Make WordPress Core

Ticket #46657: 46657.3.diff

File 46657.3.diff, 1.5 KB (added by rmccue, 5 years ago)

Escape URL before output

  • src/wp-includes/admin-bar.php

    diff --git src/wp-includes/admin-bar.php src/wp-includes/admin-bar.php
    index 6600c651df..83d8bfcc1e 100644
    function wp_admin_bar_my_sites_menu( $wp_admin_bar ) { 
    569569        foreach ( (array) $wp_admin_bar->user->blogs as $blog ) {
    570570                switch_to_blog( $blog->userblog_id );
    571571
    572                 $blavatar = '<div class="blavatar"></div>';
     572                $icon_url = get_site_icon_url( 16 );
     573                if ( $icon_url ) {
     574                        $blavatar = '<img src="' . esc_url( $icon_url ) . '" class="blavatar" width="16" height="16" />';
     575                } else {
     576                        $blavatar = '<div class="blavatar"></div>';
     577                }
     578
     579                /**
     580                 * Filter the icon for a site in the My Sites dropdown menu.
     581                 *
     582                 * @param string $blavatar Site icon markup.
     583                 * @param stdClass $blog Site being displayed.
     584                 */
     585                $blavatar = apply_filters( 'admin_bar_my_sites_site_icon', $blavatar, $blog );
    573586
    574587                $blogname = $blog->blogname;
    575588
  • src/wp-includes/css/admin-bar.css

    diff --git src/wp-includes/css/admin-bar.css src/wp-includes/css/admin-bar.css
    index ae35741489..f6dae56189 100644
    html:lang(he-il) .rtl #wpadminbar * { 
    511511        color: #eee;
    512512}
    513513
     514#wpadminbar .quicklinks li img.blavatar {
     515        height: 16px;
     516        width: 16px;
     517        display: inline-block;
     518        margin: 6px 8px 0 -2px;
     519}
     520
    514521#wpadminbar .quicklinks li a:hover .blavatar,
    515522#wpadminbar .quicklinks li a:focus .blavatar,
    516523#wpadminbar .quicklinks .ab-sub-wrapper .menupop.hover > a .blavatar {