URL escaping added in 'class-custom-background.php' file

[robinwpdeveloper]

My first ticket and really excited to contribute to the WordPress core.
Let me know if I need anything else to do.

Trac ticket: 56133

[sajjad67]

Hi @robinwpdeveloper

Welcome to WP Community! You are more than welcome here to share your opinion and do contribution to make wp even better! Please add some more descriptions of your ticket and possibly add a patch file to see what you have in mind and how it benefits & improves WP!!

[robinwpdeveloper]

File path: src/wp-admin/includes/class-custom-background.php
Here home_url( '/' ) is used (Line: 253) without any escaping.

But in other files (e.x. wp-login.php - Line 289) esc_url is used to escape home_url() properly.

We need to do the same in src/wp-admin/includes/class-custom-background.php too.

Happy Coding :)

[costdev]

• Introduced in [13041] (#12186).
• File moved in [45662] (#47632).

Related ticket: #56132

[costdev]

Hi @robinwpdeveloper, welcome to Trac and thanks for the patch! Let's milestone this for 6.1.

@SergeyBiryukov, I see you're listed as the owner. Do you think this patch has anything else to consider, or is it good to go?

Also see the related ticket #56132 for another unescaped instance of home_url().

[SergeyBiryukov]

Replying to costdev:

Do you think this patch has anything else to consider, or is it good to go?

I think this looks good :) Thanks everyone!

[SergeyBiryukov]

In 53643:

Coding Standards: Escape the home URL in the "Background updated. Visit your site" message.

This affects Custom_Background::admin_page().

Follow-up to [13041], [45662], [53642].

Props robinwpdeveloper, sajjad67, rudlinkon, hztyfoon, costdev.
Fixes #56133.

Thanks for the PR! Merged in r53643.