customize.php links in the admin menu are not ecaped

[iseulde]

Additionally add_query_arg is used incorrectly.

Introduced in [30459].

[ocean90]

The urlencode() must stay, otherwise it breaks URLs with multiple query arguments.

[westonruter]

Example: escape admin menu item URLs when output

[westonruter]

Isn't there a more fundamental problem here for escaping? The _wp_menu_output() is not always calling esc_url() when echoing out the menu items. So it seems that something like 30952.demo.diff​ would be a more robust improvement.

[iseulde]

@ocean90 Oops, sorry about the urlencode().

@westonruter That works too. :)

You still need to use an array for add_query_arg() though, or escape it manually.
esc_url( add_query_arg( 'a[a]', 'a', '/' ) ) === '/?aa=a'

[MikeHansenMe]

themes.php also has one

[ocean90]

In 31427:

Escape Customizer links in the admin menu. Fix usage of add_query_arg().

props iseulde.
fixes #30952.