From 6ba0632330518b1b7dab579507106ca651e404f7 Mon Sep 17 00:00:00 2001
From: Rajinsharwar <rajinsharwar@gmail.com>
Date: Fri, 18 Aug 2023 20:45:42 +0600
Subject: [PATCH] Escaping the variables properly

---
 src/wp-admin/revision.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/wp-admin/revision.php b/src/wp-admin/revision.php
index 458a749262..eac6d697eb 100644
--- a/src/wp-admin/revision.php
+++ b/src/wp-admin/revision.php
@@ -104,10 +104,10 @@ switch ( $action ) {
 		}
 
 		$post_edit_link = get_edit_post_link();
-		$post_title     = '<a href="' . $post_edit_link . '">' . _draft_or_post_title() . '</a>';
+		$post_title     = '<a href="' . esc_url($post_edit_link) . '">' . esc_html(_draft_or_post_title()) . '</a>';
 		/* translators: %s: Post title. */
 		$h1             = sprintf( __( 'Compare Revisions of &#8220;%s&#8221;' ), $post_title );
-		$return_to_post = '<a href="' . $post_edit_link . '">' . __( '&larr; Go to editor' ) . '</a>';
+		$return_to_post = '<a href="' . esc_url($post_edit_link) . '">' . __( '&larr; Go to editor' ) . '</a>';
 		// Used in the HTML title tag.
 		$title = __( 'Revisions' );
 
-- 
2.39.2.windows.1