[wp-trac] [WordPress Trac] #47546: The language used for the `lang` attribute isn't validated before being used

Sat Jun 15 13:48:41 UTC 2019

#47546: The language used for the `lang` attribute isn't validated before being
used
--------------------------+-----------------------------
 Reporter:  johnbillion   |      Owner:  (none)
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  I18N          |    Version:
 Severity:  normal        |   Keywords:  needs-patch
  Focuses:                |
--------------------------+-----------------------------
 In the admin area, the `lang` attribute can be populated directly from the
 `WPLANG` option or the user's `locale` meta field. In these cases, no
 check is performed to ensure that the corresponding language files exist
 before using the value for the `lang` attribute.

 This can come about if the language files that are used by a user or the
 site are deleted, or the value is otherwise modified to include an
 incorrect value.

 For example, running `wp user meta update admin locale it_IT` will result
 in `lang="it_IT"` being added to the `<html>` element, even if the
 corresponding language files don't exist. This can result in the browser
 being confused about the language of the page, and can also result in
 assistive technology handling or pronouncing text incorrectly.

 It would be preferable if the existence of the corresponding language
 files was checked before the `lang` attribute was output, falling back to
 `en_US` as necessary. I'm not sure if it's best to make this change in the
 `get_language_attributes()` function, or lower in the `determine_locale()`
 or `get_bloginfo()` functions.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/47546>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform