Prevent XSS privilege escalation in custom theme settings.7.x-3.37.x-3.x

1 files changed, 2 insertions, 2 deletions

diff --git a/template.php b/template.php
index b70adb5..b639b4d 100644
--- a/template.php
+++ b/template.php
@@ -181,8 +181,8 @@ function zen_preprocess_html(&$variables, $hook) {
     zen_add_conditional_styles();
   }
 
-  $variables['jump_link_target'] = theme_get_setting('zen_jump_link_target');
-  $variables['jump_link_text'] = theme_get_setting('zen_jump_link_text');
+  $variables['jump_link_target'] = check_plain(theme_get_setting('zen_jump_link_target'));
+  $variables['jump_link_text'] = check_plain(theme_get_setting('zen_jump_link_text'));
 
   // Return early, so the maintenance page does not call any of the code below.
   if ($hook != 'html') {