Changeset 5007 for branches/2.1/wp-admin/admin-functions.php

Timestamp:

03/09/2007 04:36:24 AM (18 years ago)

Author:

markjaquith

Message:

Sanitize browser-bound add_query_arg() outputs. fixes #3937

File:

• branches/2.1/wp-admin/admin-functions.php (modified) (1 diff)

branches/2.1/wp-admin/admin-functions.php

@@ -1923 +1923 @@
         $bytes = $size * 1024 * 1024 * 1024;
 ?>
-<form enctype="multipart/form-data" id="import-upload-form" method="post" action="<?php echo $action ?>">
+<form enctype="multipart/form-data" id="import-upload-form" method="post" action="<?php echo attribute_escape($action) ?>">
 <p>
 <label for="upload"><?php _e( 'Choose a file from your computer:' ); ?></label> (<?php printf( __('Maximum size: %s' ), $size ); ?> )