diff --git a/src/wp-admin/about.php b/src/wp-admin/about.php index 9eaf4fdc88..1cd366020b 100644 --- a/src/wp-admin/about.php +++ b/src/wp-admin/about.php @@ -23,7 +23,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php'; <div class="about__header"> <div class="about__header-image"> - <img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo admin_url( 'images/about-badge.svg' ); ?>" /> + <img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo esc_url( admin_url( 'images/about-badge.svg' ) ); ?>" /> </div> <div class="about__header-title"> @@ -179,8 +179,8 @@ require_once ABSPATH . 'wp-admin/admin-header.php'; <div class="about__section has-subtle-background-color"> <div class="column about__image"> <picture> - <source media="(max-width: 600px)" srcset="<?php echo admin_url( 'images/about-color-palette-vert.svg' ); ?>" /> - <img alt="" src="<?php echo admin_url( 'images/about-color-palette.svg' ); ?>" /> + <source media="(max-width: 600px)" srcset="<?php echo esc_url( admin_url( 'images/about-color-palette-vert.svg' ) ); ?>" /> + <img alt="" src="<?php echo esc_url( admin_url( 'images/about-color-palette.svg' ) ); ?>" /> </picture> </div> </div> diff --git a/src/wp-admin/comment.php b/src/wp-admin/comment.php index ad11f3e05b..a08e130525 100644 --- a/src/wp-admin/comment.php +++ b/src/wp-admin/comment.php @@ -232,7 +232,7 @@ switch ( $action ) { <th scope="row"><?php /* translators: Field name in comment form. */ _ex( 'Comment', 'noun' ); ?></th> <td class="comment-content"> <?php comment_text( $comment ); ?> - <p class="edit-comment"><a href="<?php echo admin_url( "comment.php?action=editcomment&c={$comment->comment_ID}" ); ?>"><?php esc_html_e( 'Edit' ); ?></a></p> + <p class="edit-comment"><a href="<?php echo esc_url( admin_url( "comment.php?action=editcomment&c={$comment->comment_ID}" ) ); ?>"><?php esc_html_e( 'Edit' ); ?></a></p> </td> </tr> </table> @@ -241,7 +241,7 @@ switch ( $action ) { <p> <?php submit_button( $button, 'primary', 'submit', false ); ?> - <a href="<?php echo admin_url( 'edit-comments.php' ); ?>" class="button-cancel"><?php esc_html_e( 'Cancel' ); ?></a> + <a href="<?php echo esc_url( admin_url( 'edit-comments.php' ) ); ?>" class="button-cancel"><?php esc_html_e( 'Cancel' ); ?></a> </p> <?php wp_nonce_field( $nonce_action ); ?> diff --git a/src/wp-admin/credits.php b/src/wp-admin/credits.php index e08684331d..639113483f 100644 --- a/src/wp-admin/credits.php +++ b/src/wp-admin/credits.php @@ -22,7 +22,7 @@ $credits = wp_credits(); <div class="about__header"> <div class="about__header-image"> - <img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo admin_url( 'images/about-badge.svg' ); ?>" /> + <img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo esc_url( admin_url( 'images/about-badge.svg' ) ); ?>" /> </div> <div class="about__header-container"> diff --git a/src/wp-admin/edit-tag-form.php b/src/wp-admin/edit-tag-form.php index cb2249e2b0..3752b8f52c 100644 --- a/src/wp-admin/edit-tag-form.php +++ b/src/wp-admin/edit-tag-form.php @@ -300,7 +300,7 @@ do_action( "{$taxonomy}_edit_form", $tag, $taxonomy ); <?php if ( current_user_can( 'delete_term', $tag->term_id ) ) : ?> <span id="delete-link"> - <a class="delete" href="<?php echo admin_url( wp_nonce_url( "edit-tags.php?action=delete&taxonomy=$taxonomy&tag_ID=$tag->term_id", 'delete-tag_' . $tag->term_id ) ); ?>"><?php _e( 'Delete' ); ?></a> + <a class="delete" href="<?php echo esc_url( admin_url( wp_nonce_url( "edit-tags.php?action=delete&taxonomy=$taxonomy&tag_ID=$tag->term_id", 'delete-tag_' . $tag->term_id ) ) ); ?>"><?php _e( 'Delete' ); ?></a> </span> <?php endif; ?> diff --git a/src/wp-admin/freedoms.php b/src/wp-admin/freedoms.php index 21ca2e500a..dae9cc1b55 100644 --- a/src/wp-admin/freedoms.php +++ b/src/wp-admin/freedoms.php @@ -25,7 +25,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php'; <div class="about__header"> <div class="about__header-image"> - <img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo admin_url( 'images/about-badge.svg' ); ?>" /> + <img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo esc_url( admin_url( 'images/about-badge.svg' ) ); ?