Changeset 62494 for trunk/src/wp-admin/includes/media.php

Timestamp:

06/12/2026 01:44:50 AM (2 months ago)

Author:

westonruter

Message:

Media: Consistently escape URLs in attachment download links and JS data.

The "Download file" link in attachment_submitbox_metadata() escaped its href with esc_attr(), which only HTML-encodes the value. Use esc_url() instead, the correct function for a URL in an href attribute, since $att_url comes from wp_get_attachment_url(). This applies the same escaping method for the Download link in the media list table output by WP_Media_List_Table::_get_row_actions().

Apply the same correction to wp_prepare_attachment_for_js(), wrapping the attachment, intermediate size, full-size, original image, and image source URLs in esc_url_raw() so the Backbone-rendered media UI emits URLs filtered through clean_url just like the server-rendered templates.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/12062.
Follow-up to r21680, r47202, r55156, r55198, r55221.

Props thisismyurl, westonruter, sabernhardt, gazipress, jamesbregenzer, manhar, sanayasir, freewebmentor.
See #57574, #41474.
Fixes #65397.

File:

• trunk/src/wp-admin/includes/media.php (modified) (1 diff)

trunk/src/wp-admin/includes/media.php

@@ -3388 +3388 @@
         </div>
         <div class="misc-pub-section misc-pub-download">
-                <a href="<?php echo esc_attr( $att_url ); ?>" download><?php _e( 'Download file' ); ?></a>
+                <a href="<?php echo esc_url( $att_url ); ?>" download><?php _e( 'Download file' ); ?></a>
         </div>
         <div class="misc-pub-section misc-pub-filename">