Changeset 21084

Timestamp:

06/15/2012 05:02:39 PM (13 years ago)

Author:

markjaquith

Message:

Always escape the output of get_pagenum_link(). fixes #14556 for the 3.3 branch.

File:

• branches/3.3/wp-includes/link-template.php (modified) (2 diffs)

branches/3.3/wp-includes/link-template.php

@@ -1376 +1376 @@
  *
  * @param int $pagenum Optional. Page ID.
- * @return string
- */
-function get_pagenum_link($pagenum = 1) {
+ * @param bool $escape Optional. Whether to escape the URL for display, with esc_url(). Defaults to true.
+*   Otherwise, prepares the URL with esc_url_raw().
+ * @return string
+ */
+function get_pagenum_link($pagenum = 1, $escape = true ) {
     global $wp_rewrite;
 
@@ -1429 +1431 @@
     $result = apply_filters('get_pagenum_link', $result);
 
-    return $result;
+    if ( $escape )
+        return esc_url( $result );
+    else
+        return esc_url_raw( $result );
 }