Escape url photon urls

Automattic · Apr 25, 2019 · a5aac20 · a5aac20
1 parent f0ec80b
commit a5aac20
Showing 1 changed file with 14 additions and 10 deletions.
diff --git a/extensions/blocks/tiled-gallery/tiled-gallery.php b/extensions/blocks/tiled-gallery/tiled-gallery.php
@@ -77,11 +77,13 @@ public static function render( $attr, $content ) {
 						$max_width = min( self::IMG_SRCSET_WIDTH_MAX, $orig_width, $orig_height );
 
 						for ( $w = $min_width; $w <= $max_width; $w = min( $max_width, $w + self::IMG_SRCSET_WIDTH_STEP ) ) {
-							$photonized_src = jetpack_photon_url(
-								$orig_src,
-								array(
-									'resize' => $w . ',' . $w,
-									'strip'  => 'all',
+							$photonized_src = esc_url(
+								jetpack_photon_url(
+									$orig_src,
+									array(
+										'resize' => $w . ',' . $w,
+										'strip'  => 'all',
+									)
 								)
 							);
 							$srcset_parts[] = $photonized_src . ' ' . $w . 'w';
@@ -94,11 +96,13 @@ public static function render( $attr, $content ) {
 						$max_width = min( self::IMG_SRCSET_WIDTH_MAX, $orig_width );
 
 						for ( $w = $min_width; $w <= $max_width; $w = min( $max_width, $w + self::IMG_SRCSET_WIDTH_STEP ) ) {
-							$photonized_src = jetpack_photon_url(
-								$orig_src,
-								array(
-									'strip' => 'all',
-									'w'     => $w,
+							$photonized_src = esc_url(
+								jetpack_photon_url(
+									$orig_src,
+									array(
+										'strip' => 'all',
+										'w'     => $w,
+									)
 								)
 							);
 							$srcset_parts[] = $photonized_src . ' ' . $w . 'w';