Changeset 12295

Timestamp:

11/30/2009 04:55:50 PM (15 years ago)

Author:

ryan

Message:

escape hrefs. Props Denis-de-Bernardy. fixes #10056

File:

• trunk/wp-admin/includes/media.php (modified) (5 diffs)

trunk/wp-admin/includes/media.php

@@ -487 +487 @@
             if ( !strpos($src, '://') )
                 $src = "http://$src";
-            $html = '[embed]' . $src . '[/embed]';
+            $html = '[embed]' . esc_url($src) . '[/embed]';
         } else {
             $src = $_POST['insertonly']['src'];
@@ -498 +498 @@
             }
             if ( !empty($src) )
-                $html = "<img src='$src' alt='$alt'$class />";
+                $html = "<img src='" . esc_url($src) . "' alt='$alt'$class />";
         }
 
-        $html = apply_filters('image_send_to_editor_url', $html, $src, $alt, $align);
+        $html = apply_filters('image_send_to_editor_url', $html, esc_url_raw($src), $alt, $align);
         return media_send_to_editor($html);
     }
@@ -597 +597 @@
             $href = "http://$href";
 
-        $html = '[embed]' . $href . '[/embed]';
-        $html = apply_filters('audio_send_to_editor_url', $html, $href);
+        $html = '[embed]' . esc_url($href) . '[/embed]';
+        $html = apply_filters('audio_send_to_editor_url', $html, esc_url_raw($href));
         return media_send_to_editor($html);
     }
@@ -648 +648 @@
             $href = "http://$href";
 
-        $html = '[embed]' . $href . '[/embed]';
-        $html = apply_filters('video_send_to_editor_url', $html, $href);
+        $html = '[embed]' . esc_url($href) . '[/embed]';
+        $html = apply_filters('video_send_to_editor_url', $html, esc_url_raw($href));
         return media_send_to_editor($html);
     }
@@ -703 +703 @@
             $title = basename($href);
         if ( !empty($title) && !empty($href) )
-            $html = "<a href='$href' >$title</a>";
-        $html = apply_filters('file_send_to_editor_url', $html, $href, $title);
+            $html = "<a href='" . esc_url($href) . "' >$title</a>";
+        $html = apply_filters('file_send_to_editor_url', $html, esc_url_raw($href), $title);
         return media_send_to_editor($html);
     }