Escape form action urls with esc_url() rather than esc_attr().

Props SergeyBiryukov
fixes #23266


git-svn-id: https://develop.svn.wordpress.org/trunk@23739 602fd350-edb4-49c9-b593-d223f7449a82

wp-admin/includes/file.php

@@ -979,7 +979,7 @@ jQuery(function($){
 });
 -->
 </script>
-<form action="<?php echo $form_post ?>" method="post">
+<form action="<?php echo esc_url( $form_post ) ?>" method="post">
 <div class="wrap">
 <?php screen_icon(); ?>
 <h2><?php _e('Connection Information') ?></h2>