From d90afeeb695c2bc328ceb3fc50edaec587cd46a4 Mon Sep 17 00:00:00 2001 From: Jb Audras Date: Sat, 4 Feb 2023 07:08:22 +0000 Subject: [PATCH] Media: Properly escape Download row action link in Media List Table. Props joedolson, pbiron, audrasjb. Fixes #57574. git-svn-id: https://develop.svn.wordpress.org/trunk@55221 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/includes/class-wp-media-list-table.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wp-admin/includes/class-wp-media-list-table.php b/src/wp-admin/includes/class-wp-media-list-table.php index 1943a5966f..9b17bd95bd 100644 --- a/src/wp-admin/includes/class-wp-media-list-table.php +++ b/src/wp-admin/includes/class-wp-media-list-table.php @@ -852,7 +852,7 @@ class WP_Media_List_Table extends WP_List_Table { $actions['download'] = sprintf( '%s', - wp_get_attachment_url( $post->ID ), + esc_url( wp_get_attachment_url( $post->ID ) ), /* translators: %s: Attachment title. */ esc_attr( sprintf( __( 'Download “%s”' ), $att_title ) ), __( 'Download file' )