IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

use clean_url() instead of attribute_escape() when dealing with src/href to protect against XSS. props xknown. fixes #3986 for trunk.

Browse Source 
git-svn-id: http://svn.automattic.com/wordpress/trunk@5056 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
markjaquith
2007-03-17 08:46:59 +00:00
parent 7136d65028
commit 611b037efa
18 changed files with 39 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
wp-admin/edit-page-form.php
View File

@@ -13,7 +13,7 @@ if (0 == $post_ID) {
$form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />";
}
$sendto = attribute_escape(stripslashes(wp_get_referer()));
$sendto = clean_url(stripslashes(wp_get_referer()));
if ( 0 != $post_ID && $sendto == get_permalink($post_ID) )
$sendto = 'redo';