[wp-trac] [WordPress Trac] #32812: Customizer Menus: Escaping inconsistencies

[WordPress Trac]

#32812: Customizer Menus: Escaping inconsistencies
--------------------------+---------------------------
 Reporter:  swissspidy    |       Owner:  valendesigns
     Type:  defect (bug)  |      Status:  assigned
 Priority:  normal        |   Milestone:  4.3
Component:  Customize     |     Version:  trunk
 Severity:  normal        |  Resolution:
 Keywords:  needs-patch   |     Focuses:
--------------------------+---------------------------

Comment (by valendesigns):

 Sorry, I was doing testing and menu items were working with valid HTML in
 them when I saved in the Admin Menu first. I assumed you were talking
 about menu titles at that point because I hit save in the Customizer, but
 stupidly didn't refresh.

 After really reading this again, I think it's reasonable, and arguably
 more appropriate, to convert menu items for Customizer Menus and Admin
 Menus to `sanitize_title`. What we're typically adding is post objects,
 which allow for limited HTML.

 I still believe that we should use `sanitize_text_field` for menu titles.
 It doesn't really make sense to allow HTML in this context.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/32812#comment:14>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform