Ticket #20106: 20106.2.patch

wp-includes/category-template.php

@@ -56 +56 @@
         }
 
         if ( $link )
-                $chain .= '<a href="' . get_category_link( $parent->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $parent->name ) ) . '">'.$name.'</a>' . $separator;
+                $chain .= '<a href="' . esc_url( get_category_link( $parent->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $parent->name ) ) . '">'.$name.'</a>' . $separator;
         else
                 $chain .= $name.$separator;
         return $chain;
@@ -171 +171 @@
                                 case 'multiple':
                                         if ( $category->parent )
                                                 $thelist .= get_category_parents( $category->parent, true, $separator );
-                                        $thelist .= '<a href="' . get_category_link( $category->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a></li>';
+                                        $thelist .= '<a href="' . esc_url( get_category_link( $category->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a></li>';
                                         break;
                                 case 'single':
-                                        $thelist .= '<a href="' . get_category_link( $category->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>';
+                                        $thelist .= '<a href="' . esc_url( get_category_link( $category->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>';
                                         if ( $category->parent )
                                                 $thelist .= get_category_parents( $category->parent, false, $separator );
                                         $thelist .= $category->name.'</a></li>';
                                         break;
                                 case '':
                                 default:
-                                        $thelist .= '<a href="' . get_category_link( $category->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a></li>';
+                                        $thelist .= '<a href="' . esc_url( get_category_link( $category->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a></li>';
                         }
                 }
                 $thelist .= '</ul>';
@@ -194 +194 @@
                                 case 'multiple':
                                         if ( $category->parent )
                                                 $thelist .= get_category_parents( $category->parent, true, $separator );
-                                        $thelist .= '<a href="' . get_category_link( $category->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a>';
+                                        $thelist .= '<a href="' . esc_url( get_category_link( $category->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a>';
                                         break;
                                 case 'single':
-                                        $thelist .= '<a href="' . get_category_link( $category->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>';
+                                        $thelist .= '<a href="' . esc_url( get_category_link( $category->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>';
                                         if ( $category->parent )
                                                 $thelist .= get_category_parents( $category->parent, false, $separator );
                                         $thelist .= "$category->name</a>";
                                         break;
                                 case '':
                                 default:
-                                        $thelist .= '<a href="' . get_category_link( $category->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a>';
+                                        $thelist .= '<a href="' . esc_url( get_category_link( $category->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a>';
                         }
                         ++$i;
                 }
@@ -825 +825 @@
 
                 $cat_name = esc_attr( $category->name );
                 $cat_name = apply_filters( 'list_cats', $cat_name, $category );
-                $link = '<a href="' . esc_attr( get_term_link($category) ) . '" ';
+                $link = '<a href="' . esc_url( get_term_link($category) ) . '" ';
                 if ( $use_desc_for_title == 0 || empty($category->description) )
                         $link .= 'title="' . esc_attr( sprintf(__( 'View all posts filed under %s' ), $cat_name) ) . '"';
                 else
@@ -839 +839 @@
                         if ( empty($feed_image) )
                                 $link .= '(';
 
-                        $link .= '<a href="' . get_term_feed_link( $category->term_id, $category->taxonomy, $feed_type ) . '"';
+                        $link .= '<a href="' . esc_url( get_term_feed_link( $category->term_id, $category->taxonomy, $feed_type ) ) . '"';
 
                         if ( empty($feed) ) {
                                 $alt = ' alt="' . sprintf(__( 'Feed for all posts filed under %s' ), $cat_name ) . '"';
@@ -1108 +1108 @@
                 $link = get_term_link( $term, $taxonomy );
                 if ( is_wp_error( $link ) )
                         return $link;
-                $term_links[] = '<a href="' . $link . '" rel="tag">' . $term->name . '</a>';
+                $term_links[] = '<a href="' . esc_url( $link ) . '" rel="tag">' . $term->name . '</a>';
         }
 
         $term_links = apply_filters( "term_links-$taxonomy", $term_links );