Changeset 55221

Timestamp:

02/04/2023 07:08:22 AM (19 months ago)

Author:

audrasjb

Message:

Media: Properly escape Download row action link in Media List Table.

Props joedolson, pbiron, audrasjb.
Fixes #57574.

File:

• trunk/src/wp-admin/includes/class-wp-media-list-table.php (modified) (1 diff)

trunk/src/wp-admin/includes/class-wp-media-list-table.php

@@ -853 +853 @@
                 $actions['download'] = sprintf(
                     '<a href="%s" aria-label="%s" download>%s</a>',
-                    wp_get_attachment_url( $post->ID ),
+                    esc_url( wp_get_attachment_url( $post->ID ) ),
                     /* translators: %s: Attachment title. */
                     esc_attr( sprintf( __( 'Download &#8220;%s&#8221;' ), $att_title ) ),