Changeset 20685

Timestamp:

05/02/2012 04:29:39 PM (13 years ago)

Author:

nacin

Message:

Always escape the output of get_pagenum_link(). fixes #14556.

File:

• trunk/wp-includes/link-template.php (modified) (2 diffs)

trunk/wp-includes/link-template.php

@@ -1373 +1373 @@
  *
  * @param int $pagenum Optional. Page ID.
- * @return string
- */
-function get_pagenum_link($pagenum = 1) {
+ * @param bool $escape Optional. Whether to escape the URL for display, with esc_url(). Defaults to true.
+*   Otherwise, prepares the URL with esc_url_raw().
+ * @return string
+ */
+function get_pagenum_link($pagenum = 1, $escape = true ) {
     global $wp_rewrite;
 
@@ -1426 +1428 @@
     $result = apply_filters('get_pagenum_link', $result);
 
-    return $result;
+    if ( $escape )
+        return esc_url( $result );
+    else
+        return esc_url_raw( $result );
 }