[wp-trac] [WordPress Trac] #24907: Escape admin_url() when used for ajax_url in admin header

[WordPress Trac]

#24907: Escape admin_url() when used for ajax_url in admin header
--------------------------+-----------------------------
 Reporter:  jeremyfelt    |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Security      |    Version:  2.7
 Severity:  normal        |   Keywords:  has-patch
--------------------------+-----------------------------
 As `admin_url()` is filtered right before returning, it should be escaped
 when output for use as the ajax_url in the admin.

--
Ticket URL: <http://core.trac.wordpress.org/ticket/24907>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software