From e09e8f465cceb0588b9b733d7e6868478359d33b Mon Sep 17 00:00:00 2001
From: azaozz <azaozz@1a063a9b-81f0-0310-95a4-ce76da25c4cd>
Date: Mon, 14 Nov 2011 19:35:32 +0000
Subject: [PATCH] Filter the link href when inserting external image in the
 editor, props DrewAPicture, fixes #18445

git-svn-id: http://svn.automattic.com/wordpress/trunk@19275 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/includes/media.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/wp-admin/includes/media.php b/wp-admin/includes/media.php
index fdf91f28be..7c7adb19ff 100644
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -1497,8 +1497,10 @@ var addExtImage = {
 
 		html = '<img alt="'+alt+'" src="'+f.src.value+'"'+title+cls+' width="'+t.width+'" height="'+t.height+'" />';
 
-		if ( f.url.value )
-			html = '<a href="'+f.url.value+'">'+html+'</a>';
+		if ( f.url.value ) {
+			url = f.url.value.replace(/'/g, '&#039;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+			html = '<a href="'+url+'">'+html+'</a>';
+		}
 
 		if ( caption )
 			html = '[caption id="" align="'+t.align+'" width="'+t.width+'" caption="'+caption+'"]'+html+'[/caption]';