Make WordPress Core

Changeset 23528


Ignore:
Timestamp:
02/28/2013 06:58:52 PM (12 years ago)
Author:
nacin
Message:

esc_url() when printing a URL into an attribute, even when it is known to be safe. (see #17562)

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-includes/author-template.php

    r23448 r23528  
    135135function get_the_author_link() {
    136136    if ( get_the_author_meta('url') ) {
    137         return '<a href="' . get_the_author_meta('url') . '" title="' . esc_attr( sprintf(__("Visit %s&#8217;s website"), get_the_author()) ) . '" rel="author external">' . get_the_author() . '</a>';
     137        return '<a href="' . esc_url( get_the_author_meta('url') ) . '" title="' . esc_attr( sprintf(__("Visit %s&#8217;s website"), get_the_author()) ) . '" rel="author external">' . get_the_author() . '</a>';
    138138    } else {
    139139        return get_the_author();
     
    201201    $link = sprintf(
    202202        '<a href="%1$s" title="%2$s" rel="author">%3$s</a>',
    203         get_author_posts_url( $authordata->ID, $authordata->user_nicename ),
     203        esc_url( get_author_posts_url( $authordata->ID, $authordata->user_nicename ) ),
    204204        esc_attr( sprintf( __( 'Posts by %s' ), get_the_author() ) ),
    205205        get_the_author()
Note: See TracChangeset for help on using the changeset viewer.