Changeset 21755 for trunk/wp-admin/includes/theme.php

Timestamp:

09/04/2012 10:35:12 PM (12 years ago)

Author:

nacin

Message:

Always URL-encode a stylesheet directory value before using it in a URL. These situations are saved by wp_nonce_url(), but we should not depend on that. see #21749, for trunk only.

File:

• trunk/wp-admin/includes/theme.php (modified) (1 diff)

trunk/wp-admin/includes/theme.php

@@ -24 +24 @@
     ob_start();
     if ( empty( $redirect ) )
-        $redirect = wp_nonce_url('themes.php?action=delete&stylesheet=' . $stylesheet, 'delete-theme_' . $stylesheet);
+        $redirect = wp_nonce_url('themes.php?action=delete&stylesheet=' . urlencode( $stylesheet ), 'delete-theme_' . $stylesheet);
     if ( false === ($credentials = request_filesystem_credentials($redirect)) ) {
         $data = ob_get_contents();