Changeset 5007 for trunk/wp-includes/script-loader.php

Timestamp:

03/09/2007 04:36:24 AM (18 years ago)

Author:

markjaquith

Message:

Sanitize browser-bound add_query_arg() outputs. fixes #3937

File:

• trunk/wp-includes/script-loader.php (modified) (1 diff)

trunk/wp-includes/script-loader.php

@@ -151 +151 @@
                     $src = 0 === strpos($this->scripts[$handle]->src, 'http://') ? $this->scripts[$handle]->src : get_option( 'siteurl' ) . $this->scripts[$handle]->src;
                     $src = add_query_arg('ver', $ver, $src);
-                    $src = apply_filters( 'script_loader_src', $src );
+                    $src = attribute_escape(apply_filters( 'script_loader_src', $src ));
                     echo "<script type='text/javascript' src='$src'></script>\n";
                     $this->print_scripts_l10n( $handle );