From 11f0a387cd864ec8506db46931b0361c442a4941 Mon Sep 17 00:00:00 2001
From: westi <westi@1a063a9b-81f0-0310-95a4-ce76da25c4cd>
Date: Wed, 26 May 2010 17:47:29 +0000
Subject: [PATCH] Some more url escaping in feeds. See #13555.

git-svn-id: http://svn.automattic.com/wordpress/trunk@14950 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/feed-atom-comments.php |  2 +-
 wp-includes/feed-rss2.php          |  4 ++--
 wp-includes/feed.php               | 12 +++++++++++-
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/wp-includes/feed-atom-comments.php b/wp-includes/feed-atom-comments.php
index ab3447d3fc..e4a39d80bd 100644
--- a/wp-includes/feed-atom-comments.php
+++ b/wp-includes/feed-atom-comments.php
@@ -27,7 +27,7 @@ echo '<?xml version="1.0" encoding="' . get_option('blog_charset') . '" ?' . '>'
 	<updated><?php echo mysql2date('Y-m-d\TH:i:s\Z', get_lastcommentmodified('GMT'), false); ?></updated>
 
 <?php if ( is_singular() ) { ?>
-	<link rel="alternate" type="<?php bloginfo_rss('html_type'); ?>" href="<?php echo get_comments_link(); ?>" />
+	<link rel="alternate" type="<?php bloginfo_rss('html_type'); ?>" href="<?php comments_link_feed(); ?>" />
 	<link rel="self" type="application/atom+xml" href="<?php echo get_post_comments_feed_link('', 'atom'); ?>" />
 	<id><?php echo get_post_comments_feed_link('', 'atom'); ?></id>
 <?php } elseif(is_search()) { ?>
diff --git a/wp-includes/feed-rss2.php b/wp-includes/feed-rss2.php
index e97ddd5b98..538f96b727 100644
--- a/wp-includes/feed-rss2.php
+++ b/wp-includes/feed-rss2.php
@@ -34,7 +34,7 @@ echo '<?xml version="1.0" encoding="'.get_option('blog_charset').'"?'.'>'; ?>
 	<item>
 		<title><?php the_title_rss() ?></title>
 		<link><?php the_permalink_rss() ?></link>
-		<comments><?php comments_link(); ?></comments>
+		<comments><?php comments_link_feed(); ?></comments>
 		<pubDate><?php echo mysql2date('D, d M Y H:i:s +0000', get_post_time('Y-m-d H:i:s', true), false); ?></pubDate>
 		<dc:creator><?php the_author() ?></dc:creator>
 		<?php the_category_rss() ?>
@@ -50,7 +50,7 @@ echo '<?xml version="1.0" encoding="'.get_option('blog_charset').'"?'.'>'; ?>
 		<content:encoded><![CDATA[<?php the_excerpt_rss() ?>]]></content:encoded>
 	<?php endif; ?>
 <?php endif; ?>
-		<wfw:commentRss><?php echo get_post_comments_feed_link(null, 'rss2'); ?></wfw:commentRss>
+		<wfw:commentRss><?php echo esc_url( get_post_comments_feed_link(null, 'rss2') ); ?></wfw:commentRss>
 		<slash:comments><?php echo get_comments_number(); ?></slash:comments>
 <?php rss_enclosure(); ?>
 	<?php do_action('rss2_item'); ?>
diff --git a/wp-includes/feed.php b/wp-includes/feed.php
index 7bc0247033..7323b4a9f7 100644
--- a/wp-includes/feed.php
+++ b/wp-includes/feed.php
@@ -186,7 +186,17 @@ function the_excerpt_rss() {
  * @uses apply_filters() Call 'the_permalink_rss' on the post permalink
  */
 function the_permalink_rss() {
-	echo apply_filters('the_permalink_rss', get_permalink());
+	echo esc_url( apply_filters('the_permalink_rss', get_permalink() ));
+}
+
+/**
+ * Outputs the link to the comments for the current post in an xml safe way
+ * 
+ * @since 3.0.0
+ * @return none
+ */
+function comments_link_feed() {
+	echo esc_url( get_comments_link() );
 }
 
 /**