From 6a163e199a236a6ddff18ceefc3931ee8b25a310 Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov.ru@gmail.com>
Date: Thu, 17 Jun 2021 14:37:00 +0000
Subject: [PATCH] Administration: Consistently escape `admin_url()` links.

Props chintan1896, mukesh27.
Fixes #53426.
Built from https://develop.svn.wordpress.org/trunk@51177


git-svn-id: http://core.svn.wordpress.org/trunk@50786 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/about.php               | 6 +++---
 wp-admin/comment.php             | 4 ++--
 wp-admin/credits.php             | 2 +-
 wp-admin/edit-tag-form.php       | 2 +-
 wp-admin/freedoms.php            | 2 +-
 wp-admin/includes/dashboard.php  | 2 +-
 wp-admin/includes/image-edit.php | 3 ++-
 wp-admin/media-new.php           | 2 +-
 wp-admin/nav-menus.php           | 4 ++--
 wp-admin/privacy.php             | 2 +-
 wp-admin/themes.php              | 2 +-
 wp-admin/upload.php              | 4 ++--
 wp-admin/users.php               | 4 ++--
 wp-includes/class-wp-embed.php   | 3 +--
 wp-includes/version.php          | 2 +-
 15 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/wp-admin/about.php b/wp-admin/about.php
index 9eaf4fdc88..1cd366020b 100644
--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -23,7 +23,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
 
 		<div class="about__header">
 			<div class="about__header-image">
-				<img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo admin_url( 'images/about-badge.svg' ); ?>" />
+				<img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo esc_url( admin_url( 'images/about-badge.svg' ) ); ?>" />
 			</div>
 
 			<div class="about__header-title">
@@ -179,8 +179,8 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
 		<div class="about__section has-subtle-background-color">
 			<div class="column about__image">
 				<picture>
-					<source media="(max-width: 600px)" srcset="<?php echo admin_url( 'images/about-color-palette-vert.svg' ); ?>" />
-					<img alt="" src="<?php echo admin_url( 'images/about-color-palette.svg' ); ?>" />
+					<source media="(max-width: 600px)" srcset="<?php echo esc_url( admin_url( 'images/about-color-palette-vert.svg' ) ); ?>" />
+					<img alt="" src="<?php echo esc_url( admin_url( 'images/about-color-palette.svg' ) ); ?>" />
 				</picture>
 			</div>
 		</div>
diff --git a/wp-admin/comment.php b/wp-admin/comment.php
index ad11f3e05b..a08e130525 100644
--- a/wp-admin/comment.php
+++ b/wp-admin/comment.php
@@ -232,7 +232,7 @@ switch ( $action ) {
 	<th scope="row"><?php /* translators: Field name in comment form. */ _ex( 'Comment', 'noun' ); ?></th>
 	<td class="comment-content">
 		<?php comment_text( $comment ); ?>
-	<p class="edit-comment"><a href="<?php echo admin_url( "comment.php?action=editcomment&amp;c={$comment->comment_ID}" ); ?>"><?php esc_html_e( 'Edit' ); ?></a></p>
+	<p class="edit-comment"><a href="<?php echo esc_url( admin_url( "comment.php?action=editcomment&c={$comment->comment_ID}" ) ); ?>"><?php esc_html_e( 'Edit' ); ?></a></p>
 	</td>
 	</tr>
 	</table>
@@ -241,7 +241,7 @@ switch ( $action ) {
 
 	<p>
 		<?php submit_button( $button, 'primary', 'submit', false ); ?>
-	<a href="<?php echo admin_url( 'edit-comments.php' ); ?>" class="button-cancel"><?php esc_html_e( 'Cancel' ); ?></a>
+	<a href="<?php echo esc_url( admin_url( 'edit-comments.php' ) ); ?>" class="button-cancel"><?php esc_html_e( 'Cancel' ); ?></a>
 	</p>
 
 		<?php wp_nonce_field( $nonce_action ); ?>
diff --git a/wp-admin/credits.php b/wp-admin/credits.php
index e08684331d..639113483f 100644
--- a/wp-admin/credits.php
+++ b/wp-admin/credits.php
@@ -22,7 +22,7 @@ $credits = wp_credits();
 
