From b66cc87ea4adb2decbd4e14c8986b4739d886470 Mon Sep 17 00:00:00 2001
From: Lance Willett <nanobar@gmail.com>
Date: Fri, 16 May 2014 22:31:15 +0000
Subject: [PATCH] Twenty Fourteen: correct escaping for parent post link and
 attachment link in image template. Props philiparthurmoore, see #28251. Built
 from https://develop.svn.wordpress.org/trunk@28462

git-svn-id: http://core.svn.wordpress.org/trunk@28289 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-content/themes/twentyfourteen/image.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/wp-content/themes/twentyfourteen/image.php b/wp-content/themes/twentyfourteen/image.php
index 98daaec1f3..4e7fb82ac2 100644
--- a/wp-content/themes/twentyfourteen/image.php
+++ b/wp-content/themes/twentyfourteen/image.php
@@ -28,9 +28,9 @@ get_header();
 
 						<span class="entry-date"><time class="entry-date" datetime="<?php echo esc_attr( get_the_date( 'c' ) ); ?>"><?php echo esc_html( get_the_date() ); ?></time></span>
 
-						<span class="full-size-link"><a href="<?php echo wp_get_attachment_url(); ?>"><?php echo $metadata['width']; ?> &times; <?php echo $metadata['height']; ?></a></span>
+						<span class="full-size-link"><a href="<?php echo esc_url( wp_get_attachment_url() ); ?>"><?php echo $metadata['width']; ?> &times; <?php echo $metadata['height']; ?></a></span>
 
-						<span class="parent-post-link"><a href="<?php echo get_permalink( $post->post_parent ); ?>" rel="gallery"><?php echo get_the_title( $post->post_parent ); ?></a></span>
+						<span class="parent-post-link"><a href="<?php echo esc_url( get_permalink( $post->post_parent ) ); ?>" rel="gallery"><?php echo get_the_title( $post->post_parent ); ?></a></span>
 						<?php edit_post_link( __( 'Edit', 'twentyfourteen' ), '<span class="edit-link">', '</span>' ); ?>
 					</div><!-- .entry-meta -->
 				</header><!-- .entry-header -->