Changeset 5007 for branches/2.0/wp-admin/admin-functions.php

Timestamp:

03/09/2007 04:36:24 AM (18 years ago)

Author:

markjaquith

Message:

Sanitize browser-bound add_query_arg() outputs. fixes #3937

File:

• branches/2.0/wp-admin/admin-functions.php (modified) (1 diff)

branches/2.0/wp-admin/admin-functions.php

@@ -1811 +1811 @@
 }
 </script>
-<form enctype="multipart/form-data" id="uploadForm" method="post" action="<?php echo $action ?>">
+<form enctype="multipart/form-data" id="uploadForm" method="post" action="<?php echo attribute_escape($action) ?>">
 <label for="upload"><?php _e('File:'); ?></label><input type="file" id="upload" name="import" />
 <input type="hidden" name="action" value="save" />