Changeset 19033 for trunk/wp-includes/general-template.php

Timestamp:

10/20/2011 11:41:07 PM (13 years ago)

Author:

nacin

Message:

Use esc_url() rather than esc_attr() on a redirect-to URL. fixes #17243.

File:

• trunk/wp-includes/general-template.php (modified) (2 diffs)

trunk/wp-includes/general-template.php

@@ -253 +253 @@
 
     $form = '
-        <form name="' . $args['form_id'] . '" id="' . $args['form_id'] . '" action="' . site_url( 'wp-login.php', 'login_post' ) . '" method="post">
+        <form name="' . $args['form_id'] . '" id="' . $args['form_id'] . '" action="' . esc_url( site_url( 'wp-login.php', 'login_post' ) ) . '" method="post">
             ' . apply_filters( 'login_form_top', '', $args ) . '
             <p class="login-username">
@@ -267 +267 @@
             <p class="login-submit">
                 <input type="submit" name="wp-submit" id="' . esc_attr( $args['id_submit'] ) . '" class="button-primary" value="' . esc_attr( $args['label_log_in'] ) . '" tabindex="100" />
-                <input type="hidden" name="redirect_to" value="' . esc_attr( $args['redirect'] ) . '" />
+                <input type="hidden" name="redirect_to" value="' . esc_url( $args['redirect'] ) . '" />
             </p>
             ' . apply_filters( 'login_form_bottom', '', $args ) . '