Changeset 12296

Timestamp:

11/30/2009 05:08:36 PM (17 years ago)

Author:

ryan

Message:

escape hrefs. Props Denis-de-Bernardy. fixes #10056 for 2.8

File:

• branches/2.8/wp-admin/includes/media.php (modified) (4 diffs)

branches/2.8/wp-admin/includes/media.php

@@ -478 +478 @@
                 }
                 if ( !empty($src) )
-                        $html = "<img src='$src' alt='$alt'$class />";
-                $html = apply_filters('image_send_to_editor_url', $html, $src, $alt, $align);
+                        $html = "<img src='" . esc_url($src) . "' alt='$alt'$class />";
+                $html = apply_filters('image_send_to_editor_url', $html, esc_url_raw($src), $alt, $align);
                 return media_send_to_editor($html);
         }
@@ -570 +570 @@
                         $title = basename($href);
                 if ( !empty($title) && !empty($href) )
-                        $html = "<a href='$href' >$title</a>";
-                $html = apply_filters('audio_send_to_editor_url', $html, $href, $title);
+                        $html = "<a href='" . esc_url($href) . "' >$title</a>";
+                $html = apply_filters('audio_send_to_editor_url', $html, esc_url_raw($href), $title);
                 return media_send_to_editor($html);
         }
@@ -624 +624 @@
                         $title = basename($href);
                 if ( !empty($title) && !empty($href) )
-                        $html = "<a href='$href' >$title</a>";
-                $html = apply_filters('video_send_to_editor_url', $html, $href, $title);
+                        $html = "<a href='" . esc_url($href) . "' >$title</a>";
+                $html = apply_filters('video_send_to_editor_url', $html, esc_url_raw($href), $title);
                 return media_send_to_editor($html);
         }
@@ -678 +678 @@
                         $title = basename($href);
                 if ( !empty($title) && !empty($href) )
-                        $html = "<a href='$href' >$title</a>";
-                $html = apply_filters('file_send_to_editor_url', $html, $href, $title);
+                        $html = "<a href='" . esc_url($href) . "' >$title</a>";
+                $html = apply_filters('file_send_to_editor_url', $html, esc_url_raw($href), $title);
                 return media_send_to_editor($html);
         }