Merge pull request #40 from quassy/patch-1

This should fix #39
radgeek · Apr 26, 2015 · acd9749 · acd9749
2 parents fd75606 + 8ad4dee
commit acd9749
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/feedwordpress.php b/feedwordpress.php
@@ -1284,7 +1284,7 @@ static function admin_init () {
 					$sendback .= ( ! empty( $post_type ) ) ? '?post_type=' . $post_type : '';
 				endif;
 			else :
-				$sendback = remove_query_arg( array('trashed', 'untrashed', 'deleted', 'zapped', 'unzapped', 'ids'), $sendback );
+				$sendback = esc_url( remove_query_arg( array('trashed', 'untrashed', 'deleted', 'zapped', 'unzapped', 'ids'), $sendback ) );
 			endif;
 
 			// Make sure we have a post corresponding to this ID.
@@ -1324,7 +1324,7 @@ static function admin_init () {
 				add_post_meta($post_id, '_feedwordpress_zapped_blank_me', 1, /*unique=*/ true);
 				add_post_meta($post_id, '_feedwordpress_zapped_blank_old_status', $old_status, /*unique=*/ true);
 
-				wp_redirect( add_query_arg( array('zapped' => 1, 'ids' => $post_id), $sendback ) );
+				wp_redirect( esc_url_raw( add_query_arg( array('zapped' => 1, 'ids' => $post_id), $sendback ) ) );
 
 			else :
 				$old_status = get_post_meta($post_id, '_feedwordpress_zapped_blank_old_status', /*single=*/ true);
@@ -1336,7 +1336,7 @@ static function admin_init () {
 				delete_post_meta($post_id, '_feedwordpress_zapped_blank_me');
 				delete_post_meta($post_id, '_feedwordpress_zapped_blank_old_status');
 
-				wp_redirect( add_query_arg( array('unzapped' => 1, 'ids' => $post_id), $sendback ) );
+				wp_redirect( esc_url_raw( add_query_arg( array('unzapped' => 1, 'ids' => $post_id), $sendback ) ) );
 
 			endif;