Ticket #4689: 4689.diff

wp-admin/includes/upload.php

@@ -106 +106 @@
         global $post_id, $tab, $style;
         $enctype = $id ? '' : ' enctype="multipart/form-data"';
 ?>
-        <form<?php echo $enctype; ?> id="upload-file" method="post" action="<?php echo get_option('siteurl') . "/wp-admin/upload.php?style=$style&amp;tab=upload&amp;post_id=$post_id"; ?>">
+        <form<?php echo $enctype; ?> id="upload-file" method="post" action="<?php echo get_option('siteurl') . "/wp-admin/upload.php?style=" . attribute_escape($style) . "&amp;tab=upload&amp;post_id=" . attribute_escape($post_id); ?>">
 <?php
         if ( $id ) :
                 $attachment = get_post_to_edit( $id );