Changeset 5007 for trunk/wp-admin/custom-header.php

Timestamp:

03/09/2007 04:36:24 AM (18 years ago)

Author:

markjaquith

Message:

Sanitize browser-bound add_query_arg() outputs. fixes #3937

File:

• trunk/wp-admin/custom-header.php (modified) (3 diffs)

trunk/wp-admin/custom-header.php

@@ -175 +175 @@
 <p><?php printf(__('Images of exactly <strong>%1$d x %2$d pixels</strong> will be used as-is.'), HEADER_IMAGE_WIDTH, HEADER_IMAGE_HEIGHT); ?></p>
 
-<form enctype="multipart/form-data" id="uploadForm" method="POST" action="<?php echo add_query_arg('step', 2) ?>" style="margin: auto; width: 50%;">
+<form enctype="multipart/form-data" id="uploadForm" method="POST" action="<?php echo attribute_escape(add_query_arg('step', 2)) ?>" style="margin: auto; width: 50%;">
 <label for="upload"><?php _e('Choose an image from your computer:'); ?></label><br /><input type="file" id="upload" name="import" />
 <input type="hidden" name="action" value="save" />
@@ -189 +189 @@
 <h2><?php _e('Reset Header Image and Color'); ?></h2>
 <p><?php _e('This will restore the original header image and color. You will not be able to retrieve any customizations.') ?></p>
-<form method="post" action="<?php echo add_query_arg('step', 1) ?>">
+<form method="post" action="<?php echo attribute_escape(add_query_arg('step', 1)) ?>">
 <input type="submit" name="resetheader" value="<?php _e('Restore Original Header'); ?>" />
 </form>
@@ -241 +241 @@
 <div class="wrap">
 
-<form method="POST" action="<?php echo add_query_arg('step', 3) ?>">
+<form method="POST" action="<?php echo attribute_escape(add_query_arg('step', 3)) ?>">
 
 <p><?php _e('Choose the part of the image you want to use as your header.'); ?></p>