>" /> </div> <div class="about__header-container"> diff --git a/src/wp-admin/includes/dashboard.php b/src/wp-admin/includes/dashboard.php index 178e45b2a1..4ba4b9edde 100644 --- a/src/wp-admin/includes/dashboard.php +++ b/src/wp-admin/includes/dashboard.php @@ -1996,7 +1996,7 @@ function wp_welcome_panel() { <h3><?php _e( 'Get Started' ); ?></h3> <a class="button button-primary button-hero load-customize hide-if-no-customize" href="<?php echo wp_customize_url(); ?>"><?php _e( 'Customize Your Site' ); ?></a> <?php endif; ?> - <a class="button button-primary button-hero hide-if-customize" href="<?php echo admin_url( 'themes.php' ); ?>"><?php _e( 'Customize Your Site' ); ?></a> + <a class="button button-primary button-hero hide-if-customize" href="<?php echo esc_url( admin_url( 'themes.php' ) ); ?>"><?php _e( 'Customize Your Site' ); ?></a> <?php if ( current_user_can( 'install_themes' ) || ( current_user_can( 'switch_themes' ) && count( wp_get_themes( array( 'allowed' => true ) ) ) > 1 ) ) : ?> <?php $themes_link = current_user_can( 'customize' ) ? add_query_arg( 'autofocus[panel]', 'themes', admin_url( 'customize.php' ) ) : admin_url( 'themes.php' ); ?> <p class="hide-if-no-customize"> diff --git a/src/wp-admin/includes/image-edit.php b/src/wp-admin/includes/image-edit.php index 52b403d180..95da5af3d5 100644 --- a/src/wp-admin/includes/image-edit.php +++ b/src/wp-admin/includes/image-edit.php @@ -90,7 +90,8 @@ function wp_image_editor( $post_id, $msg = false ) { <input type="hidden" id="imgedit-y-<?php echo $post_id; ?>" value="<?php echo isset( $meta['height'] ) ? $meta['height'] : 0; ?>" /> <div id="imgedit-crop-<?php echo $post_id; ?>" class="imgedit-crop-wrap"> - <img id="image-preview-<?php echo $post_id; ?>" onload="imageEdit.imgLoaded('<?php echo $post_id; ?>')" src="<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>?action=imgedit-preview&_ajax_nonce=<?php echo $nonce; ?>&postid=<?php echo $post_id; ?>&rand=<?php echo rand( 1, 99999 ); ?>" alt="" /> + <img id="image-preview-<?php echo $post_id; ?>" onload="imageEdit.imgLoaded('<?php echo $post_id; ?>')" + src="<?php echo esc_url( admin_url( 'admin-ajax.php', 'relative' ) ) . '?action=imgedit-preview&_ajax_nonce=' . $nonce . '&postid=' . $post_id . '&rand=' . rand( 1, 99999 ); ?>" alt="" /> </div> <div class="imgedit-submit"> diff --git a/src/wp-admin/media-new.php b/src/wp-admin/media-new.php index a4df447ceb..97426512a4 100644 --- a/src/wp-admin/media-new.php +++ b/src/wp-admin/media-new.php @@ -72,7 +72,7 @@ if ( get_user_setting( 'uploader' ) || isset( $_GET['browser-uploader'] ) ) { <div class="wrap"> <h1><?php echo esc_html( $title ); ?></h1> - <form enctype="multipart/form-data" method="post" action="<?php echo admin_url( 'media-new.php' ); ?>" class="<?php echo esc_attr( $form_class ); ?>" id="file-form"> + <form enctype="multipart/form-data" method="post" action="<?php echo esc_url( admin_url( 'media-new.php' ) ); ?>" class="<?php echo esc_attr( $form_class ); ?>" id="file-form"> <?php media_upload_form(); ?> diff --git a/src/wp-admin/nav-menus.php b/src/wp-admin/nav-menus.php index c9683ae299..950499fde1 100644 --- a/src/wp-admin/nav-menus.php +++ b/src/wp-admin/nav-menus.php @@ -689,7 +689,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php'; <hr class="wp-header-end"> <nav class="nav-tab-wrapper wp-clearfix" aria-label="<?php esc_attr_e( 'Secondary menu' ); ?>"> - <a href="<?php echo admin_url( 'nav-menus.php' ); ?>" class="nav-tab<?php echo $nav_tab_active_class; ?>"<?php echo $nav_aria_current; ?>><?php esc_html_e( 'Edit Menus' ); ?></a> + <a href="<?php echo esc_url( admin_url( 'nav-menus.php' ) ); ?>" class="nav-tab<?php echo $nav_tab_active_class; ?>"<?php echo $nav_aria_current; ?>><?php esc_html_e( 'Edit Menus' ); ?></a> <?php if ( $num_locations && $menu_count ) { $active_tab_class = ''; @@ -840,7 +840,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php'; <span class="screen-reader-text"><?php _e( 'Click the Save Menu button to save your changes.' ); ?></span> </span><!