From 2ca28e49fc489a9bb3c9c9c0d8907a033fe056ef Mon Sep 17 00:00:00 2001
From: Jb Audras <audrasjb@git.wordpress.org>
Date: Mon, 17 Oct 2022 11:24:08 +0000
Subject: [PATCH] Customize: Escape blogname option in underscores templates.

Props xknown, martinkrcho.


git-svn-id: https://develop.svn.wordpress.org/trunk@54526 602fd350-edb4-49c9-b593-d223f7449a82
---
 .../customize/class-wp-customize-header-image-control.php   | 6 +++---
 .../customize/class-wp-customize-site-icon-control.php      | 2 +-
 src/wp-includes/media-template.php                          | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/wp-includes/customize/class-wp-customize-header-image-control.php b/src/wp-includes/customize/class-wp-customize-header-image-control.php
index 98bf8af6d0..a48a97c996 100644
--- a/src/wp-includes/customize/class-wp-customize-header-image-control.php
+++ b/src/wp-includes/customize/class-wp-customize-header-image-control.php
@@ -131,10 +131,10 @@ class WP_Customize_Header_Image_Control extends WP_Customize_Image_Control {
 			<# } else { #>
 
 			<button type="button" class="choice thumbnail"
-				data-customize-image-value="{{{data.header.url}}}"
+				data-customize-image-value="{{data.header.url}}"
 				data-customize-header-image-data="{{JSON.stringify(data.header)}}">
 				<span class="screen-reader-text"><?php _e( 'Set image' ); ?></span>
-				<img src="{{{data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}" />
+				<img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" />
 			</button>
 
 			<# if ( data.type === 'uploaded' ) { #>
@@ -159,7 +159,7 @@ class WP_Customize_Header_Image_Control extends WP_Customize_Image_Control {
 
 				<# } else { #>
 
-			<img src="{{{data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}" />
+			<img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" />
 
 				<# } #>
 			<# } else { #>
diff --git a/src/wp-includes/customize/class-wp-customize-site-icon-control.php b/src/wp-includes/customize/class-wp-customize-site-icon-control.php
index 7b689657fa..942000a57d 100644
--- a/src/wp-includes/customize/class-wp-customize-site-icon-control.php
+++ b/src/wp-includes/customize/class-wp-customize-site-icon-control.php
@@ -68,7 +68,7 @@ class WP_Customize_Site_Icon_Control extends WP_Customize_Cropped_Image_Control
 							<div class="favicon">
 								<img src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>" />
 							</div>
-							<span class="browser-title" aria-hidden="true"><# print( '<?php bloginfo( 'name' ); ?>' ) #></span>
+							<span class="browser-title" aria-hidden="true"><# print( '<?php echo esc_js( get_bloginfo( 'name' ) ); ?>' ) #></span>
 						</div>
 						<img class="app-icon-preview" src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as an app icon' ); ?>" />
 					</div>
diff --git a/src/wp-includes/media-template.php b/src/wp-includes/media-template.php
index 826649be39..8de6170da9 100644
--- a/src/wp-includes/media-template.php
+++ b/src/wp-includes/media-template.php
@@ -1497,7 +1497,7 @@ function wp_print_media_templates() {
 			<div class="favicon">
 				<img id="preview-favicon" src="{{ data.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>" />
 			</div>
-			<span class="browser-title" aria-hidden="true"><# print( '<?php bloginfo( 'name' ); ?>' ) #></span>
+			<span class="browser-title" aria-hidden="true"><# print( '<?php echo esc_js( get_bloginfo( 'name' ) ); ?>' ) #></span>
 		</div>
 
 		<strong aria-hidden="true"><?php _e( 'As an app icon' ); ?></strong>