Changeset 51177 for trunk/src/wp-admin/upload.php

Timestamp:

06/17/2021 02:35:59 PM (4 years ago)

Author:

SergeyBiryukov

Message:

Administration: Consistently escape admin_url() links.

Props chintan1896, mukesh27.
Fixes #53426.

File:

• trunk/src/wp-admin/upload.php (modified) (2 diffs)

trunk/src/wp-admin/upload.php

@@ -88 +88 @@
         if ( current_user_can( 'upload_files' ) ) {
             ?>
-            <a href="<?php echo admin_url( 'media-new.php' ); ?>" class="page-title-action aria-button-if-js"><?php echo esc_html_x( 'Add New', 'file' ); ?></a>
+            <a href="<?php echo esc_url( admin_url( 'media-new.php' ) ); ?>" class="page-title-action aria-button-if-js"><?php echo esc_html_x( 'Add New', 'file' ); ?></a>
                                 <?php
         }
@@ -273 +273 @@
 if ( current_user_can( 'upload_files' ) ) {
     ?>
-    <a href="<?php echo admin_url( 'media-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'file' ); ?></a>
+    <a href="<?php echo esc_url( admin_url( 'media-new.php' ) ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'file' ); ?></a>
                         <?php
 }