From fc1980e3694557f3024c7bde36fc7e63dc5cb481 Mon Sep 17 00:00:00 2001 From: Scott Taylor Date: Tue, 22 Sep 2015 04:30:11 +0000 Subject: [PATCH] Sanitization: when falling back to (wait for it...) `$fallback` in `sanitize_html_class()`, sanitize it as well. Props MikeHansenMe, wonderboymusic. Fixes #30967. git-svn-id: https://develop.svn.wordpress.org/trunk@34377 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/formatting.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/wp-includes/formatting.php b/src/wp-includes/formatting.php index 240a21a928..7140dc2c4e 100644 --- a/src/wp-includes/formatting.php +++ b/src/wp-includes/formatting.php @@ -1600,9 +1600,9 @@ function sanitize_html_class( $class, $fallback = '' ) { //Limit to A-Z,a-z,0-9,_,- $sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $sanitized ); - if ( '' == $sanitized ) - $sanitized = $fallback; - + if ( '' == $sanitized && $fallback ) { + return sanitize_html_class( $fallback ); + } /** * Filter a sanitized HTML class string. *