From a4eb4880b4f05bd5d87a81643e3238fc49a60c1d Mon Sep 17 00:00:00 2001 From: "Dominik Schilling (ocean90)" Date: Wed, 11 Feb 2015 22:47:44 +0000 Subject: [PATCH] Escape Customizer links in the admin menu. Fix usage of `add_query_arg()`. props iseulde. fixes #30952. git-svn-id: https://develop.svn.wordpress.org/trunk@31427 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/menu.php | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/wp-admin/menu.php b/src/wp-admin/menu.php index 89c13d9684..ba14a097c8 100644 --- a/src/wp-admin/menu.php +++ b/src/wp-admin/menu.php @@ -147,24 +147,24 @@ $menu[59] = array( '', 'read', 'separator2', '', 'wp-menu-separator' ); $appearance_cap = current_user_can( 'switch_themes') ? 'switch_themes' : 'edit_theme_options'; -$menu[60] = array( __('Appearance'), $appearance_cap, 'themes.php', '', 'menu-top menu-icon-appearance', 'menu-appearance', 'dashicons-admin-appearance' ); +$menu[60] = array( __( 'Appearance' ), $appearance_cap, 'themes.php', '', 'menu-top menu-icon-appearance', 'menu-appearance', 'dashicons-admin-appearance' ); $submenu['themes.php'][5] = array( __( 'Themes' ), $appearance_cap, 'themes.php' ); $customize_url = add_query_arg( 'return', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), 'customize.php' ); - $submenu['themes.php'][6] = array( __( 'Customize' ), 'customize', $customize_url, '', 'hide-if-no-customize' ); + $submenu['themes.php'][6] = array( __( 'Customize' ), 'customize', esc_url( $customize_url ), '', 'hide-if-no-customize' ); if ( current_theme_supports( 'menus' ) || current_theme_supports( 'widgets' ) ) { - $submenu['themes.php'][10] = array(__( 'Menus' ), 'edit_theme_options', 'nav-menus.php'); + $submenu['themes.php'][10] = array( __( 'Menus' ), 'edit_theme_options', 'nav-menus.php' ); } if ( current_theme_supports( 'custom-header' ) && current_user_can( 'customize') ) { - $customize_header_url = add_query_arg( 'autofocus[control]', 'header_image', $customize_url ); - $submenu['themes.php'][15] = array( __( 'Header' ), $appearance_cap, $customize_header_url, '', 'hide-if-no-customize' ); + $customize_header_url = add_query_arg( array( 'autofocus' => array( 'control' => 'header_image' ) ), $customize_url ); + $submenu['themes.php'][15] = array( __( 'Header' ), $appearance_cap, esc_url( $customize_header_url ), '', 'hide-if-no-customize' ); } if ( current_theme_supports( 'custom-background' ) && current_user_can( 'customize') ) { - $customize_background_url = add_query_arg( 'autofocus[control]', 'background_image', $customize_url ); - $submenu['themes.php'][20] = array( __( 'Background' ), $appearance_cap, $customize_background_url, '', 'hide-if-no-customize' ); + $customize_background_url = add_query_arg( array( 'autofocus' => array( 'control' => 'background_image' ) ), $customize_url ); + $submenu['themes.php'][20] = array( __( 'Background' ), $appearance_cap, esc_url( $customize_background_url ), '', 'hide-if-no-customize' ); } unset( $customize_url );