Ticket #57539: 57539.patch

wp-admin/includes/class-wp-comments-list-table.php

@@ -708 +708 @@
                         if ( 'approved' === $the_comment_status ) {
                                 $actions['unapprove'] = sprintf(
                                         '<a href="%s" data-wp-lists="%s" class="vim-u vim-destructive aria-button-if-js" aria-label="%s">%s</a>',
-                                        $unapprove_url,
+                                        esc_url( $unapprove_url ),
                                         "delete:the-comment-list:comment-{$comment->comment_ID}:e7e7d3:action=dim-comment&amp;new=unapproved",
                                         esc_attr__( 'Unapprove this comment' ),
                                         __( 'Unapprove' )
@@ -716 +716 @@
                         } elseif ( 'unapproved' === $the_comment_status ) {
                                 $actions['approve'] = sprintf(
                                         '<a href="%s" data-wp-lists="%s" class="vim-a vim-destructive aria-button-if-js" aria-label="%s">%s</a>',
-                                        $approve_url,
+                                        esc_url( $approve_url ),
                                         "delete:the-comment-list:comment-{$comment->comment_ID}:e7e7d3:action=dim-comment&amp;new=approved",
                                         esc_attr__( 'Approve this comment' ),
                                         __( 'Approve' )
@@ -725 +725 @@
                 } else {
                         $actions['approve'] = sprintf(
                                 '<a href="%s" data-wp-lists="%s" class="vim-a aria-button-if-js" aria-label="%s">%s</a>',
-                                $approve_url,
+                                esc_url( $approve_url ),
                                 "dim:the-comment-list:comment-{$comment->comment_ID}:unapproved:e7e7d3:e7e7d3:new=approved",
                                 esc_attr__( 'Approve this comment' ),
                                 __( 'Approve' )
@@ -733 +733 @@
 
                         $actions['unapprove'] = sprintf(
                                 '<a href="%s" data-wp-lists="%s" class="vim-u aria-button-if-js" aria-label="%s">%s</a>',
-                                $unapprove_url,
+                                esc_url( $unapprove_url ),
                                 "dim:the-comment-list:comment-{$comment->comment_ID}:unapproved:e7e7d3:e7e7d3:new=unapproved",
                                 esc_attr__( 'Unapprove this comment' ),
                                 __( 'Unapprove' )
@@ -743 +743 @@
                 if ( 'spam' !== $the_comment_status ) {
                         $actions['spam'] = sprintf(
                                 '<a href="%s" data-wp-lists="%s" class="vim-s vim-destructive aria-button-if-js" aria-label="%s">%s</a>',
-                                $spam_url,
+                                esc_url( $spam_url ),
                                 "delete:the-comment-list:comment-{$comment->comment_ID}::spam=1",
                                 esc_attr__( 'Mark this comment as spam' ),
                                 /* translators: "Mark as spam" link. */
@@ -752 +752 @@
                 } elseif ( 'spam' === $the_comment_status ) {
                         $actions['unspam'] = sprintf(
                                 '<a href="%s" data-wp-lists="%s" class="vim-z vim-destructive aria-button-if-js" aria-label="%s">%s</a>',
-                                $unspam_url,
+                                esc_url( $unspam_url ),
                                 "delete:the-comment-list:comment-{$comment->comment_ID}:66cc66:unspam=1",
                                 esc_attr__( 'Restore this comment from the spam' ),
                                 _x( 'Not Spam', 'comment' )
@@ -762 +762 @@
                 if ( 'trash' === $the_comment_status ) {
                         $actions['untrash'] = sprintf(
                                 '<a href="%s" data-wp-lists="%s" class="vim-z vim-destructive aria-button-if-js" aria-label="%s">%s</a>',
-                                $untrash_url,
+                                esc_url( $untrash_url ),
                                 "delete:the-comment-list:comment-{$comment->comment_ID}:66cc66:untrash=1",
                                 esc_attr__( 'Restore this comment from the Trash' ),
                                 __( 'Restore' )
@@ -772 +772 @@
                 if ( 'spam' === $the_comment_status || 'trash' === $the_comment_status || ! EMPTY_TRASH_DAYS ) {
                         $actions['delete'] = sprintf(
                                 '<a href="%s" data-wp-lists="%s" class="delete vim-d vim-destructive aria-button-if-js" aria-label="%s">%s</a>',
-                                $delete_url,
+                                esc_url( $delete_url ),
                                 "delete:the-comment-list:comment-{$comment->comment_ID}::delete=1",
                                 esc_attr__( 'Delete this comment permanently' ),
                                 __( 'Delete Permanently' )
@@ -780 +780 @@
                 } else {
                         $actions['trash'] = sprintf(
                                 '<a href="%s" data-wp-lists="%s" class="delete vim-d vim-destructive aria-button-if-js" aria-label="%s">%s</a>',
-                                $trash_url,
+                                esc_url( $trash_url ),
                                 "delete:the-comment-list:comment-{$comment->comment_ID}::trash=1",
                                 esc_attr__( 'Move this comment to the Trash' ),
                                 _x( 'Trash', 'verb' )