Media: Properly escape Download row action link in Media List Table.

Props joedolson, pbiron, audrasjb.
Fixes #57574.

Built from https://develop.svn.wordpress.org/trunk@55221


git-svn-id: http://core.svn.wordpress.org/trunk@54754 1a063a9b-81f0-0310-95a4-ce76da25c4cd

wp-admin/includes/class-wp-media-list-table.php

@@ -852,7 +852,7 @@ class WP_Media_List_Table extends WP_List_Table {
 
 				$actions['download'] = sprintf(
 					'<a href="%s" aria-label="%s" download>%s</a>',
-					wp_get_attachment_url( $post->ID ),
+					esc_url( wp_get_attachment_url( $post->ID ) ),
 					/* translators: %s: Attachment title. */
 					esc_attr( sprintf( __( 'Download &#8220;%s&#8221;' ), $att_title ) ),
 					__( 'Download file' )

wp-includes/version.php

@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.2-alpha-55220';
+$wp_version = '6.2-alpha-55221';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.