Changeset 23739 for trunk/wp-admin/includes/template.php

Timestamp:

03/18/2013 02:01:25 PM (12 years ago)

Author:

ryan

Message:

Escape form action urls with esc_url() rather than esc_attr().

Props SergeyBiryukov
fixes #23266

File:

• trunk/wp-admin/includes/template.php (modified) (1 diff)

trunk/wp-admin/includes/template.php

@@ -786 +786 @@
     else :
 ?>
-<form enctype="multipart/form-data" id="import-upload-form" method="post" class="wp-upload-form" action="<?php echo esc_attr(wp_nonce_url($action, 'import-upload')); ?>">
+<form enctype="multipart/form-data" id="import-upload-form" method="post" class="wp-upload-form" action="<?php echo esc_url( wp_nonce_url( $action, 'import-upload' ) ); ?>">
 <p>
 <label for="upload"><?php _e( 'Choose a file from your computer:' ); ?></label> (<?php printf( __('Maximum size: %s' ), $size ); ?>)