Ticket #30952: 30952.demo.diff

src/wp-admin/menu-header.php

@@ -127 +127 @@
                                 $menu_file = substr( $menu_file, 0, $pos );
                         if ( ! empty( $menu_hook ) || ( ( 'index.php' != $submenu_items[0][2] ) && file_exists( WP_PLUGIN_DIR . "/$menu_file" ) && ! file_exists( ABSPATH . "/wp-admin/$menu_file" ) ) ) {
                                 $admin_is_parent = true;
-                                echo "<a href='admin.php?page={$submenu_items[0][2]}'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>$title</div></a>";
+                                $href = esc_url( admin_url( "admin.php?page={$submenu_items[0][2]}" ) );
+                                echo "<a href='$href'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>$title</div></a>";
                         } else {
-                                echo "\n\t<a href='{$submenu_items[0][2]}'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>$title</div></a>";
+                                $href = esc_url( $submenu_items[0][2] );
+                                echo "\n\t<a href='{$href}'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>$title</div></a>";
                         }
                 } elseif ( ! empty( $item[2] ) && current_user_can( $item[1] ) ) {
                         $menu_hook = get_plugin_page_hook( $item[2], 'admin.php' );
@@ -138 +140 @@
                                 $menu_file = substr( $menu_file, 0, $pos );
                         if ( ! empty( $menu_hook ) || ( ( 'index.php' != $item[2] ) && file_exists( WP_PLUGIN_DIR . "/$menu_file" ) && ! file_exists( ABSPATH . "/wp-admin/$menu_file" ) ) ) {
                                 $admin_is_parent = true;
-                                echo "\n\t<a href='admin.php?page={$item[2]}'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>{$item[0]}</div></a>";
+                                $href = esc_url( admin_url( "admin.php?page={$item[2]}" ) );
+                                echo "\n\t<a href='$href'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>{$item[0]}</div></a>";
                         } else {
-                                echo "\n\t<a href='{$item[2]}'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>{$item[0]}</div></a>";
+                                $href = $item[2];
+                                if ( ! preg_match( '#^/|^https?:#', $href ) ) {
+                                        $href = admin_url( $href );
+                                }
+                                $href = esc_url( $href );
+                                echo "\n\t<a href='{$href}'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>{$item[0]}</div></a>";
                         }
                 }
 
@@ -200 +208 @@
                                                 $sub_item_url = add_query_arg( array( 'page' => $sub_item[2] ), $item[2] );
                                         else
                                                 $sub_item_url = add_query_arg( array( 'page' => $sub_item[2] ), 'admin.php' );
-
-                                        $sub_item_url = esc_url( $sub_item_url );
-                                        echo "<li$class><a href='$sub_item_url'$class>$title</a></li>";
                                 } else {
-                                        echo "<li$class><a href='{$sub_item[2]}'$class>$title</a></li>";
+                                        $sub_item_url = $sub_item[2];
+                                }
+
+                                if ( ! preg_match( '#^/|^https?:#', $sub_item_url ) ) {
+                                        $sub_item_url = admin_url( $sub_item_url );
                                 }
+                                $sub_item_url = esc_url( $sub_item_url );
+                                echo "<li$class><a href='$sub_item_url'$class>$title</a></li>";
                         }
                         echo "</ul>";
                 }