Context Navigation

← Previous Changeset
Next Changeset →

Changeset 62494

Timestamp:

06/12/2026 01:44:50 AM (4 weeks ago)

Author:

westonruter

Message:

Media: Consistently escape URLs in attachment download links and JS data.

The "Download file" link in attachment_submitbox_metadata() escaped its href with esc_attr(), which only HTML-encodes the value. Use esc_url() instead, the correct function for a URL in an href attribute, since $att_url comes from wp_get_attachment_url(). This applies the same escaping method for the Download link in the media list table output by WP_Media_List_Table::_get_row_actions().

Apply the same correction to wp_prepare_attachment_for_js(), wrapping the attachment, intermediate size, full-size, original image, and image source URLs in esc_url_raw() so the Backbone-rendered media UI emits URLs filtered through clean_url just like the server-rendered templates.

Developed in https://github.com/WordPress/wordpress-develop/pull/12062.
Follow-up to r21680, r47202, r55156, r55198, r55221.

Props thisismyurl, westonruter, sabernhardt, gazipress, jamesbregenzer, manhar, sanayasir, freewebmentor.
See #57574, #41474.
Fixes #65397.

Location:

trunk/src

Files:

: 2 edited

wp-admin/includes/media.php (modified) (1 diff)
wp-includes/media.php (modified) (7 diffs)

Legend:

: Unmodified
: Added
: Removed

trunk/src/wp-admin/includes/media.php

r62400	r62494
3388	3388	</div>
3389	3389	<div class="misc-pub-section misc-pub-download">
3390		<a href="<?php echo esc_~~attr~~( $att_url ); ?>" download><?php _e( 'Download file' ); ?></a>
	3390	<a href="<?php echo esc_url( $att_url ); ?>" download><?php _e( 'Download file' ); ?></a>
3391	3391	</div>
3392	3392	<div class="misc-pub-section misc-pub-filename">

trunk/src/wp-includes/media.php

-              r62455
+              r62494
                 'title'         => $attachment->post_title,
                 'filename'      => wp_basename( get_attached_file( $attachment->ID ) ),
                 'url'           => $attachment_url,
+                'url'           => esc_url_raw( $attachment_url ),
                 'link'          => get_attachment_link( $attachment->ID ),
                 'alt'           => get_post_meta( $attachment->ID, '_wp_attachment_image_alt', true ),
 …
                                         'height'      => $downsize[2],
                                         'width'       => $downsize[1],
                                         'url'         => $downsize[0],
+                                        'url'         => esc_url_raw( $downsize[0] ),
                                         'orientation' => $downsize[2] > $downsize[1] ? 'portrait' : 'landscape',
                                 );
 …
                                         'height'      => $height,
                                         'width'       => $width,
                                         'url'         => $base_url . $size_meta['file'],
+                                        'url'         => esc_url_raw( $base_url . $size_meta['file'] ),
                                         'orientation' => $height > $width ? 'portrait' : 'landscape',
                                 );
 …
                 if ( 'image' === $type ) {
                         if ( ! empty( $meta['original_image'] ) ) {
+                                $response['originalImageURL']  = wp_get_original_image_url( $attachment->ID );
+                                $original_image_url            = wp_get_original_image_url( $attachment->ID );
+                                $response['originalImageURL']  = $original_image_url ? esc_url_raw( $original_image_url ) : '';
                                 $response['originalImageName'] = wp_basename( wp_get_original_image_path( $attachment->ID ) );
+                        }
                         $sizes['full'] = array( 'url' => $attachment_url );
+                        $sizes['full'] = array( 'url' => esc_url_raw( $attachment_url ) );
                         if ( isset( $meta['height'], $meta['width'] ) ) {
 …
                 } elseif ( $meta['sizes']['full']['file'] ) {
                         $sizes['full'] = array(
                                 'url'         => $base_url . $meta['sizes']['full']['file'],
+                                'url'         => esc_url_raw( $base_url . $meta['sizes']['full']['file'] ),
                                 'height'      => $meta['sizes']['full']['height'],
                                 'width'       => $meta['sizes']['full']['width'],
 …
                         if ( is_array( $response_image_full ) ) {
                                 $response['image'] = array(
                                         'src'    => $response_image_full[0],
+                                        'src'    => esc_url_raw( $response_image_full[0] ),
                                         'width'  => $response_image_full[1],
                                         'height' => $response_image_full[2],
 …
                         if ( is_array( $response_image_thumb ) ) {
                                 $response['thumb'] = array(
                                         'src'    => $response_image_thumb[0],
+                                        'src'    => esc_url_raw( $response_image_thumb[0] ),
                                         'width'  => $response_image_thumb[1],
                                         'height' => $response_image_thumb[2],

Note: See TracChangeset for help on using the changeset viewer.

Make WordPress Core

Context Navigation

Changeset 62494

Legend:

trunk/src/wp-admin/includes/media.php

trunk/src/wp-includes/media.php

Download in other formats: