif ( is_user_admin() ) {
     /* translators: User dashboard screen title. %s: Network title. */
-    $admin_title = sprintf( __( 'User Dashboard: %s' ), esc_html( get_network()->site_name ) );
+    $admin_title = sprintf( __( 'User Dashboard: %s' ), get_network()->site_name );
 } else {
     $admin_title = get_bloginfo( 'name' );
@@ -72 +72 @@
 _wp_admin_html_begin();
 ?>
-<title><?php echo $admin_title; ?></title>
+<title><?php echo esc_html( $admin_title ); ?></title>
 <?php
 

trunk/src/wp-admin/customize.php

@@ -151 +151 @@
 
 ?>
-<title><?php echo $admin_title; ?></title>
+<title><?php echo esc_html( $admin_title ); ?></title>
 
 <script type="text/javascript">