Ticket #56064: 56064.patch

src/wp-admin/includes/media.php

@@ -145 +145 @@
         }
 
         if ( $url ) {
-                $html = '<a href="' . esc_attr( $url ) . '"' . $rel . '>' . $html . '</a>';
+                $html = '<a href="' . esc_url( $url ) . '"' . $rel . '>' . $html . '</a>';
         }
 
         /**
@@ -1269 +1269 @@
         return "
         <input type='text' class='text urlfield' name='attachments[$post->ID][url]' value='" . esc_attr( $url ) . "' /><br />
         <button type='button' class='button urlnone' data-link-url=''>" . __( 'None' ) . "</button>
-        <button type='button' class='button urlfile' data-link-url='" . esc_attr( $file ) . "'>" . __( 'File URL' ) . "</button>
-        <button type='button' class='button urlpost' data-link-url='" . esc_attr( $link ) . "'>" . __( 'Attachment Post URL' ) . '</button>
+        <button type='button' class='button urlfile' data-link-url='" . esc_url( $file ) . "'>" . __( 'File URL' ) . "</button>
+        <button type='button' class='button urlpost' data-link-url='" . esc_url( $link ) . "'>" . __( 'Attachment Post URL' ) . '</button>
 ';
 }