-- /add-edit-menu-action --> <?php else : ?> - <form method="get" action="<?php echo admin_url( 'nav-menus.php' ); ?>"> + <form method="get" action="<?php echo esc_url( admin_url( 'nav-menus.php' ) ); ?>"> <input type="hidden" name="action" value="edit" /> <label for="select-menu-to-edit" class="selected-menu"><?php _e( 'Select a menu to edit:' ); ?></label> <select name="menu" id="select-menu-to-edit"> diff --git a/src/wp-admin/privacy.php b/src/wp-admin/privacy.php index c8b6ab5905..57ea379021 100644 --- a/src/wp-admin/privacy.php +++ b/src/wp-admin/privacy.php @@ -19,7 +19,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php'; <div class="about__header"> <div class="about__header-image"> - <img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo admin_url( 'images/about-badge.svg' ); ?>" /> + <img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo esc_url( admin_url( 'images/about-badge.svg' ) ); ?>" /> </div> <div class="about__header-container"> diff --git a/src/wp-admin/themes.php b/src/wp-admin/themes.php index f671d54e22..2a230ee504 100644 --- a/src/wp-admin/themes.php +++ b/src/wp-admin/themes.php @@ -250,7 +250,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php'; </h1> <?php if ( ! is_multisite() && current_user_can( 'install_themes' ) ) : ?> - <a href="<?php echo admin_url( 'theme-install.php' ); ?>" class="hide-if-no-js page-title-action"><?php echo esc_html_x( 'Add New', 'theme' ); ?></a> + <a href="<?php echo esc_url( admin_url( 'theme-install.php' ) ); ?>" class="hide-if-no-js page-title-action"><?php echo esc_html_x( 'Add New', 'theme' ); ?></a> <?php endif; ?> <form class="search-form"></form> diff --git a/src/wp-admin/upload.php b/src/wp-admin/upload.php index 8ea6e1c6d6..81fe4fd16b 100644 --- a/src/wp-admin/upload.php +++ b/src/wp-admin/upload.php @@ -87,7 +87,7 @@ if ( 'grid' === $mode ) { <?php if ( current_user_can( 'upload_files' ) ) { ?> - <a href="<?php echo admin_url( 'media-new.php' ); ?>" class="page-title-action aria-button-if-js"><?php echo esc_html_x( 'Add New', 'file' ); ?></a> + <a href="<?php echo esc_url( admin_url( 'media-new.php' ) ); ?>" class="page-title-action aria-button-if-js"><?php echo esc_html_x( 'Add New', 'file' ); ?></a> <?php } ?> @@ -272,7 +272,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php'; <?php if ( current_user_can( 'upload_files' ) ) { ?> - <a href="<?php echo admin_url( 'media-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'file' ); ?></a> + <a href="<?php echo esc_url( admin_url( 'media-new.php' ) ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'file' ); ?></a> <?php } diff --git a/src/wp-admin/users.php b/src/wp-admin/users.php index b0427874f0..133015be3b 100644 --- a/src/wp-admin/users.php +++ b/src/wp-admin/users.php @@ -617,9 +617,9 @@ switch ( $wp_list_table->current_action() ) { <?php if ( current_user_can( 'create_users' ) ) { ?> - <a href="<?php echo admin_url( 'user-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'user' ); ?></a> + <a href="<?php echo esc_url( admin_url( 'user-new.php' ) ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'user' ); ?></a> <?php } elseif ( is_multisite() && current_user_can( 'promote_users' ) ) { ?> - <a href="<?php echo admin_url( 'user-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add Existing', 'user' ); ?></a> + <a href="<?php echo esc_url( admin_url( 'user-new.php' ) ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add Existing', 'user' ); ?></a> <?php } diff --git a/src/wp-includes/class-wp-embed.php b/src/wp-includes/class-wp-embed.php index 4b189f9334..1fa37be41b 100644 --- a/src/wp-includes/class-wp-embed.php +++ b/src/wp-includes/class-wp-embed.php @@ -86,11 +86,10 @@ class WP_Embed { if ( ! $post || empty( $_GET['message'] ) ) { return; } - ?> <script type="text/javascript"> jQuery(document).ready(function($){ - $.get("<?php echo admin_url( 'admin-ajax.php?action=oembed-cache&post=' . $post->ID, 'relative' ); ?>"); + $.get("<?php echo esc_url( admin_url( 'admin-ajax.php', 'relative' ) ) . '?action=oembed-cache&post=' . $post->ID; ?>"); }); </script> <?php