From 63f4733ead155501fe71b2c2ed3cc9d9c228c439 Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov@git.wordpress.org>
Date: Mon, 21 Jun 2021 04:29:18 +0000
Subject: [PATCH] Administration: Consistently escape `network_admin_url()`
 links.

Follow-up to [51177].

Props chintan1896, mukesh27.
Fixes #53459.

git-svn-id: https://develop.svn.wordpress.org/trunk@51189 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-admin/includes/dashboard.php | 4 ++--
 src/wp-admin/includes/template.php  | 2 +-
 src/wp-admin/network/site-new.php   | 2 +-
 src/wp-admin/network/site-users.php | 2 +-
 src/wp-admin/network/sites.php      | 2 +-
 src/wp-admin/network/user-new.php   | 2 +-
 src/wp-admin/network/users.php      | 4 ++--
 src/wp-admin/upload.php             | 2 +-
 8 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/src/wp-admin/includes/dashboard.php b/src/wp-admin/includes/dashboard.php
index 4ba4b9edde..45dddd81a6 100644
--- a/src/wp-admin/includes/dashboard.php
+++ b/src/wp-admin/includes/dashboard.php
@@ -484,7 +484,7 @@ function wp_network_dashboard_right_now() {
 		do_action( 'wpmuadminresult' );
 	?>
 
-	<form action="<?php echo network_admin_url( 'users.php' ); ?>" method="get">
+	<form action="<?php echo esc_url( network_admin_url( 'users.php' ) ); ?>" method="get">
 		<p>
 			<label class="screen-reader-text" for="search-users"><?php _e( 'Search Users' ); ?></label>
 			<input type="search" name="s" value="" size="30" autocomplete="off" id="search-users" />
@@ -492,7 +492,7 @@ function wp_network_dashboard_right_now() {
 		</p>
 	</form>
 
-	<form action="<?php echo network_admin_url( 'sites.php' ); ?>" method="get">
+	<form action="<?php echo esc_url( network_admin_url( 'sites.php' ) ); ?>" method="get">
 		<p>
 			<label class="screen-reader-text" for="search-sites"><?php _e( 'Search Sites' ); ?></label>
 			<input type="search" name="s" value="" size="30" autocomplete="off" id="search-sites" />
diff --git a/src/wp-admin/includes/template.php b/src/wp-admin/includes/template.php
index acdc12798d..83df709754 100644
--- a/src/wp-admin/includes/template.php
+++ b/src/wp-admin/includes/template.php
@@ -972,7 +972,7 @@ function wp_import_upload_form( $action ) {
 		?>
 		<div class="error"><p><?php _e( 'Before you can upload your import file, you will need to fix the following error:' ); ?></p>
 		<p><strong><?php echo $upload_dir['error']; ?></strong></p></div>
-								<?php
+		<?php
 	else :
 		?>
 <form enctype="multipart/form-data" id="import-upload-form" method="post" class="wp-upload-form" action="<?php echo esc_url( wp_nonce_url( $action, 'import-upload' ) ); ?>">
diff --git a/src/wp-admin/network/site-new.php b/src/wp-admin/network/site-new.php
index ffe2f8fddd..340e35c7bd 100644
--- a/src/wp-admin/network/site-new.php
+++ b/src/wp-admin/network/site-new.php
@@ -201,7 +201,7 @@ printf(
 );
 ?>
 </p>
-<form method="post" action="<?php echo network_admin_url( 'site-new.php?action=add-site' ); ?>" novalidate="novalidate">
+<form method="post" action="<?php echo esc_url( network_admin_url( 'site-new.php?action=add-site' ) ); ?>" novalidate="novalidate">
 <?php wp_nonce_field( 'add-blog', '_wpnonce_add-blog' ); ?>
 	<table class="form-table" role="presentation">
 		<tr class="form-field form-required">
diff --git a/src/wp-admin/network/site-users.php b/src/wp-admin/network/site-users.php
index 1130bf58c7..b2d3f638af 100644
--- a/src/wp-admin/network/site-users.php
+++ b/src/wp-admin/network/site-users.php
@@ -330,7 +330,7 @@ if ( current_user_can( 'promote_users' ) && apply_filters( 'show_network_site_us
 if ( current_user_can( 'create_users' ) && apply_filters( 'show_network_site_users_add_new_form', true ) ) :
 	?>
 <h2 id="add-new-user"><?php _e( 'Add New User' ); ?></h2>
-<form action="<?php echo network_admin_url( 'site-users.php?action=newuser' ); ?>" id="newuser" method="post">
+<form action="<?php echo esc_url( network_admin_url( 'site-users.php?action=newuser' ) ); ?>" id="newuser" method="post">
 	<input type="hidden" name="id" value="<?php echo esc_attr( $id ); ?>" />
 	<table class="form-table" role="presentation">
 		<tr>
diff --git a/src/wp-admin/network/sites.php b/src/wp-admin/network/sites.php
index dd476765d1..bcbee04276 100644
--- a/src/wp-admin/network/sites.php
+++ b/src/wp-admin/network/sites.php
@@ -366,7 +366,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
 <h1 class="wp-heading-inline"><?php _e( 'Sites' ); ?></h1>
 
