← All changes | views/widgets/title.php +8 -1 3.4.2 → 4.9.2 View file →

		@@ -1,4 +1,11 @@
1	1	<?php
2	2
	3	+
	4	+if ( ! defined( 'ABSPATH' ) ) {
	5	+ exit;
	6	+}
3	7	$tag = empty( $tag ) ? 'h2' : $tag;
4		-echo sprintf( '<%1$s id="betterdocs-entry-title" class="betterdocs-entry-title" %2$s>%3$s</%1$s>', strtolower( $tag ), $wrapper_attr, wp_kses_post( $title ) );
	8	+// $tag lands in a tag-name position, so clamp it to a safe HTML tag via the
	9	+// allow-list rather than relying on strtolower() (which leaves a space/= intact).
	10	+$tag = betterdocs()->template_helper->is_valid_tag( $tag );
	11	+printf( '<%1$s id="betterdocs-entry-title" class="betterdocs-entry-title" %2$s>%3$s</%1$s>', $tag, $wrapper_attr, wp_kses_post( $title ) ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped