| @@ -1,4 +1,11 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | + | |
| 4 | +if ( ! defined( 'ABSPATH' ) ) { | |
| 5 | + exit; | |
| 6 | +} | |
| 3 | 7 | $tag = empty( $tag ) ? 'h2' : $tag; |
| 4 | -echo sprintf( '<%1$s id="betterdocs-entry-title" class="betterdocs-entry-title" %2$s>%3$s</%1$s>', strtolower( $tag ), $wrapper_attr, wp_kses_post( $title ) ); | |
| 8 | +// $tag lands in a tag-name position, so clamp it to a safe HTML tag via the | |
| 9 | +// allow-list rather than relying on strtolower() (which leaves a space/= intact). | |
| 10 | +$tag = betterdocs()->template_helper->is_valid_tag( $tag ); | |
| 11 | +printf( '<%1$s id="betterdocs-entry-title" class="betterdocs-entry-title" %2$s>%3$s</%1$s>', $tag, $wrapper_attr, wp_kses_post( $title ) ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