 <?php if ( current_user_can( 'create_sites' ) ) : ?>
-	<a href="<?php echo network_admin_url( 'site-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'site' ); ?></a>
+	<a href="<?php echo esc_url( network_admin_url( 'site-new.php' ) ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'site' ); ?></a>
 <?php endif; ?>
 
 <?php
diff --git a/src/wp-admin/network/user-new.php b/src/wp-admin/network/user-new.php
index 468d2c795f..191e9bdda1 100644
--- a/src/wp-admin/network/user-new.php
+++ b/src/wp-admin/network/user-new.php
@@ -122,7 +122,7 @@ if ( isset( $add_user_errors ) && is_wp_error( $add_user_errors ) ) {
 		?>
 	</div>
 <?php } ?>
-	<form action="<?php echo network_admin_url( 'user-new.php?action=add-user' ); ?>" id="adduser" method="post" novalidate="novalidate">
+	<form action="<?php echo esc_url( network_admin_url( 'user-new.php?action=add-user' ) ); ?>" id="adduser" method="post" novalidate="novalidate">
 	<table class="form-table" role="presentation">
 		<tr class="form-field form-required">
 			<th scope="row"><label for="username"><?php _e( 'Username' ); ?></label></th>
diff --git a/src/wp-admin/network/users.php b/src/wp-admin/network/users.php
index 5943a7819a..915b0d0958 100644
--- a/src/wp-admin/network/users.php
+++ b/src/wp-admin/network/users.php
@@ -273,8 +273,8 @@ if ( isset( $_REQUEST['updated'] ) && 'true' == $_REQUEST['updated'] && ! empty(
 	<?php
 	if ( current_user_can( 'create_users' ) ) :
 		?>
-		<a href="<?php echo network_admin_url( 'user-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'user' ); ?></a>
-							<?php
+		<a href="<?php echo esc_url( network_admin_url( 'user-new.php' ) ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'user' ); ?></a>
+		<?php
 	endif;
 
 	if ( strlen( $usersearch ) ) {
diff --git a/src/wp-admin/upload.php b/src/wp-admin/upload.php
index 81fe4fd16b..d1de3561ca 100644
--- a/src/wp-admin/upload.php
+++ b/src/wp-admin/upload.php
@@ -88,7 +88,7 @@ if ( 'grid' === $mode ) {
 		if ( current_user_can( 'upload_files' ) ) {
 			?>
 			<a href="<?php echo esc_url( admin_url( 'media-new.php' ) ); ?>" class="page-title-action aria-button-if-js"><?php echo esc_html_x( 'Add New', 'file' ); ?></a>
-								<?php
+			<?php
 		}
 		?>