From 518b19a4043c370f88eaf8a278b777d50e2b148d Mon Sep 17 00:00:00 2001
From: nacin <nacin@1a063a9b-81f0-0310-95a4-ce76da25c4cd>
Date: Fri, 14 May 2010 15:03:59 +0000
Subject: [PATCH] esc_url the URL from get_upload_iframe_src. props jshreve,
 see #13383.

git-svn-id: http://svn.automattic.com/wordpress/trunk@14633 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/includes/media.php | 2 +-
 wp-admin/includes/post.php  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/wp-admin/includes/media.php b/wp-admin/includes/media.php
index a1609e9165..ee3d09990b 100644
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -379,7 +379,7 @@ function media_buttons() {
 add_action( 'media_buttons', 'media_buttons' );
 
 function _media_button($title, $icon, $type) {
-	return "<a href='" . get_upload_iframe_src($type) . "' id='add_$type' class='thickbox' title='$title'><img src='" . esc_url( admin_url( $icon ) ) . "' alt='$title' /></a>";
+	return "<a href='" . esc_url( get_upload_iframe_src($type) ) . "' id='add_$type' class='thickbox' title='$title'><img src='" . esc_url( admin_url( $icon ) ) . "' alt='$title' /></a>";
 }
 
 function get_upload_iframe_src($type) {
diff --git a/wp-admin/includes/post.php b/wp-admin/includes/post.php
index e178397644..ae12f44404 100644
--- a/wp-admin/includes/post.php
+++ b/wp-admin/includes/post.php
@@ -1143,7 +1143,7 @@ function get_sample_permalink_html( $id, $new_title = null, $new_slug = null ) {
 function _wp_post_thumbnail_html( $thumbnail_id = NULL ) {
 	global $content_width, $_wp_additional_image_sizes;
 
-	$set_thumbnail_link = '<p class="hide-if-no-js"><a title="' . esc_attr__( 'Set featured image' ) . '" href="' . get_upload_iframe_src('image') . '" id="set-post-thumbnail" class="thickbox">%s</a></p>';
+	$set_thumbnail_link = '<p class="hide-if-no-js"><a title="' . esc_attr__( 'Set featured image' ) . '" href="' . esc_url( get_upload_iframe_src('image') ) . '" id="set-post-thumbnail" class="thickbox">%s</a></p>';
 	$content = sprintf($set_thumbnail_link, esc_html__( 'Set featured image' ));
 
 	if ( $thumbnail_id && get_post( $thumbnail_id ) ) {