From 91edc716967c7d08ffd4c380fa93686701ca6339 Mon Sep 17 00:00:00 2001
From: Ryan Boren <ryan@git.wordpress.org>
Date: Wed, 25 Apr 2012 20:24:20 +0000
Subject: [PATCH] Pass the upload iframe src url as an arg to sprintf to avoid
 treating octets as format specifiers. Fixes setting the featured image on
 blogs containing spaces in the install path. Props rosshanney. fixes #20443

git-svn-id: https://develop.svn.wordpress.org/trunk@20594 602fd350-edb4-49c9-b593-d223f7449a82
---
 wp-admin/includes/post.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/wp-admin/includes/post.php b/wp-admin/includes/post.php
index 72ba517cf9..8d014258fa 100644
--- a/wp-admin/includes/post.php
+++ b/wp-admin/includes/post.php
@@ -1145,8 +1145,9 @@ function _wp_post_thumbnail_html( $thumbnail_id = null, $post_id = null ) {
 	if ( empty( $post_id ) )
 		$post_id = $post_ID;
 
-	$set_thumbnail_link = '<p class="hide-if-no-js"><a title="' . esc_attr__( 'Set featured image' ) . '" href="' . esc_url( get_upload_iframe_src('image', $post_id) ) . '" id="set-post-thumbnail" class="thickbox">%s</a></p>';
-	$content = sprintf($set_thumbnail_link, esc_html__( 'Set featured image' ));
+	$upload_iframe_src = esc_url( get_upload_iframe_src('image', $post_id) );
+	$set_thumbnail_link = '<p class="hide-if-no-js"><a title="' . esc_attr__( 'Set featured image' ) . '" href="%s" id="set-post-thumbnail" class="thickbox">%s</a></p>';
+	$content = sprintf( $set_thumbnail_link, $upload_iframe_src, esc_html__( 'Set featured image' ) );
 
 	if ( $thumbnail_id && get_post( $thumbnail_id ) ) {
 		$old_content_width = $content_width;
@@ -1157,7 +1158,7 @@ function _wp_post_thumbnail_html( $thumbnail_id = null, $post_id = null ) {
 			$thumbnail_html = wp_get_attachment_image( $thumbnail_id, 'post-thumbnail' );
 		if ( !empty( $thumbnail_html ) ) {
 			$ajax_nonce = wp_create_nonce( "set_post_thumbnail-$post_id" );
-			$content = sprintf($set_thumbnail_link, $thumbnail_html);
+			$content = sprintf( $set_thumbnail_link, $upload_iframe_src, $thumbnail_html );
 			$content .= '<p class="hide-if-no-js"><a href="#" id="remove-post-thumbnail" onclick="WPRemoveThumbnail(\'' . $ajax_nonce . '\');return false;">' . esc_html__( 'Remove featured image' ) . '</a></p>';
 		}
 		$content_width = $old_content_width;