Skip to content

Prevent error in Menu location checkbox settings #10859

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sabernhardt wants to merge 1 commit into
base: trunk
Choose a base branch
from
+12 −5
Open

Prevent error in Menu location checkbox settings #10859

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 12 additions & 5 deletions src/wp-admin/nav-menus.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1200,25 +1200,32 @@ function wp_nav_menu_max_depth( $classes ) {
<legend class="menu-settings-group-name howto"><?php _e( 'Display location' ); ?></legend>
<?php
foreach ( $locations as $location => $description ) :
$checked = false;
$checked = false;
$location_set = '';

if ( isset( $menu_locations[ $location ] )
&& 0 !== $nav_menu_selected_id
&& $menu_locations[ $location ] === $nav_menu_selected_id
) {
$checked = true;
}

if ( ! empty( $menu_locations[ $location ] )
&& $menu_locations[ $location ] !== $nav_menu_selected_id
) {
$location_set = ' aria-describedby="theme-location-set-' . esc_attr( $location ) . '"';
}
?>
<div class="menu-settings-input checkbox-input">
<input type="checkbox"<?php checked( $checked ); ?> name="menu-locations[<?php echo esc_attr( $location ); ?>]" id="locations-<?php echo esc_attr( $location ); ?>" value="<?php echo esc_attr( $nav_menu_selected_id ); ?>" />
<input type="checkbox"<?php checked( $checked ); ?> name="menu-locations[<?php echo esc_attr( $location ); ?>]" id="locations-<?php echo esc_attr( $location ); ?>" value="<?php echo esc_attr( $nav_menu_selected_id ); ?>"<?php echo $location_set; ?> />
Copy link
Member

@mukeshpanchal27 mukeshpanchal27 Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make sure to add escaping.

Copy link
Author

@sabernhardt sabernhardt Feb 4, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The variable has escaping, but it escapes the attribute earlier than usual.

<label for="locations-<?php echo esc_attr( $location ); ?>"><?php echo $description; ?></label>
<?php if ( ! empty( $menu_locations[ $location ] ) && $menu_locations[ $location ] !== $nav_menu_selected_id ) : ?>
<span class="theme-location-set">
<?php if ( '' !== $location_set ) : ?>
<span class="theme-location-set" id="theme-location-set-<?php echo esc_attr( $location ); ?>">
<?php
printf(
/* translators: %s: Menu name. */
_x( '(Currently set to: %s)', 'menu location' ),
wp_get_nav_menu_object( $menu_locations[ $location ] )->name
is_nav_menu( $menu_locations[ $location ] ) ? wp_get_nav_menu_object( $menu_locations[ $location ] )->name : __( 'an invalid menu ID' )
Copy link
Member

@mukeshpanchal27 mukeshpanchal27 Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest using a similar defensive approach as used here: https://github.com/WordPress/wordpress-develop/blob/trunk/src/wp-admin/nav-menus.php#L643-L646

$menu_name = __( 'an invalid menu ID' );
if ( is_nav_menu( $menu_locations[ $location ] ) ) {
    $menu_object = wp_get_nav_menu_object( $menu_locations[ $location ] );
    if ( ! is_wp_error( $menu_object ) ) {
        $menu_name = $menu_object->name;
    }
}

);
?>
</span>
Expand Down
Loading