Users: Use `esc_url()` instead of `esc_attr()` to escape the value of the `srcset` attribute in `get_avatar()`.
Props joemcgill, henry.wright. Fixes #41215. Built from https://develop.svn.wordpress.org/trunk@41156 git-svn-id: http://core.svn.wordpress.org/trunk@40996 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
parent
a89f1e469b
commit
7d2b400876
|
@ -2535,7 +2535,7 @@ function get_avatar( $id_or_email, $size = 96, $default = '', $alt = '', $args =
|
|||
"<img alt='%s' src='%s' srcset='%s' class='%s' height='%d' width='%d' %s/>",
|
||||
esc_attr( $args['alt'] ),
|
||||
esc_url( $url ),
|
||||
esc_attr( "$url2x 2x" ),
|
||||
esc_url( $url2x ) . ' 2x',
|
||||
esc_attr( join( ' ', $class ) ),
|
||||
(int) $args['height'],
|
||||
(int) $args['width'],
|
||||
|
|
|
@ -4,7 +4,7 @@
|
|||
*
|
||||
* @global string $wp_version
|
||||
*/
|
||||
$wp_version = '4.9-alpha-41154';
|
||||
$wp_version = '4.9-alpha-41156';
|
||||
|
||||
/**
|
||||
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
|
||||
|
|
Loading…
Reference in New Issue