| @@ -77,9 +77,9 @@ | ||
| 77 | 77 | foreach ( $image_ids as $image_id ) { |
| 78 | 78 | $url = wp_get_attachment_url( esc_attr( $image_id ) ); |
| 79 | 79 | if ( false !== $url ) { |
| 80 | 80 | $image_src .= '' !== $image_src ? '<br/>' : ''; |
| 81 | - $image_src .= sprintf( '<img src="%s" width="100%%">', $url ); | |
| 81 | + $image_src .= sprintf( '<img src="%s" width="100%%">', esc_url_raw( $url ) ); | |
| 82 | 82 | } |
| 83 | 83 | } |
| 84 | 84 | |
| 85 | 85 | return $image_src; |
| @@ -104,9 +104,9 @@ | ||
| 104 | 104 | $mime_type = substr( $mime_type, $mime_ext + 1 ); |
| 105 | 105 | } |
| 106 | 106 | $title = get_the_title( esc_attr( $media_id ) ); |
| 107 | 107 | $media_links .= '' !== $media_links ? '<br/>' : ''; |
| 108 | - $media_links .= sprintf( '<span class="dashicons dashicons-external"></span><a href="%s" title="%s" class="wpda_tooltip" target="_blank">%s</a>', $url, $title, $mime_type ); | |
| 108 | + $media_links .= sprintf( '<span class="dashicons dashicons-external"></span><a href="%s" title="%s" class="wpda_tooltip" target="_blank">%s</a>', esc_url_raw( $url ), esc_attr( $title ), esc_html( $mime_type ) ); | |
| 109 | 109 | } |
| 110 | 110 | } |
| 111 | 111 | } |
| 112 | 112 | |
