Changeset 45154

Timestamp:

04/09/2019 02:06:29 PM (6 years ago)

Author:

desrosj

Message:

Privacy: Pass admin URLs for data export and erase forms through esc_url().

Introduced in [45149].

Props: birgire.
Fixes #44047.

File:

• trunk/src/wp-admin/includes/user.php (modified) (2 diffs)

trunk/src/wp-admin/includes/user.php

@@ -831 +831 @@
         <?php settings_errors(); ?>
 
-        <form action="<?php echo admin_url( 'tools.php?page=export_personal_data' ); ?>" method="post" class="wp-privacy-request-form">
+        <form action="<?php echo esc_url( admin_url( 'tools.php?page=export_personal_data' ) ); ?>" method="post" class="wp-privacy-request-form">
             <h2><?php esc_html_e( 'Add Data Export Request' ); ?></h2>
             <p><?php esc_html_e( 'An email will be sent to the user at this email address asking them to verify the request.' ); ?></p>
@@ -915 +915 @@
         <?php settings_errors(); ?>
 
-        <form action="<?php echo admin_url( 'tools.php?page=remove_personal_data' ); ?>" method="post" class="wp-privacy-request-form">
+        <form action="<?php echo esc_url( admin_url( 'tools.php?page=remove_personal_data' ) ); ?>" method="post" class="wp-privacy-request-form">
             <h2><?php esc_html_e( 'Add Data Erasure Request' ); ?></h2>
             <p><?php esc_html_e( 'An email will be sent to the user at this email address asking them to verify the request.' ); ?></p>