WordPress.org

Make WordPress Core

Changeset 37786


Ignore:
Timestamp:
06/21/2016 02:23:11 PM (4 years ago)
Author:
nbachiyski
Message:

Admin: Escape attachment name in case it contains special characters

Merge of [37774] to the 4.3 branch.

Location:
branches/4.3/src
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.3/src/wp-admin/includes/class-wp-media-list-table.php

    r33270 r37786  
    362362            <?php _media_states( $post ); ?>
    363363        </strong>
    364         <p class="filename"><span class="screen-reader-text"><?php _e( 'File name:' ); ?> </span><?php echo wp_basename( $post->guid ); ?></p>
     364        <p class="filename"><span class="screen-reader-text"><?php _e( 'File name:' ); ?> </span><?php echo esc_html( wp_basename( $post->guid ) ); ?></p>
    365365        <?php
    366366    }
  • branches/4.3/src/wp-includes/post-template.php

    r32892 r37786  
    15981598     * @param string|bool $text      If string, will be link text. Default false.
    15991599     */
    1600     return apply_filters( 'wp_get_attachment_link', "<a href='$url'>$link_text</a>", $id, $size, $permalink, $icon, $text );
     1600    return apply_filters( 'wp_get_attachment_link', "<a href='" . esc_url( $url ) . "'>$link_text</a>", $id, $size, $permalink, $icon, $text );
    16011601}
    16021602
Note: See TracChangeset for help on using the changeset viewer.