From ba5324e2bd5dd0cd301ce777d0f6fd4e9024a2e8 Mon Sep 17 00:00:00 2001
From: audrasjb <audrasjb@git.wordpress.org>
Date: Sat, 4 Feb 2023 07:10:18 +0000
Subject: [PATCH] Media: Properly escape Download row action link in Media List
 Table.

Props joedolson, pbiron, audrasjb.
Fixes #57574.

Built from https://develop.svn.wordpress.org/trunk@55221


git-svn-id: http://core.svn.wordpress.org/trunk@54754 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/includes/class-wp-media-list-table.php | 2 +-
 wp-includes/version.php                         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/wp-admin/includes/class-wp-media-list-table.php b/wp-admin/includes/class-wp-media-list-table.php
index 1943a5966f..9b17bd95bd 100644
--- a/wp-admin/includes/class-wp-media-list-table.php
+++ b/wp-admin/includes/class-wp-media-list-table.php
@@ -852,7 +852,7 @@ class WP_Media_List_Table extends WP_List_Table {
 
 				$actions['download'] = sprintf(
 					'<a href="%s" aria-label="%s" download>%s</a>',
-					wp_get_attachment_url( $post->ID ),
+					esc_url( wp_get_attachment_url( $post->ID ) ),
 					/* translators: %s: Attachment title. */
 					esc_attr( sprintf( __( 'Download &#8220;%s&#8221;' ), $att_title ) ),
 					__( 'Download file' )
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 6019736e92..75c0fc0155 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.2-alpha-55220';
+$wp_version = '6.2-alpha-55221';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.