Changeset 51177 for trunk/src/wp-admin/includes/image-edit.php

Timestamp:

06/17/2021 02:35:59 PM (3 years ago)

Author:

SergeyBiryukov

Message:

Administration: Consistently escape admin_url() links.

Props chintan1896, mukesh27.
Fixes #53426.

File:

• trunk/src/wp-admin/includes/image-edit.php (modified) (1 diff)

trunk/src/wp-admin/includes/image-edit.php

@@ -91 +91 @@
 
         <div id="imgedit-crop-<?php echo $post_id; ?>" class="imgedit-crop-wrap">
-        <img id="image-preview-<?php echo $post_id; ?>" onload="imageEdit.imgLoaded('<?php echo $post_id; ?>')" src="<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>?action=imgedit-preview&amp;_ajax_nonce=<?php echo $nonce; ?>&amp;postid=<?php echo $post_id; ?>&amp;rand=<?php echo rand( 1, 99999 ); ?>" alt="" />
+        <img id="image-preview-<?php echo $post_id; ?>" onload="imageEdit.imgLoaded('<?php echo $post_id; ?>')"
+            src="<?php echo esc_url( admin_url( 'admin-ajax.php', 'relative' ) ) . '?action=imgedit-preview&amp;_ajax_nonce=' . $nonce . '&amp;postid=' . $post_id . '&amp;rand=' . rand( 1, 99999 ); ?>" alt="" />
         </div>