Ticket #13383: escurl.diff

wp-admin/includes/post.php

@@ -1143 +1143 @@
 function _wp_post_thumbnail_html( $thumbnail_id = NULL ) {
         global $content_width, $_wp_additional_image_sizes;
 
-        $set_thumbnail_link = '<p class="hide-if-no-js"><a title="' . esc_attr__( 'Set featured image' ) . '" href="' . get_upload_iframe_src('image') . '" id="set-post-thumbnail" class="thickbox">%s</a></p>';
+        $set_thumbnail_link = '<p class="hide-if-no-js"><a title="' . esc_attr__( 'Set featured image' ) . '" href="' . esc_url( get_upload_iframe_src('image') ) . '" id="set-post-thumbnail" class="thickbox">%s</a></p>';
         $content = sprintf($set_thumbnail_link, esc_html__( 'Set featured image' ));
 
         if ( $thumbnail_id && get_post( $thumbnail_id ) ) {

wp-admin/includes/media.php

@@ -379 +379 @@
 add_action( 'media_buttons', 'media_buttons' );
 
 function _media_button($title, $icon, $type) {
-        return "<a href='" . get_upload_iframe_src($type) . "' id='add_$type' class='thickbox' title='$title'><img src='" . esc_url( admin_url( $icon ) ) . "' alt='$title' /></a>";
+        return "<a href='" . esc_url( get_upload_iframe_src($type) ) . "' id='add_$type' class='thickbox' title='$title'><img src='" . esc_url( admin_url( $icon ) ) . "' alt='$title' /></a>";
 }
 
 function get_upload_iframe_src($type) {