WordPress.org

Make WordPress Core

Changeset 37785


Ignore:
Timestamp:
06/21/2016 02:22:35 PM (4 years ago)
Author:
nbachiyski
Message:

Admin: Escape attachment name in case it contains special characters

Merge of [37774] to the 4.4 branch.

Location:
branches/4.4/src
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.4/src/wp-admin/includes/class-wp-media-list-table.php

    r35752 r37785  
    393393            <?php
    394394            $file = get_attached_file( $post->ID );
    395             echo wp_basename( $file );
     395            echo esc_html( wp_basename( $file ) );
    396396            ?>
    397397        </p>
  • branches/4.4/src/wp-includes/post-template.php

    r35737 r37785  
    14481448     * @param string|bool  $text      If string, will be link text. Default false.
    14491449     */
    1450     return apply_filters( 'wp_get_attachment_link', "<a href='$url'>$link_text</a>", $id, $size, $permalink, $icon, $text );
     1450    return apply_filters( 'wp_get_attachment_link', "<a href='" . esc_url( $url ) . "'>$link_text</a>", $id, $size, $permalink, $icon, $text );
    14511451}
    14521452
Note: See TracChangeset for help on using the changeset viewer.