| @@ -12,9 +12,9 @@ | ||
| 12 | 12 | |
| 13 | 13 | /** |
| 14 | 14 | * Output a bbPress specific tools box |
| 15 | 15 | * |
| 16 | - * @since 2.6.0 bbPress (r6273) | |
| 16 | + * @since 2.6.0 bbPress (r6274) | |
| 17 | 17 | */ |
| 18 | 18 | function bbp_admin_tools_box() { |
| 19 | 19 | |
| 20 | 20 | // Bail if user cannot access tools page |
| @@ -40,9 +40,9 @@ | ||
| 40 | 40 | continue; |
| 41 | 41 | } |
| 42 | 42 | |
| 43 | 43 | // Add link to array |
| 44 | - $links[] = sprintf( '<a href="%s">%s</a>', esc_url( add_query_arg( array( 'page' => $tool['page'] ), admin_url( 'tools.php' ) ) ), $tool['name'] ); | |
| 44 | + $links[] = sprintf( '<a href="%s">%s</a>', esc_url( add_query_arg( array( 'page' => $tool['page'] ), admin_url( 'tools.php' ) ) ), wp_kses_post( $tool['name'] ) ); | |
| 45 | 45 | } |
| 46 | 46 | |
| 47 | 47 | // Output links |
| 48 | 48 | echo '<p class="bbp-tools-links">' . implode( ' · ', $links ) . '</p>'; |
| @@ -553,10 +553,10 @@ | ||
| 553 | 553 | $is_current = (bool) ( $tab['page'] === $active_tab ); |
| 554 | 554 | $tab_class = $is_current ? $active_class : $idle_class; |
| 555 | 555 | $tab_url = add_query_arg( array( 'page' => $tab['page'] ), admin_url( 'tools.php' ) ); |
| 556 | 556 | |
| 557 | - // Tab name is not escaped - may contain HTML | |
| 558 | - $tabs_html .= '<a href="' . esc_url( $tab_url ) . '" class="' . esc_attr( $tab_class ) . '">' . $tab['name'] . '</a>'; | |
| 557 | + // Allow safe markup for the pending-upgrade count | |
| 558 | + $tabs_html .= '<a href="' . esc_url( $tab_url ) . '" class="' . esc_attr( $tab_class ) . '">' . wp_kses_post( $tab['name'] ) . '</a>'; | |
| 559 | 559 | } |
| 560 | 560 | |
| 561 | 561 | // Output the tabs |
| 562 | 562 | return $tabs_html; |
| @@ -564,9 +564,9 @@ | ||
| 564 | 564 | |
| 565 | 565 | /** |
| 566 | 566 | * Return possible tools pages |
| 567 | 567 | * |
| 568 | - * @since 2.6.0 bbPress (r6273) | |
| 568 | + * @since 2.6.0 bbPress (r6274) | |
| 569 | 569 | * |
| 570 | 570 | * @return array |
| 571 | 571 | */ |
| 572 | 572 | function bbp_get_tools_admin_pages() { |
| @@ -576,9 +576,9 @@ | ||
| 576 | 576 | |
| 577 | 577 | /** |
| 578 | 578 | * Filters the tools admin pages. |
| 579 | 579 | * |
| 580 | - * @since 2.6.0 bbPress (r6273) | |
| 580 | + * @since 2.1.0 bbPress (r3872) | |
| 581 | 581 | * |
| 582 | 582 | * @param array $pages The default array of tools pages. |
| 583 | 583 | */ |
| 584 | 584 | return (array) apply_filters( |
