WordPress.org
Get WordPress

Make WordPress Core

Opened 14 years ago

Closed 13 years ago

#23266 closed defect (bug) (fixed)

Replace esc_attr() with esc_url() for form action URLs

Reported by: SergeyBiryukov Owned by: ryan
Priority: normal Milestone: 3.6
Component: Formatting Version:
Severity: normal Keywords: has-patch
Cc: Focuses:

Description

We use esc_attr() for form action URLs in some places. esc_url() should be used instead.

Attachments (1)

23266.patch​ (3.1 KB ) - added by SergeyBiryukov 14 years ago.

Download all attachments as: .zip

Change History (6)

@SergeyBiryukov
14 years ago

#2 @DrewAPicture
14 years ago

  • Cc DrewAPicture added

+1. Probably wouldn't hurt to rope in some of the others that don't use escaping at all such as in several Multisite files and all over the place really.

I could only find a few instances where esc_url() was used in conjunction with admin_url(), self_admin_url(), site_url() and the like. Not sure if it's even needed.

Here's an ack of the files/lines lacking escaping or misusing esc_attr() as already covered in @SergeyBiryukov's patch: ​https://gist.github.com/4598774

#5 @ryan
13 years ago

  • Owner set to ryan
  • Resolution → fixed
  • Status new → closed

In 23739:

Escape form action urls with esc_url() rather than esc_attr().

Props SergeyBiryukov
fixes #23266

Note: See TracTickets for help on using tickets.