Use the proper function to escape WP.org links

[SergeyBiryukov]

We use esc_attr_e() in some places:

<a href="<?php esc_attr_e( 'http://wordpress.org/' ); ?>"><?php _e( 'WordPress' ); ?></a>

esc_url( __( 'http://wordpress.org/' ) ) should be used instead.

[SergeyBiryukov]

Related: #23266

[DrewAPicture]

+1, 23334.patch looks good to me.

[SergeyBiryukov]

In 23413:

Use correct escaping function. fixes #23334.

[SergeyBiryukov]

In 23455:

Revert to esc_attr_e() in setup-config.php to prevent a fatal error.
kses.php is not loaded at this point, so esc_url() cannot be used.

props csixty4, JustinSainton.
fixes #23516. see #23334.