 	<div class="about__header">
 		<div class="about__header-image">
-			<img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo admin_url( 'images/about-badge.svg' ); ?>" />
+			<img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo esc_url( admin_url( 'images/about-badge.svg' ) ); ?>" />
 		</div>
 
 		<div class="about__header-container">
diff --git a/wp-admin/edit-tag-form.php b/wp-admin/edit-tag-form.php
index cb2249e2b0..3752b8f52c 100644
--- a/wp-admin/edit-tag-form.php
+++ b/wp-admin/edit-tag-form.php
@@ -300,7 +300,7 @@ do_action( "{$taxonomy}_edit_form", $tag, $taxonomy );
 
 	<?php if ( current_user_can( 'delete_term', $tag->term_id ) ) : ?>
 		<span id="delete-link">
-			<a class="delete" href="<?php echo admin_url( wp_nonce_url( "edit-tags.php?action=delete&taxonomy=$taxonomy&tag_ID=$tag->term_id", 'delete-tag_' . $tag->term_id ) ); ?>"><?php _e( 'Delete' ); ?></a>
+			<a class="delete" href="<?php echo esc_url( admin_url( wp_nonce_url( "edit-tags.php?action=delete&taxonomy=$taxonomy&tag_ID=$tag->term_id", 'delete-tag_' . $tag->term_id ) ) ); ?>"><?php _e( 'Delete' ); ?></a>
 		</span>
 	<?php endif; ?>
 
diff --git a/wp-admin/freedoms.php b/wp-admin/freedoms.php
index 21ca2e500a..dae9cc1b55 100644
--- a/wp-admin/freedoms.php
+++ b/wp-admin/freedoms.php
@@ -25,7 +25,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
 
 	<div class="about__header">
 		<div class="about__header-image">
-			<img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo admin_url( 'images/about-badge.svg' ); ?>" />
+			<img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo esc_url( admin_url( 'images/about-badge.svg' ) ); ?>" />
 		</div>
 
 		<div class="about__header-container">
diff --git a/wp-admin/includes/dashboard.php b/wp-admin/includes/dashboard.php
index 178e45b2a1..4ba4b9edde 100644
--- a/wp-admin/includes/dashboard.php
+++ b/wp-admin/includes/dashboard.php
@@ -1996,7 +1996,7 @@ function wp_welcome_panel() {
 			<h3><?php _e( 'Get Started' ); ?></h3>
 			<a class="button button-primary button-hero load-customize hide-if-no-customize" href="<?php echo wp_customize_url(); ?>"><?php _e( 'Customize Your Site' ); ?></a>
 		<?php endif; ?>
-		<a class="button button-primary button-hero hide-if-customize" href="<?php echo admin_url( 'themes.php' ); ?>"><?php _e( 'Customize Your Site' ); ?></a>
+		<a class="button button-primary button-hero hide-if-customize" href="<?php echo esc_url( admin_url( 'themes.php' ) ); ?>"><?php _e( 'Customize Your Site' ); ?></a>
 		<?php if ( current_user_can( 'install_themes' ) || ( current_user_can( 'switch_themes' ) && count( wp_get_themes( array( 'allowed' => true ) ) ) > 1 ) ) : ?>
 			<?php $themes_link = current_user_can( 'customize' ) ? add_query_arg( 'autofocus[panel]', 'themes', admin_url( 'customize.php' ) ) : admin_url( 'themes.php' ); ?>
 			<p class="hide-if-no-customize">
diff --git a/wp-admin/includes/image-edit.php b/wp-admin/includes/image-edit.php
index 52b403d180..95da5af3d5 100644
--- a/wp-admin/includes/image-edit.php
+++ b/wp-admin/includes/image-edit.php
@@ -90,7 +90,8 @@ function wp_image_editor( $post_id, $msg = false ) {
 		<input type="hidden" id="imgedit-y-<?php echo $post_id; ?>" value="<?php echo isset( $meta['height'] ) ? $meta['height'] : 0; ?>" />
 
