Changeset 5828

Timestamp:

08/01/2007 05:21:08 PM (17 years ago)

Author:

markjaquith

Message:

attribute_escape() in upload form action. Props Nazgul. fixes #4689 for 2.2.x

File:

• branches/2.2/wp-admin/upload-functions.php (modified) (1 diff)

branches/2.2/wp-admin/upload-functions.php

@@ -106 +106 @@
     global $post_id, $tab, $style;
     $enctype = $id ? '' : ' enctype="multipart/form-data"';
+    $post_id = (int) $post_id;
 ?>
-    <form<?php echo $enctype; ?> id="upload-file" method="post" action="<?php echo get_option('siteurl') . "/wp-admin/upload.php?style=$style&amp;tab=upload&amp;post_id=$post_id"; ?>">
+    <form<?php echo $enctype; ?> id="upload-file" method="post" action="<?php echo get_option('siteurl') . '/wp-admin/upload.php?style=' . attribute_escape($style) . '&amp;tab=upload&amp;post_id=' . $post_id; ?>">
 <?php
     if ( $id ) :