Changeset 24334 for trunk/wp-includes/media.php

Timestamp:

05/23/2013 05:45:59 PM (12 years ago)

Author:

duck_

Message:

Properly escape source parameter in audio/video shortcodes. See #23282.

File:

• trunk/wp-includes/media.php (modified) (4 diffs)

trunk/wp-includes/media.php

@@ -862 +862 @@
         $type = wp_check_filetype( $src );
         if ( ! in_array( $type['ext'], $default_types ) )
-            return sprintf( '<a class="wp-post-format-link-audio" href="%1$s">%1$s</a>', $src );
+            return sprintf( '<a class="wp-post-format-link-audio" href="%s">%s</a>', esc_url( $src ), esc_html( $src ) );
         $primary = true;
         array_unshift( $default_types, 'src' );
@@ -908 +908 @@
                 $fileurl = $$fallback;
             $type = wp_check_filetype( $$fallback );
-            $html .= sprintf( $source, $type['type'], $$fallback );
+            $html .= sprintf( $source, $type['type'], esc_url( $$fallback ) );
         }
     }
@@ -980 +980 @@
         $type = wp_check_filetype( $src );
         if ( ! in_array( $type['ext'], $default_types ) )
-            return sprintf( '<a class="wp-post-format-link-video" href="%1$s">%1$s</a>', $src );
+            return sprintf( '<a class="wp-post-format-link-video" href="%s">%s</a>', esc_url( $src ), esc_html( $src ) );
         $primary = true;
         array_unshift( $default_types, 'src' );
@@ -1034 +1034 @@
             if ( 'm4v' === $type['ext'] )
                 $type['type'] = 'video/m4v';
-            $html .= sprintf( $source, $type['type'], $$fallback );
+            $html .= sprintf( $source, $type['type'], esc_url( $$fallback ) );
         }
     }