 		<div id="imgedit-crop-<?php echo $post_id; ?>" class="imgedit-crop-wrap">
-		<img id="image-preview-<?php echo $post_id; ?>" onload="imageEdit.imgLoaded('<?php echo $post_id; ?>')" src="<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>?action=imgedit-preview&amp;_ajax_nonce=<?php echo $nonce; ?>&amp;postid=<?php echo $post_id; ?>&amp;rand=<?php echo rand( 1, 99999 ); ?>" alt="" />
+		<img id="image-preview-<?php echo $post_id; ?>" onload="imageEdit.imgLoaded('<?php echo $post_id; ?>')"
+			src="<?php echo esc_url( admin_url( 'admin-ajax.php', 'relative' ) ) . '?action=imgedit-preview&amp;_ajax_nonce=' . $nonce . '&amp;postid=' . $post_id . '&amp;rand=' . rand( 1, 99999 ); ?>" alt="" />
 		</div>
 
 		<div class="imgedit-submit">
diff --git a/wp-admin/media-new.php b/wp-admin/media-new.php
index a4df447ceb..97426512a4 100644
--- a/wp-admin/media-new.php
+++ b/wp-admin/media-new.php
@@ -72,7 +72,7 @@ if ( get_user_setting( 'uploader' ) || isset( $_GET['browser-uploader'] ) ) {
 <div class="wrap">
 	<h1><?php echo esc_html( $title ); ?></h1>
 
-	<form enctype="multipart/form-data" method="post" action="<?php echo admin_url( 'media-new.php' ); ?>" class="<?php echo esc_attr( $form_class ); ?>" id="file-form">
+	<form enctype="multipart/form-data" method="post" action="<?php echo esc_url( admin_url( 'media-new.php' ) ); ?>" class="<?php echo esc_attr( $form_class ); ?>" id="file-form">
 
 	<?php media_upload_form(); ?>
 
diff --git a/wp-admin/nav-menus.php b/wp-admin/nav-menus.php
index c9683ae299..950499fde1 100644
--- a/wp-admin/nav-menus.php
+++ b/wp-admin/nav-menus.php
@@ -689,7 +689,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
 	<hr class="wp-header-end">
 
 	<nav class="nav-tab-wrapper wp-clearfix" aria-label="<?php esc_attr_e( 'Secondary menu' ); ?>">
-		<a href="<?php echo admin_url( 'nav-menus.php' ); ?>" class="nav-tab<?php echo $nav_tab_active_class; ?>"<?php echo $nav_aria_current; ?>><?php esc_html_e( 'Edit Menus' ); ?></a>
+		<a href="<?php echo esc_url( admin_url( 'nav-menus.php' ) ); ?>" class="nav-tab<?php echo $nav_tab_active_class; ?>"<?php echo $nav_aria_current; ?>><?php esc_html_e( 'Edit Menus' ); ?></a>
 		<?php
 		if ( $num_locations && $menu_count ) {
 			$active_tab_class = '';
@@ -840,7 +840,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
 			<span class="screen-reader-text"><?php _e( 'Click the Save Menu button to save your changes.' ); ?></span>
 		</span><!-- /add-edit-menu-action -->
 		<?php else : ?>
-			<form method="get" action="<?php echo admin_url( 'nav-menus.php' ); ?>">
+			<form method="get" action="<?php echo esc_url( admin_url( 'nav-menus.php' ) ); ?>">
 			<input type="hidden" name="action" value="edit" />
 			<label for="select-menu-to-edit" class="selected-menu"><?php _e( 'Select a menu to edit:' ); ?></label>
 			<select name="menu" id="select-menu-to-edit">
diff --git a/wp-admin/privacy.php b/wp-admin/privacy.php
index c8b6ab5905..57ea379021 100644
--- a/wp-admin/privacy.php
+++ b/wp-admin/privacy.php
@@ -19,7 +19,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
 
 	<div class="about__header">
 		<div class="about__header-image">
-			<img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo admin_url( 'images/about-badge.svg' ); ?>" />
+			<img alt="<?php _e( 'Code is Poetry' ); ?>" src="<?php echo esc_url( admin_url( 'images/about-badge.svg' ) ); ?>" />
 		</div>
 
