Changeset 50809

Timestamp:

05/04/2021 01:46:06 PM (3 years ago)

Author:

desrosj

Message:

General: Use correct escaping function for form action attributes.

Props chintan1896, audrasjb.
Fixes #53150.

File:

• trunk/src/wp-admin/includes/post.php (modified) (1 diff)

trunk/src/wp-admin/includes/post.php

@@ -2259 +2259 @@
     <?php the_block_editor_meta_box_post_form_hidden_fields( $post ); ?>
     </form>
-    <form id="toggle-custom-fields-form" method="post" action="<?php echo esc_attr( admin_url( 'post.php' ) ); ?>">
+    <form id="toggle-custom-fields-form" method="post" action="<?php echo esc_url( admin_url( 'post.php' ) ); ?>">
         <?php wp_nonce_field( 'toggle-custom-fields', 'toggle-custom-fields-nonce' ); ?>
         <input type="hidden" name="action" value="toggle-custom-fields" />