Changeset 20656

Timestamp:

04/30/2012 09:36:43 PM (13 years ago)

Author:

ryan

Message:

Escape term links output in category-template.php functions. Props SergeyBiryukov, solarissmoke, alex-ye. fixes #20106

File:

• trunk/wp-includes/category-template.php (modified) (8 diffs)

trunk/wp-includes/category-template.php

@@ -57 +57 @@
 
     if ( $link )
-        $chain .= '<a href="' . get_category_link( $parent->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $parent->name ) ) . '">'.$name.'</a>' . $separator;
+        $chain .= '<a href="' . esc_url( get_category_link( $parent->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $parent->name ) ) . '">'.$name.'</a>' . $separator;
     else
         $chain .= $name.$separator;
@@ -172 +172 @@
                     if ( $category->parent )
                         $thelist .= get_category_parents( $category->parent, true, $separator );
-                    $thelist .= '<a href="' . get_category_link( $category->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a></li>';
+                    $thelist .= '<a href="' . esc_url( get_category_link( $category->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a></li>';
                     break;
                 case 'single':
-                    $thelist .= '<a href="' . get_category_link( $category->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>';
+                    $thelist .= '<a href="' . esc_url( get_category_link( $category->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>';
                     if ( $category->parent )
                         $thelist .= get_category_parents( $category->parent, false, $separator );
@@ -182 +182 @@
                 case '':
                 default:
-                    $thelist .= '<a href="' . get_category_link( $category->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a></li>';
+                    $thelist .= '<a href="' . esc_url( get_category_link( $category->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a></li>';
             }
         }
@@ -195 +195 @@
                     if ( $category->parent )
                         $thelist .= get_category_parents( $category->parent, true, $separator );
-                    $thelist .= '<a href="' . get_category_link( $category->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a>';
+                    $thelist .= '<a href="' . esc_url( get_category_link( $category->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a>';
                     break;
                 case 'single':
-                    $thelist .= '<a href="' . get_category_link( $category->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>';
+                    $thelist .= '<a href="' . esc_url( get_category_link( $category->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>';
                     if ( $category->parent )
                         $thelist .= get_category_parents( $category->parent, false, $separator );
@@ -205 +205 @@
                 case '':
                 default:
-                    $thelist .= '<a href="' . get_category_link( $category->term_id ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a>';
+                    $thelist .= '<a href="' . esc_url( get_category_link( $category->term_id ) ) . '" title="' . esc_attr( sprintf( __( "View all posts in %s" ), $category->name ) ) . '" ' . $rel . '>' . $category->name.'</a>';
             }
             ++$i;
@@ -826 +826 @@
         $cat_name = esc_attr( $category->name );
         $cat_name = apply_filters( 'list_cats', $cat_name, $category );
-        $link = '<a href="' . esc_attr( get_term_link($category) ) . '" ';
+        $link = '<a href="' . esc_url( get_term_link($category) ) . '" ';
         if ( $use_desc_for_title == 0 || empty($category->description) )
             $link .= 'title="' . esc_attr( sprintf(__( 'View all posts filed under %s' ), $cat_name) ) . '"';
@@ -840 +840 @@
                 $link .= '(';
 
-            $link .= '<a href="' . get_term_feed_link( $category->term_id, $category->taxonomy, $feed_type ) . '"';
+            $link .= '<a href="' . esc_url( get_term_feed_link( $category->term_id, $category->taxonomy, $feed_type ) ) . '"';
 
             if ( empty($feed) ) {
@@ -1110 +1110 @@
         if ( is_wp_error( $link ) )
             return $link;
-        $term_links[] = '<a href="' . $link . '" rel="tag">' . $term->name . '</a>';
+        $term_links[] = '<a href="' . esc_url( $link ) . '" rel="tag">' . $term->name . '</a>';
     }