IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Always URL-encode a stylesheet directory value before using it in a URL. These situations are saved by wp_nonce_url(), but we should not depend on that. see #21749, for trunk only.

Browse Source 
git-svn-id: http://core.svn.wordpress.org/trunk@21755 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Andrew Nacin
2012-09-04 22:35:12 +00:00
parent d476c22aa1
commit fb36abe6b7
5 changed files with 21 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
wp-admin/includes/class-wp-themes-list-table.php
View File

@@ -143,7 +143,7 @@ class WP_Themes_List_Table extends WP_List_Table {
. __( 'Live Preview' ) . '</a>';
if ( ! is_multisite() && current_user_can( 'delete_themes' ) )
$actions['delete'] = '<a class="submitdelete deletion" href="' . wp_nonce_url( "themes.php?action=delete&amp;stylesheet=$stylesheet", 'delete-theme_' . $stylesheet )
$actions['delete'] = '<a class="submitdelete deletion" href="' . wp_nonce_url( 'themes.php?action=delete&amp;stylesheet=' . urlencode( $stylesheet ), 'delete-theme_' . $stylesheet )
. '" onclick="' . "return confirm( '" . esc_js( sprintf( __( "You are about to delete this theme '%s'\n 'Cancel' to stop, 'OK' to delete." ), $title ) )
. "' );" . '">' . __( 'Delete' ) . '</a>';