Changeset 6819

Timestamp:

05/14/2018 08:42:23 PM (8 years ago)

Author:

johnjamesjacoby

Message:

Prefer sanitize_html_class() over esc_attr().

This change uses the correct formatting function in places where potentially untrusted class strings are ran through array_map().

Location:

trunk/src/includes

Files:

• admin/classes/class-bbp-admin.php (modified) (1 diff)
• forums/template.php (modified) (1 diff)

trunk/src/includes/admin/classes/class-bbp-admin.php

@@ -341 +341 @@
 
         // Assemble the message
-        $message = '<div id="message" class="notice ' . implode( ' ', array_map( 'esc_attr', $classes ) ) . '">' . $message . '</div>';
+        $message = '<div id="message" class="notice ' . implode( ' ', array_map( 'sanitize_html_class', $classes ) ) . '">' . $message . '</div>';
         $message = str_replace( "'", "\'", $message );
 

trunk/src/includes/forums/template.php

@@ -754 +754 @@
 
         // This could use bbp_get_forum_class() eventually...
-        $subforum_classes_attr = 'class="' . implode( ' ', array_map( 'esc_attr', $subforum_classes ) ) . '"';
+        $subforum_classes_attr = 'class="' . implode( ' ', array_map( 'sanitize_html_class', $subforum_classes ) ) . '"';
 
         // Build this sub forums link