Always escape the URL echoed by header_image(). fixes #23664.

git-svn-id: http://core.svn.wordpress.org/trunk@23633 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-03-07 05:30:00 +00:00 · 2013-03-07 05:30:00 +00:00 · aa842e13b1
parent caf591b7aa
commit aa842e13b1
1 changed files with 2 additions and 2 deletions
--- a/wp-includes/theme.php
+++ b/wp-includes/theme.php
@ -981,12 +981,12 @@ function is_random_header_image( $type = 'any' ) {
 }

 /**
- * Display header image path.
+ * Display header image URL.
 *
 * @since 2.1.0
 */
 function header_image() {
-	echo get_header_image();
+	echo esc_url( get_header_image() );
 }

 /**