sergiotarxz
/
Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Twenty Fifteen: only escape HTML attribute output with `esc_attr()`. See #30133, props ocean90. 

git-svn-id: https://develop.svn.wordpress.org/trunk@30081 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Lance Willett 2014-10-28 23:07:32 +00:00
parent 66e02d639e
commit acbf0229cf
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/wp-content/themes/twentyfifteen/inc/custom-header.php
View File

@ -149,13 +149,13 @@ if ( ! function_exists( 'twentyfifteen_admin_header_image' ) ) :
* @see twentyfifteen_custom_header_setup().
*/
function twentyfifteen_admin_header_image() {
$style = sprintf( ' style="color: #%s;"', get_header_textcolor() );
$style = sprintf( ' style="color: #%s;"', esc_attr( get_header_textcolor() ) );
$color_scheme = twentyfifteen_get_color_scheme();
$header_background_color = get_theme_mod( 'header_background_color', $color_scheme[1] );
?>
<div id="headimg" style="background-image: url(<?php header_image(); ?>); background-color: <?php echo esc_attr( $header_background_color ); ?>;">
<h1 class="displaying-header-text"><a id="name"<?php echo esc_attr( $style ); ?> onclick="return false;" href="<?php echo esc_url( home_url( '/' ) ); ?>"><?php bloginfo( 'name' ); ?></a></h1>
<div id="desc" class="displaying-header-text"<?php echo esc_attr( $style ); ?>><?php bloginfo( 'description' ); ?></div>
<h1 class="displaying-header-text"><a id="name"<?php echo $style; ?> onclick="return false;" href="<?php echo esc_url( home_url( '/' ) ); ?>"><?php bloginfo( 'name' ); ?></a></h1>
<div id="desc" class="displaying-header-text"<?php echo $style; ?>><?php bloginfo( 'description' ); ?></div>
</div>
<?php
}