Changeset 12051 for trunk/wp-admin/includes/media.php

Timestamp:

10/18/2009 06:14:16 AM (15 years ago)

Author:

azaozz

Message:

Properly escape filename when sending to editor, props hakre sivel, fixes #10252

File:

• trunk/wp-admin/includes/media.php (modified) (1 diff)

trunk/wp-admin/includes/media.php

@@ -108 +108 @@
 
     if ( $url )
-        $html = '<a href="' . esc_url($url) . "\"$rel>$html</a>";
+        $html = '<a href="' . esc_attr($url) . "\"$rel>$html</a>";
 
     $html = apply_filters( 'image_send_to_editor', $html, $id, $alt, $title, $align, $url, $size );