 		<div class="about__header-container">
diff --git a/wp-admin/themes.php b/wp-admin/themes.php
index f671d54e22..2a230ee504 100644
--- a/wp-admin/themes.php
+++ b/wp-admin/themes.php
@@ -250,7 +250,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
 	</h1>
 
 	<?php if ( ! is_multisite() && current_user_can( 'install_themes' ) ) : ?>
-		<a href="<?php echo admin_url( 'theme-install.php' ); ?>" class="hide-if-no-js page-title-action"><?php echo esc_html_x( 'Add New', 'theme' ); ?></a>
+		<a href="<?php echo esc_url( admin_url( 'theme-install.php' ) ); ?>" class="hide-if-no-js page-title-action"><?php echo esc_html_x( 'Add New', 'theme' ); ?></a>
 	<?php endif; ?>
 
 	<form class="search-form"></form>
diff --git a/wp-admin/upload.php b/wp-admin/upload.php
index 8ea6e1c6d6..81fe4fd16b 100644
--- a/wp-admin/upload.php
+++ b/wp-admin/upload.php
@@ -87,7 +87,7 @@ if ( 'grid' === $mode ) {
 		<?php
 		if ( current_user_can( 'upload_files' ) ) {
 			?>
-			<a href="<?php echo admin_url( 'media-new.php' ); ?>" class="page-title-action aria-button-if-js"><?php echo esc_html_x( 'Add New', 'file' ); ?></a>
+			<a href="<?php echo esc_url( admin_url( 'media-new.php' ) ); ?>" class="page-title-action aria-button-if-js"><?php echo esc_html_x( 'Add New', 'file' ); ?></a>
 								<?php
 		}
 		?>
@@ -272,7 +272,7 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
 <?php
 if ( current_user_can( 'upload_files' ) ) {
 	?>
-	<a href="<?php echo admin_url( 'media-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'file' ); ?></a>
+	<a href="<?php echo esc_url( admin_url( 'media-new.php' ) ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'file' ); ?></a>
 						<?php
 }
 
diff --git a/wp-admin/users.php b/wp-admin/users.php
index b0427874f0..133015be3b 100644
--- a/wp-admin/users.php
+++ b/wp-admin/users.php
@@ -617,9 +617,9 @@ switch ( $wp_list_table->current_action() ) {
 		<?php
 		if ( current_user_can( 'create_users' ) ) {
 			?>
-	<a href="<?php echo admin_url( 'user-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'user' ); ?></a>
+	<a href="<?php echo esc_url( admin_url( 'user-new.php' ) ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'user' ); ?></a>
 <?php } elseif ( is_multisite() && current_user_can( 'promote_users' ) ) { ?>
-	<a href="<?php echo admin_url( 'user-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add Existing', 'user' ); ?></a>
+	<a href="<?php echo esc_url( admin_url( 'user-new.php' ) ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add Existing', 'user' ); ?></a>
 			<?php
 }
 
diff --git a/wp-includes/class-wp-embed.php b/wp-includes/class-wp-embed.php
index 4b189f9334..1fa37be41b 100644
--- a/wp-includes/class-wp-embed.php
+++ b/wp-includes/class-wp-embed.php
@@ -86,11 +86,10 @@ class WP_Embed {
 		if ( ! $post || empty( $_GET['message'] ) ) {
 			return;
 		}
-
 		?>
 <script type="text/javascript">
 	jQuery(document).ready(function($){
-		$.get("<?php echo admin_url( 'admin-ajax.php?action=oembed-cache&post=' . $post->ID, 'relative' ); ?>");
+		$.get("<?php echo esc_url( admin_url( 'admin-ajax.php', 'relative' ) ) . '?action=oembed-cache&post=' . $post->ID; ?>");
 	});
 </script>
 		<?php
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 84e4fbcddc..c0a14e79d8 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -13,7 +13,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.8-beta2-51176';
+$wp_version = '5.8-beta2-51177';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.