Changeset 29397 for trunk/src/wp-includes/pluggable.php

Timestamp:

08/06/2014 07:49:30 AM (12 years ago)

Author:

nacin

Message:

Escape late in get_avatar().

File:

• trunk/src/wp-includes/pluggable.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -2174 +2174 @@
                 $avatar = "<img alt='{$safe_alt}' src='{$out}' class='avatar avatar-{$size} photo' height='{$size}' width='{$size}' />";
         } else {
-                $avatar = "<img alt='{$safe_alt}' src='{$default}' class='avatar avatar-{$size} photo avatar-default' height='{$size}' width='{$size}' />";
+                $out = esc_url( $default );
+                $avatar = "<img alt='{$safe_alt}' src='{$out}' class='avatar avatar-{$size} photo avatar-default' height='{$size}' width='{$size}' />";
         }