Ticket #3986: clean_url-includes_a-l.diff

link-template.php

@@ -503 +503 @@
 }
 
 function next_posts($max_page = 0) {
-        echo attribute_escape(get_next_posts_page_link($max_page));
+        echo clean_url(get_next_posts_page_link($max_page));
 }
 
 function next_posts_link($label='Next Page »', $max_page=0) {
@@ -533 +533 @@
 }
 
 function previous_posts() {
-        echo attribute_escape(get_previous_posts_page_link());
+        echo clean_url(get_previous_posts_page_link());
 }
 
 function previous_posts_link($label='« Previous Page') {

general-template.php

@@ -297 +297 @@
 function get_archives_link($url, $text, $format = 'html', $before = '', $after = '') {
         $text = wptexturize($text);
         $title_text = attribute_escape($text);
+        $url = clean_url($url);
 
         if ('link' == $format)
                 return "\t<link rel='archives' title='$title_text' href='$url' />\n";
@@ -985 +986 @@
                 $link = str_replace('%#%', $current - 1, $link);
                 if ( $add_args )
                         $link = add_query_arg( $add_args, $link );
-                $page_links[] = "<a class='prev page-numbers' href='" . attribute_escape($link) . "'>$prev_text</a>";
+                $page_links[] = "<a class='prev page-numbers' href='" . clean_url($link) . "'>$prev_text</a>";
         endif;
         for ( $n = 1; $n <= $total; $n++ ) :
                 if ( $n == $current ) :
@@ -997 +998 @@
                                 $link = str_replace('%#%', $n, $link);
                                 if ( $add_args )
                                         $link = add_query_arg( $add_args, $link );
-                                $page_links[] = "<a class='page-numbers' href='" . attribute_escape($link) . "'>$n</a>";
+                                $page_links[] = "<a class='page-numbers' href='" . clean_url($link) . "'>$n</a>";
                                 $dots = true;
                         elseif ( $dots && !$show_all ) :
                                 $page_links[] = "<span class='page-numbers dots'>...</span>";
@@ -1010 +1011 @@
                 $link = str_replace('%#%', $current + 1, $link);
                 if ( $add_args )
                         $link = add_query_arg( $add_args, $link );
-                $page_links[] = "<a class='next page-numbers' href='" . attribute_escape($link) . "'>$next_text</a>";
+                $page_links[] = "<a class='next page-numbers' href='" . clean_url($link) . "'>$next_text</a>";
         endif;
         switch ( $type ) :
                 case 'array' :

comment.php

@@ -169 +169 @@
         if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) ) {
                 $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]);
                 $comment_author_url = stripslashes($comment_author_url);
-                $comment_author_url = attribute_escape($comment_author_url);
+                $comment_author_url = clean_url($comment_author_url);
                 $_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url;
         }
 }

functions.php

@@ -1272 +1272 @@
 
         $adminurl = get_option('siteurl') . '/wp-admin';
         if ( wp_get_referer() )
-                $adminurl = attribute_escape(wp_get_referer());
+                $adminurl = clean_url(wp_get_referer());
 
         $title = __('WordPress Confirmation');
         // Remove extra layer of slashes.
@@ -1289 +1289 @@
                 $html .= "\t\t<input type='hidden' name='_wpnonce' value='" . wp_create_nonce($action) . "' />\n";
                 $html .= "\t\t<div id='message' class='confirm fade'>\n\t\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t\t<p><a href='$adminurl'>" . __('No') . "</a> <input type='submit' value='" . __('Yes') . "' /></p>\n\t\t</div>\n\t</form>\n";
         } else {
-                $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . attribute_escape(add_query_arg( '_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'] )) . "'>" . __('Yes') . "</a></p>\n\t</div>\n";
+                $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . clean_url(add_query_arg( '_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'] )) . "'>" . __('Yes') . "</a></p>\n\t</div>\n";
         }
         $html .= "</body>\n</html>";
         wp_die($html, $title);

bookmark-template.php

@@ -96 +96 @@
                         $output .= get_option('links_recently_updated_prepend');
                 $the_link = '#';
                 if ( !empty($row->link_url) )
-                        $the_link = wp_specialchars($row->link_url);
+                        $the_link = clean_url($row->link_url);
                 $rel = $row->link_rel;
                 if ( '' != $rel )
                         $rel = ' rel="' . $rel . '"';
@@ -260 +260 @@
 
                 $the_link = '#';
                 if ( !empty($bookmark->link_url) )
-                        $the_link = wp_specialchars($bookmark->link_url);
+                        $the_link = clean_url($bookmark->link_url);
 
                 $rel = $bookmark->link_rel;
                 if ( '' != $rel )