Changeset 53050

Timestamp:

04/01/2022 11:44:59 AM (3 years ago)

Author:

SergeyBiryukov

Message:

Administration: Consistently escape icon URLs in the admin menu.

Follow-up to [9154], [26664].

Props chintan1896, jigar-bhanushali, mukesh27.
Fixes #55496.

File:

• trunk/src/wp-admin/menu-header.php (modified) (2 diffs)

trunk/src/wp-admin/menu-header.php

@@ -124 +124 @@
          */
         if ( ! empty( $item[6] ) ) {
-            $img = '<img src="' . $item[6] . '" alt="" />';
+            $img = '<img src="' . esc_url( $item[6] ) . '" alt="" />';
 
             if ( 'none' === $item[6] || 'div' === $item[6] ) {
@@ -130 +130 @@
             } elseif ( 0 === strpos( $item[6], 'data:image/svg+xml;base64,' ) ) {
                 $img       = '<br />';
-                $img_style = ' style="background-image:url(\'' . esc_attr( $item[6] ) . '\')"';
+                $img_style = ' style="background-image:url(\'' . esc_url( $item[6] ) . '\')"';
                 $img_class = ' svg';
             } elseif ( 0 === strpos( $item[6], 'dashicons-' ) ) {