Changeset 5057 for branches/2.1/wp-admin/upload.php

Timestamp:

03/17/2007 08:47:29 AM (19 years ago)

Author:

markjaquith

Message:

use clean_url() instead of attribute_escape() when dealing with src/href to protect against XSS. props xknown. fixes #3986 for 2.1.

File:

• branches/2.1/wp-admin/upload.php (modified) (1 diff)

branches/2.1/wp-admin/upload.php

@@ -91 +91 @@
         if ( isset($tab_array[4]) && is_array($tab_array[4]) )
                 add_query_arg( $tab_array[4], $href );
-        $_href = attribute_escape( $href);
+        $_href = clean_url( $href);
         $page_links = '';
         $class = 'upload-tab alignleft';