Changeset 23739 for trunk/wp-admin/includes/file.php

Timestamp:

03/18/2013 02:01:25 PM (12 years ago)

Author:

ryan

Message:

Escape form action urls with esc_url() rather than esc_attr().

Props SergeyBiryukov
fixes #23266

File:

• trunk/wp-admin/includes/file.php (modified) (1 diff)

trunk/wp-admin/includes/file.php

@@ -980 +980 @@
 -->
 </script>
-<form action="<?php echo $form_post ?>" method="post">
+<form action="<?php echo esc_url( $form_post ) ?>" method="post">
 <div class="wrap">
 <?php screen_icon(); ?>