Changeset 5007 for branches/2.1/wp-includes/script-loader.php

Timestamp:

03/09/2007 04:36:24 AM (18 years ago)

Author:

markjaquith

Message:

Sanitize browser-bound add_query_arg() outputs. fixes #3937

File:

• branches/2.1/wp-includes/script-loader.php (modified) (1 diff)

branches/2.1/wp-includes/script-loader.php

@@ -79 +79 @@
                         $ver .= '&' . $this->args[$handle];
                     $src = 0 === strpos($this->scripts[$handle]->src, 'http://') ? $this->scripts[$handle]->src : get_option( 'siteurl' ) . $this->scripts[$handle]->src;
-                    $src = add_query_arg('ver', $ver, $src);
+                    $src = attribute_escape(add_query_arg('ver', $ver, $src));
                     echo "<script type='text/javascript' src='$src'></script>\n";
                 }