Merge pull request #1216 from siteorigin/improve-attribute-name-handling

Improve Attribute Name Handling
siteorigin · Jun 27, 2024 · 9bfe11e · 9bfe11e
2 parents e00282b + 27f665f
commit 9bfe11e
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 6 deletions.
diff --git a/inc/renderer.php b/inc/renderer.php
@@ -676,9 +676,9 @@ private function start_style_wrapper( $name, $style = array(), $for = false ) {
 				}
 
 				if ( is_array( $value ) ) {
-					$style_wrapper .= $name . '="' . esc_attr( implode( ' ', array_unique( $value ) ) ) . '" ';
+					$style_wrapper .= sanitize_key( $name ) . '="' . esc_attr( implode( ' ', array_unique( $value ) ) ) . '" ';
 				} else {
-					$style_wrapper .= $name . '="' . esc_attr( $value ) . '" ';
+					$style_wrapper .= sanitize_key( $name ) . '="' . esc_attr( $value ) . '" ';
 				}
 			}
 			$style_wrapper .= '>';
@@ -810,7 +810,7 @@ public function the_widget( $widget_info, $instance, $grid_index, $cell_index, $
 		$before_widget = '<div ';
 
 		foreach ( $attributes as $k => $v ) {
-			$before_widget .= esc_attr( $k ) . '="' . esc_attr( $v ) . '" ';
+			$before_widget .= sanitize_key( $k ) . '="' . esc_attr( $v ) . '" ';
 		}
 		$before_widget .= '>';
 
@@ -1010,11 +1010,11 @@ public function get_panels_layout_data( $panels_data ) {
 	 * @param array  $attributes The attributes for the HTML element.
 	 */
 	private function render_element( $tag, $attributes ) {
-		echo '<' . esc_html( $tag );
+		echo '<' . sanitize_key( $tag );
 
 		foreach ( $attributes as $name => $value ) {
 			if ( $value ) {
-				echo ' ' . esc_html( $name ) . '="' . esc_attr( $value ) . '" ';
+				echo ' ' . sanitize_key( $name ) . '="' . esc_attr( $value ) . '" ';
 			}
 		}
 		echo '>';

diff --git a/widgets/widgets.php b/widgets/widgets.php
@@ -809,7 +809,7 @@ public function widget( $args, $instance ) {
 			if ( empty( $v ) ) {
 				continue;
 			}
-			$shortcode_attr[] = esc_html( $k ) . '="' . esc_attr( $v ) . '"';
+			$shortcode_attr[] = sanitize_key( $k ) . '="' . esc_attr( $v ) . '"';
 		}
 
 		echo do_shortcode( '[gallery ' . implode( ' ', $shortcode_attr ) . ']' );