Ticket #60978: 60978.3.patch

src/wp-admin/async-upload.php

@@ -60 +60 @@
                                         // Title shouldn't ever be empty, but use filename just in case.
                                         $file     = get_attached_file( $post->ID );
                                         $file_url = wp_get_attachment_url( $post->ID );
-                                        $title    = $post->post_title ? $post->post_title : wp_basename( $file );
+                                        $title    = $post->post_title ? $post->post_title : esc_html( wp_basename( $file ) );
                                         ?>
                                         <div class="filename new">
                                                 <span class="media-list-title"><strong><?php echo esc_html( wp_html_excerpt( $title, 60, '&hellip;' ) ); ?></strong></span>
-                                                <span class="media-list-subtitle"><?php echo wp_basename( $file ); ?></span>
+                                                <span class="media-list-subtitle"><?php echo esc_html( wp_basename( $file ) ); ?></span>
                                         </div>
                                 </div>
                                 <div class="attachment-tools">
                                         <span class="media-item-copy-container copy-to-clipboard-container edit-attachment">
-                                                <button type="button" class="button button-small copy-attachment-url" data-clipboard-text="<?php echo $file_url; ?>"><?php _e( 'Copy URL to clipboard' ); ?></button>
+                                                <button type="button" class="button button-small copy-attachment-url" data-clipboard-text="<?php echo esc_url( $file_url ); ?>"><?php _e( 'Copy URL to clipboard' ); ?></button>
                                                 <span class="success hidden" aria-hidden="true"><?php _e( 'Copied!' ); ?></span>
                                         </span>
                                         <?php