Escape URL's

scribu · May 8, 2015 · d6c85e1 · d6c85e1
1 parent a06242d
commit d6c85e1
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/PostMetabox.php b/PostMetabox.php
@@ -292,7 +292,8 @@ protected function save( $post_id ) {
 			);
 			update_post_meta( $post_id, '_error_data_' . $this->id, $error_data );
 
-			$location = add_query_arg( 'message', 1, esc_url_raw( get_edit_post_link( $post_id, 'url' ) ) );
+			$location = esc_url_raw( add_query_arg( 'message', 1, esc_url_raw( get_edit_post_link( $post_id, 'url' ) ) ) );
+
 			wp_redirect( apply_filters( 'redirect_post_location', $location, $post_id ) );
 			exit;
 		}

diff --git a/Util.php b/Util.php
@@ -425,7 +425,7 @@ function html_link( $url, $title = '' ) {
 		$title = $url;
 	}
 
-	return html( 'a', array( 'href' => $url ), $title );
+	return html( 'a', array( 'href' => esc_url( $url ) ), $title );
 }
 endif;