Changeset 28463 for trunk/src/wp-content/themes/twentyten/loop-attachment.php

Timestamp:

05/16/2014 10:43:31 PM (11 years ago)

Author:

lancewillett

Message:

Twenty Ten: correct attribute escaping in the attachment template. Props philiparthurmoore, see #28251.

File:

• trunk/src/wp-content/themes/twentyten/loop-attachment.php (modified) (4 diffs)

trunk/src/wp-content/themes/twentyten/loop-attachment.php

@@ -19 +19 @@
 
                 <?php if ( ! empty( $post->post_parent ) ) : ?>
-                    <p class="page-title"><a href="<?php echo get_permalink( $post->post_parent ); ?>" title="<?php echo esc_attr( sprintf( __( 'Return to %s', 'twentyten' ), strip_tags( get_the_title( $post->post_parent ) ) ) ); ?>" rel="gallery"><?php
+                    <p class="page-title"><a href="<?php echo esc_url( get_permalink( $post->post_parent ) ); ?>" title="<?php echo esc_attr( sprintf( __( 'Return to %s', 'twentyten' ), strip_tags( get_the_title( $post->post_parent ) ) ) ); ?>" rel="gallery"><?php
                         /* translators: %s - title of parent post */
                         printf( __( '<span class="meta-nav">&larr;</span> %s', 'twentyten' ), get_the_title( $post->post_parent ) );
@@ -53 +53 @@
                                 printf( __( 'Full size is %s pixels', 'twentyten' ),
                                     sprintf( '<a href="%1$s" title="%2$s">%3$s &times; %4$s</a>',
-                                        wp_get_attachment_url(),
+                                        esc_url( wp_get_attachment_url() ),
                                         esc_attr( __( 'Link to full-size image', 'twentyten' ) ),
                                         $metadata['width'],
@@ -86 +86 @@
     }
 ?>
-                        <p class="attachment"><a href="<?php echo $next_attachment_url; ?>" title="<?php the_title_attribute(); ?>" rel="attachment"><?php
+                        <p class="attachment"><a href="<?php echo esc_url( $next_attachment_url ); ?>" title="<?php the_title_attribute(); ?>" rel="attachment"><?php
                             /**
                              * Filter the Twenty Ten default attachment width.
@@ -111 +111 @@
                         </div><!-- #nav-below -->
 <?php else : ?>
-                        <a href="<?php echo wp_get_attachment_url(); ?>" title="<?php the_title_attribute(); ?>" rel="attachment"><?php echo basename( get_permalink() ); ?></a>
+                        <a href="<?php echo esc_url( wp_get_attachment_url() ); ?>" title="<?php the_title_attribute(); ?>" rel="attachment"><?php echo basename( get_permalink() ); ?></a>
 <?php endif; ?>
                         </div><!-- .entry-attachment -->