From 21b8312b48cf88f14298015c34f51a5fc8531a84 Mon Sep 17 00:00:00 2001
From: audrasjb <audrasjb@git.wordpress.org>
Date: Mon, 27 May 2024 14:31:13 +0000
Subject: [PATCH] Upload: Add missing escaping functions in
 `wp-admin/async-upload.php`.

Props nareshbheda, mukesh27.
Fixes #60978.



Built from https://develop.svn.wordpress.org/trunk@58210


git-svn-id: http://core.svn.wordpress.org/trunk@57673 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/async-upload.php | 4 ++--
 wp-includes/version.php   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/wp-admin/async-upload.php b/wp-admin/async-upload.php
index 864f2be654..d32111bfe2 100644
--- a/wp-admin/async-upload.php
+++ b/wp-admin/async-upload.php
@@ -64,12 +64,12 @@ if ( isset( $_REQUEST['attachment_id'] ) && (int) $_REQUEST['attachment_id'] &&
 					?>
 					<div class="filename new">
 						<span class="media-list-title"><strong><?php echo esc_html( wp_html_excerpt( $title, 60, '&hellip;' ) ); ?></strong></span>
-						<span class="media-list-subtitle"><?php echo wp_basename( $file ); ?></span>
+						<span class="media-list-subtitle"><?php echo esc_html( wp_basename( $file ) ); ?></span>
 					</div>
 				</div>
 				<div class="attachment-tools">
 					<span class="media-item-copy-container copy-to-clipboard-container edit-attachment">
-						<button type="button" class="button button-small copy-attachment-url" data-clipboard-text="<?php echo $file_url; ?>"><?php _e( 'Copy URL to clipboard' ); ?></button>
+						<button type="button" class="button button-small copy-attachment-url" data-clipboard-text="<?php echo esc_url( $file_url ); ?>"><?php _e( 'Copy URL to clipboard' ); ?></button>
 						<span class="success hidden" aria-hidden="true"><?php _e( 'Copied!' ); ?></span>
 					</span>
 					<?php
diff --git a/wp-includes/version.php b/wp-includes/version.php
index fefe6701f4..83b79a4784 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.6-alpha-58209';
+$wp_version = '6.6-alpha-58210';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.