vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-11 12:20:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Escape form action urls with esc_url() rather than esc_attr().

Browse Source 
Props SergeyBiryukov
fixes #23266


git-svn-id: https://develop.svn.wordpress.org/trunk@23739 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Ryan Boren
2013-03-18 14:01:25 +00:00
parent 18e3a300ab
commit be67f3c550
5 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-admin/includes/template.php
+1 -1
View File
@@ -785,7 +785,7 @@ function wp_import_upload_form( $action ) {
<p><strong><?php echo $upload_dir['error']; ?></strong></p></div><?php
else :
?>
<form enctype="multipart/form-data" id="import-upload-form" method="post" class="wp-upload-form" action="<?php echo esc_attr(wp_nonce_url($action, 'import-upload')); ?>">
<form enctype="multipart/form-data" id="import-upload-form" method="post" class="wp-upload-form" action="<?php echo esc_url( wp_nonce_url( $action, 'import-upload' ) ); ?>">
<p>
<label for="upload"><?php _e( 'Choose a file from your computer:' ); ?></label> (<?php printf( __('Maximum size: %s' ), $size ); ?>)
<input type="file" id="upload" name="import" size="25" />