Changes from trunk/wp-includes/author-template.php at r11450 to branches/2.8/wp-includes/author-template.php at r11890

File:

• branches/2.8/wp-includes/author-template.php (modified) (5 diffs)

branches/2.8/wp-includes/author-template.php

@@ -133 +133 @@
 function the_author_link() {
     if ( get_the_author_meta('url') ) {
-        echo '<a href="' . get_the_author_meta('url') . '" title="' . sprintf(__("Visit %s&#8217;s website"), get_the_author()) . '" rel="external">' . get_the_author() . '</a>';
+        echo '<a href="' . get_the_author_meta('url') . '" title="' . esc_attr( sprintf(__("Visit %s&#8217;s website"), get_the_author()) ) . '" rel="external">' . get_the_author() . '</a>';
     } else {
         the_author();
@@ -182 +182 @@
         '<a href="%1$s" title="%2$s">%3$s</a>',
         get_author_posts_url( $authordata->ID, $authordata->user_nicename ),
-        sprintf( __( 'Posts by %s' ), esc_attr( get_the_author() ) ),
+        esc_attr( sprintf( __( 'Posts by %s' ), get_the_author() ) ),
         get_the_author()
     );
@@ -293 +293 @@
                 $link = $name;
         } else {
-            $link = '<a href="' . get_author_posts_url($author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), esc_attr($author->display_name)) . '">' . $name . '</a>';
+            $link = '<a href="' . get_author_posts_url($author->ID, $author->user_nicename) . '" title="' . esc_attr( sprintf(__("Posts by %s"), $author->display_name) ) . '">' . $name . '</a>';
 
             if ( (! empty($feed_image)) || (! empty($feed)) ) {
@@ -302 +302 @@
 
                 if ( !empty($feed) ) {
-                    $title = ' title="' . $feed . '"';
-                    $alt = ' alt="' . $feed . '"';
+                    $title = ' title="' . esc_attr($feed) . '"';
+                    $alt = ' alt="' . esc_attr($feed) . '"';
                     $name = $feed;
                     $link .= $title;
@@ -311 +311 @@
 
                 if ( !empty($feed_image) )
-                    $link .= "<img src=\"$feed_image\" style=\"border: none;\"$alt$title" . ' />';
+                    $link .= "<img src=\"" . esc_url($feed_image) . "\" style=\"border: none;\"$alt$title" . ' />';
                 else
                     $link .= $name;