Changeset 5007 for branches/2.1/wp-admin/upload-functions.php

Timestamp:

03/09/2007 04:36:24 AM (18 years ago)

Author:

markjaquith

Message:

Sanitize browser-bound add_query_arg() outputs. fixes #3937

File:

• branches/2.1/wp-admin/upload-functions.php (modified) (1 diff)

branches/2.1/wp-admin/upload-functions.php

@@ -36 +36 @@
 
     if ( $href )
-        $r .= "<a id='file-link-$id' href='$href' title='$post_title' class='file-link $class'>\n";
+        $r .= "<a id='file-link-$id' href='" . attribute_escape($href) ."' title='$post_title' class='file-link $class'>\n";
     if ( $href || $image_src )
         $r .= "\t\t\t$innerHTML";