Changeset 51189

Timestamp:

06/21/2021 04:29:18 AM (4 years ago)

Author:

SergeyBiryukov

Message:

Administration: Consistently escape network_admin_url() links.

Follow-up to [51177].

Props chintan1896, mukesh27.
Fixes #53459.

Location:

trunk/src/wp-admin

Files:

• includes/dashboard.php (modified) (2 diffs)
• includes/template.php (modified) (1 diff)
• network/site-new.php (modified) (1 diff)
• network/site-users.php (modified) (1 diff)
• network/sites.php (modified) (1 diff)
• network/user-new.php (modified) (1 diff)
• network/users.php (modified) (1 diff)
• upload.php (modified) (1 diff)

trunk/src/wp-admin/includes/dashboard.php

@@ -485 +485 @@
     ?>
 
-    <form action="<?php echo network_admin_url( 'users.php' ); ?>" method="get">
+    <form action="<?php echo esc_url( network_admin_url( 'users.php' ) ); ?>" method="get">
         <p>
             <label class="screen-reader-text" for="search-users"><?php _e( 'Search Users' ); ?></label>
@@ -493 +493 @@
     </form>
 
-    <form action="<?php echo network_admin_url( 'sites.php' ); ?>" method="get">
+    <form action="<?php echo esc_url( network_admin_url( 'sites.php' ) ); ?>" method="get">
         <p>
             <label class="screen-reader-text" for="search-sites"><?php _e( 'Search Sites' ); ?></label>

trunk/src/wp-admin/includes/template.php

@@ -973 +973 @@
         <div class="error"><p><?php _e( 'Before you can upload your import file, you will need to fix the following error:' ); ?></p>
         <p><strong><?php echo $upload_dir['error']; ?></strong></p></div>
-                                <?php
+        <?php
     else :
         ?>

trunk/src/wp-admin/network/site-new.php

@@ -202 +202 @@
 ?>
 </p>
-<form method="post" action="<?php echo network_admin_url( 'site-new.php?action=add-site' ); ?>" novalidate="novalidate">
+<form method="post" action="<?php echo esc_url( network_admin_url( 'site-new.php?action=add-site' ) ); ?>" novalidate="novalidate">
 <?php wp_nonce_field( 'add-blog', '_wpnonce_add-blog' ); ?>
     <table class="form-table" role="presentation">

trunk/src/wp-admin/network/site-users.php

@@ -331 +331 @@
     ?>
 <h2 id="add-new-user"><?php _e( 'Add New User' ); ?></h2>
-<form action="<?php echo network_admin_url( 'site-users.php?action=newuser' ); ?>" id="newuser" method="post">
+<form action="<?php echo esc_url( network_admin_url( 'site-users.php?action=newuser' ) ); ?>" id="newuser" method="post">
     <input type="hidden" name="id" value="<?php echo esc_attr( $id ); ?>" />
     <table class="form-table" role="presentation">

trunk/src/wp-admin/network/sites.php

@@ -367 +367 @@
 
 <?php if ( current_user_can( 'create_sites' ) ) : ?>
-    <a href="<?php echo network_admin_url( 'site-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'site' ); ?></a>
+    <a href="<?php echo esc_url( network_admin_url( 'site-new.php' ) ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'site' ); ?></a>
 <?php endif; ?>
 

trunk/src/wp-admin/network/user-new.php

@@ -123 +123 @@
     </div>
 <?php } ?>
-    <form action="<?php echo network_admin_url( 'user-new.php?action=add-user' ); ?>" id="adduser" method="post" novalidate="novalidate">
+    <form action="<?php echo esc_url( network_admin_url( 'user-new.php?action=add-user' ) ); ?>" id="adduser" method="post" novalidate="novalidate">
     <table class="form-table" role="presentation">
         <tr class="form-field form-required">

trunk/src/wp-admin/network/users.php

@@ -274 +274 @@
     if ( current_user_can( 'create_users' ) ) :
         ?>
-        <a href="<?php echo network_admin_url( 'user-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'user' ); ?></a>
-                            <?php
+        <a href="<?php echo esc_url( network_admin_url( 'user-new.php' ) ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'user' ); ?></a>
+        <?php
     endif;
 

trunk/src/wp-admin/upload.php

@@ -89 +89 @@
             ?>
             <a href="<?php echo esc_url( admin_url( 'media-new.php' ) ); ?>" class="page-title-action aria-button-if-js"><?php echo esc_html_x( 'Add New', 'file' ); ?></a>
-                                <?php
+            <?php
         }
         ?>