Escaping function missing.

[chintan1896]

Escaping function missing which is use admin url function.

[mukesh27]

Hi there!

Thank you for the ticket and patch.

In my global search, I found two more files that need escaping for the admin_url function.

​https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-embed.php#L93
​https://github.com/WordPress/WordPress/blob/master/wp-admin/edit-tag-form.php#L303

[chintan1896]

Refresh patch added

[SergeyBiryukov]

Hi there, thanks for the patch!

Just noting that the instance in wp-includes/class-wp-embed.php does not need escaping.

The current code creates a link like this:

$.get("/build/wp-admin/admin-ajax.php?action=oembed-cache&post=123");

With the patch, the ampersand is converted to the & entity:

$.get("/build/wp-admin/admin-ajax.php?action=oembed-cache&post=123");

This leads to the post parameter being dropped from the link when the request is made in my testing:

http://develop.wordpress.test/build/wp-admin/admin-ajax.php?action=oembed-cache&

The rest of the patch looks good.

[SergeyBiryukov]

On second thought, we could use something like this in wp-includes/class-wp-embed.php:

$.get("<?php echo esc_url( admin_url( 'admin-ajax.php', 'relative' ) ) . '?action=oembed-cache&post=' . $post->ID; ?>");

It would be consistent with a similar line in wp-admin/includes/image-edit.php (as seen in the patch).

[SergeyBiryukov]

In 51177:

Administration: Consistently escape admin_url() links.

Props chintan1896, mukesh27.
Fixes #53426.