Changeset 60213

Timestamp:

05/01/2025 07:24:33 PM (10 months ago)

Author:

SergeyBiryukov

Message:

Coding Standards: Use correct escaping function for nav menu item URLs.

Follow-up to [14248], [15077].

Props hardik2221, nareshbheda, dilipbheda, SirLouen.
Fixes #63351.

Location:

trunk/src/wp-admin/includes

Files:

• class-walker-nav-menu-checklist.php (modified) (1 diff)
• class-walker-nav-menu-edit.php (modified) (1 diff)

trunk/src/wp-admin/includes/class-walker-nav-menu-checklist.php

@@ -118 +118 @@
         $output .= '<input type="hidden" class="menu-item-type" name="menu-item[' . $possible_object_id . '][menu-item-type]" value="' . esc_attr( $menu_item->type ) . '" />';
         $output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . esc_attr( $menu_item->title ) . '" />';
-        $output .= '<input type="hidden" class="menu-item-url" name="menu-item[' . $possible_object_id . '][menu-item-url]" value="' . esc_attr( $menu_item->url ) . '" />';
+        $output .= '<input type="hidden" class="menu-item-url" name="menu-item[' . $possible_object_id . '][menu-item-url]" value="' . esc_url( $menu_item->url ) . '" />';
         $output .= '<input type="hidden" class="menu-item-target" name="menu-item[' . $possible_object_id . '][menu-item-target]" value="' . esc_attr( $menu_item->target ) . '" />';
         $output .= '<input type="hidden" class="menu-item-attr-title" name="menu-item[' . $possible_object_id . '][menu-item-attr-title]" value="' . esc_attr( $menu_item->attr_title ) . '" />';

trunk/src/wp-admin/includes/class-walker-nav-menu-edit.php

@@ -197 +197 @@
                         <label for="edit-menu-item-url-<?php echo $item_id; ?>">
                             <?php _e( 'URL' ); ?><br />
-                            <input type="text" id="edit-menu-item-url-<?php echo $item_id; ?>" class="widefat code edit-menu-item-url" name="menu-item-url[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->url ); ?>" />
+                            <input type="text" id="edit-menu-item-url-<?php echo $item_id; ?>" class="widefat code edit-menu-item-url" name="menu-item-url[<?php echo $item_id; ?>]" value="<?php echo esc_url( $menu_item->url ); ?>" />
                         </label>
                     </p>