Changeset 27574

Timestamp:

03/17/2014 10:15:27 PM (11 years ago)

Author:

ocean90

Message:

Customizer: Use esc_url_raw to escape customizer URL settings to prevent double encoding.

props westonruter, ocean90.
fixes #26569.

File:

• trunk/src/wp-admin/customize.php (modified) (2 diffs)

trunk/src/wp-admin/customize.php

@@ -209 +209 @@
         ),
         'url'      => array(
-            'preview'       => esc_url( $url ? $url : home_url( '/' ) ),
-            'parent'        => esc_url( admin_url() ),
-            'activated'     => admin_url( 'themes.php?activated=true&previewed' ),
-            'ajax'          => esc_url( admin_url( 'admin-ajax.php', 'relative' ) ),
-            'allowed'       => array_map( 'esc_url', $allowed_urls ),
+            'preview'       => esc_url_raw( $url ? $url : home_url( '/' ) ),
+            'parent'        => esc_url_raw( admin_url() ),
+            'activated'     => esc_url_raw( admin_url( 'themes.php?activated=true&previewed' ) ),
+            'ajax'          => esc_url_raw( admin_url( 'admin-ajax.php', 'relative' ) ),
+            'allowed'       => array_map( 'esc_url_raw', $allowed_urls ),
             'isCrossDomain' => $cross_domain,
-            'fallback'      => $fallback_url,
-            'home'          => esc_url( home_url( '/' ) ),
-            'login'         => $login_url,
+            'fallback'      => esc_url_raw( $fallback_url ),
+            'home'          => esc_url_raw( home_url( '/' ) ),
+            'login'         => esc_url_raw( $login_url ),
         ),
         'browser'  => array(
@@ -226 +226 @@
         'controls' => array(),
         'nonce'    => array(
-            'save'    => wp_create_nonce( 'save-customize_' . $wp_customize->get_stylesheet() ),
-            'preview' => wp_create_nonce( 'preview-customize_' . $wp_customize->get_stylesheet() )
-        ),
+            'save'    => wp_create_nonce( 'save-customize_' . $wp_customize->get_stylesheet() ),
+            'preview' => wp_create_nonce( 'preview-customize_' . $wp_customize->get_stylesheet() )
+        ),
     );