WordPress.org

Make WordPress Core

Changeset 31427


Ignore:
Timestamp:
02/11/2015 10:47:44 PM (5 years ago)
Author:
ocean90
Message:

Escape Customizer links in the admin menu. Fix usage of add_query_arg().

props iseulde.
fixes #30952.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/menu.php

    r30659 r31427  
    148148$appearance_cap = current_user_can( 'switch_themes') ? 'switch_themes' : 'edit_theme_options';
    149149
    150 $menu[60] = array( __('Appearance'), $appearance_cap, 'themes.php', '', 'menu-top menu-icon-appearance', 'menu-appearance', 'dashicons-admin-appearance' );
     150$menu[60] = array( __( 'Appearance' ), $appearance_cap, 'themes.php', '', 'menu-top menu-icon-appearance', 'menu-appearance', 'dashicons-admin-appearance' );
    151151    $submenu['themes.php'][5] = array( __( 'Themes' ), $appearance_cap, 'themes.php' );
    152152
    153153    $customize_url = add_query_arg( 'return', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), 'customize.php' );
    154     $submenu['themes.php'][6] = array( __( 'Customize' ), 'customize', $customize_url, '', 'hide-if-no-customize' );
     154    $submenu['themes.php'][6] = array( __( 'Customize' ), 'customize', esc_url( $customize_url ), '', 'hide-if-no-customize' );
    155155
    156156    if ( current_theme_supports( 'menus' ) || current_theme_supports( 'widgets' ) ) {
    157         $submenu['themes.php'][10] = array(__( 'Menus' ), 'edit_theme_options', 'nav-menus.php');
     157        $submenu['themes.php'][10] = array( __( 'Menus' ), 'edit_theme_options', 'nav-menus.php' );
    158158    }
    159159
    160160    if ( current_theme_supports( 'custom-header' ) && current_user_can( 'customize') ) {
    161         $customize_header_url = add_query_arg( 'autofocus[control]', 'header_image', $customize_url );
    162         $submenu['themes.php'][15] = array( __( 'Header' ), $appearance_cap, $customize_header_url, '', 'hide-if-no-customize' );
     161        $customize_header_url = add_query_arg( array( 'autofocus' => array( 'control' => 'header_image' ) ), $customize_url );
     162        $submenu['themes.php'][15] = array( __( 'Header' ), $appearance_cap, esc_url( $customize_header_url ), '', 'hide-if-no-customize' );
    163163    }
    164164
    165165    if ( current_theme_supports( 'custom-background' ) && current_user_can( 'customize') ) {
    166         $customize_background_url = add_query_arg( 'autofocus[control]', 'background_image', $customize_url );
    167         $submenu['themes.php'][20] = array( __( 'Background' ), $appearance_cap, $customize_background_url, '', 'hide-if-no-customize' );
     166        $customize_background_url = add_query_arg( array( 'autofocus' => array( 'control' => 'background_image' ) ), $customize_url );
     167        $submenu['themes.php'][20] = array( __( 'Background' ), $appearance_cap, esc_url( $customize_background_url ), '', 'hide-if-no-customize' );
    168168    }
    169169
Note: See TracChangeset for help on using the changeset viewer.