Changeset 23633

Timestamp:

03/07/2013 05:30:00 AM (12 years ago)

Author:

SergeyBiryukov

Message:

Always escape the URL echoed by header_image(). fixes #23664.

File:

• trunk/wp-includes/theme.php (modified) (1 diff)

trunk/wp-includes/theme.php

@@ -982 +982 @@
 
 /**
- * Display header image path.
+ * Display header image URL.
  *
  * @since 2.1.0
  */
 function header_image() {
-    echo get_header_image();
+    echo esc_url( get_header_image() );
 }