Make WordPress Core

Changeset 53050


Ignore:
Timestamp:
04/01/2022 11:44:59 AM (2 years ago)
Author:
SergeyBiryukov
Message:

Administration: Consistently escape icon URLs in the admin menu.

Follow-up to [9154], [26664].

Props chintan1896, jigar-bhanushali, mukesh27.
Fixes #55496.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/menu-header.php

    r49193 r53050  
    124124         */
    125125        if ( ! empty( $item[6] ) ) {
    126             $img = '<img src="' . $item[6] . '" alt="" />';
     126            $img = '<img src="' . esc_url( $item[6] ) . '" alt="" />';
    127127
    128128            if ( 'none' === $item[6] || 'div' === $item[6] ) {
     
    130130            } elseif ( 0 === strpos( $item[6], 'data:image/svg+xml;base64,' ) ) {
    131131                $img       = '<br />';
    132                 $img_style = ' style="background-image:url(\'' . esc_attr( $item[6] ) . '\')"';
     132                $img_style = ' style="background-image:url(\'' . esc_url( $item[6] ) . '\')"';
    133133                $img_class = ' svg';
    134134            } elseif ( 0 === strpos( $item[6], 'dashicons-' ) ) {
Note: See TracChangeset for help on using the changeset viewer.