Change esc_html to esc_url

[truptikanzariya]

Change "esc_html" to "esc_url" in the wp-admin/authorize-application.php file.

[dd32]

I believe this is intentionally using esc_html() and not esc_url(), as the link is output on the page, rather than as part of a <a href attribute. This is also not the only location on that page where the link is output using esc_html(). Anywhere that would use it as a link uses esc_url() though.

The code originated in ​https://github.com/WordPress/application-passwords/ - but I can't find the actual source of it there.

[johnbillion]

Yeah esc_html() is appropriate here. Thanks for the contribution though @truptikanzariya !

[sabernhardt]

For what it's worth: that code has had several iterations, with the earliest version in the ​first commit of PR 39 in the plugin.