Changeset 41156

Timestamp:

07/26/2017 01:21:37 PM (7 years ago)

Author:

SergeyBiryukov

Message:

Users: Use esc_url() instead of esc_attr() to escape the value of the srcset attribute in get_avatar().

Props joemcgill, henry.wright.
Fixes #41215.

File:

• trunk/src/wp-includes/pluggable.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -2536 +2536 @@
         esc_attr( $args['alt'] ),
         esc_url( $url ),
-        esc_attr( "$url2x 2x" ),
+        esc_url( $url2x ) . ' 2x',
         esc_attr( join( ' ', $class ) ),
         (int) $args['height'],