Changeset 59538

Timestamp:

12/18/2024 08:56:06 PM (4 months ago)

Author:

jorbin

Message:

Coding Standards: Escape attachment URL in wp-admin/async-upload.php.

Follow-up to [58279].

Reviewed by jorbin.
Merges [59407] to the 6.7 branch.

Props shyamkariya, pitamdey, nareshbheda, ketanniruke, desrosj, SergeyBiryukov .
Fixes #62434.

Location:

branches/6.7

Files:

• . (modified) (1 prop)
• src/wp-admin/async-upload.php (modified) (1 diff)

branches/6.7/src/wp-admin/async-upload.php

@@ -75 +75 @@
                             ?>
                             <span class="media-item-copy-container copy-to-clipboard-container edit-attachment">
-                                <button type="button" class="button button-small copy-attachment-url" data-clipboard-text="<?php echo $file_url; ?>"><?php _e( 'Copy URL to clipboard' ); ?></button>
+                                <button type="button" class="button button-small copy-attachment-url"
+                                    data-clipboard-text="<?php echo esc_url( $file_url ); ?>"
+                                ><?php _e( 'Copy URL to clipboard' ); ?></button>
                                 <span class="success hidden" aria-hidden="true"><?php _e( 'Copied!' ); ?></span>
                             </span>