Make WordPress Core

Ticket #7281: add_query_arg.diff

File add_query_arg.diff, 1.3 KB (added by xknown, 17 years ago)

add_query_arg sanitization

  • wp-admin/includes/media.php

     
    14181418
    14191419function media_upload_flash_bypass() {
    14201420        echo '<p class="upload-flash-bypass">';
    1421         printf( __('You are using the Flash uploader.  Problems?  Try the <a href="%s">Browser uploader</a> instead.'), add_query_arg('flash', 0) );
     1421        printf( __('You are using the Flash uploader.  Problems?  Try the <a href="%s">Browser uploader</a> instead.'), clean_url(add_query_arg('flash', 0)) );
    14221422        echo '</p>';
    14231423}
    14241424
     
    14281428        echo '<p class="upload-html-bypass">';
    14291429        if ( array_key_exists('flash', $_REQUEST) )
    14301430                // the user manually selected the browser uploader, so let them switch back to Flash
    1431                 printf( __('You are using the Browser uploader.  Try the <a href="%s">Flash uploader</a> instead.'), add_query_arg('flash', 1) );
     1431                printf( __('You are using the Browser uploader.  Try the <a href="%s">Flash uploader</a> instead.'), clean_url(add_query_arg('flash', 1)) );
    14321432        else
    14331433                // the user probably doesn't have Flash
    14341434                printf( __('You are using the Browser uploader.') );