From e0324559140383df928e4a973ec74a8505ceb79d Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov.ru@gmail.com>
Date: Sun, 16 Mar 2025 20:47:29 +0000
Subject: [PATCH] Coding Standards: Escape thumbnail URL and attributes in
 `wp_image_editor()`.

Follow-up to [11965].

Props benazeer, dhruvang21, sabernhardt.
Fixes #62951.
Built from https://develop.svn.wordpress.org/trunk@59990


git-svn-id: http://core.svn.wordpress.org/trunk@59332 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/includes/image-edit.php | 6 +++---
 wp-includes/version.php          | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/wp-admin/includes/image-edit.php b/wp-admin/includes/image-edit.php
index 7f9ebf7f9f..d0a3abdc15 100644
--- a/wp-admin/includes/image-edit.php
+++ b/wp-admin/includes/image-edit.php
@@ -293,7 +293,7 @@ function wp_image_editor( $post_id, $msg = false ) {
 		</div>
 		<div class="imgedit-thumbnail-preview-group">
 			<figure class="imgedit-thumbnail-preview">
-				<img src="<?php echo $thumb['url']; ?>" width="<?php echo $thumb_img[0]; ?>" height="<?php echo $thumb_img[1]; ?>" class="imgedit-size-preview" alt="" draggable="false" />
+				<img src="<?php echo esc_url( $thumb['url'] ); ?>" width="<?php echo esc_attr( $thumb_img[0] ); ?>" height="<?php echo esc_attr( $thumb_img[1] ); ?>" class="imgedit-size-preview" alt="" draggable="false" />
 				<figcaption class="imgedit-thumbnail-preview-caption"><?php _e( 'Current thumbnail' ); ?></figcaption>
 			</figure>
 			<div id="imgedit-save-target-<?php echo $post_id; ?>" class="imgedit-save-target">
@@ -534,8 +534,8 @@ function _image_get_preview_ratio( $w, $h ) {
  * @see WP_Image_Editor::rotate()
  *
  * @ignore
- * @param resource|GdImage  $img   Image resource.
- * @param float|int         $angle Image rotation angle, in degrees.
+ * @param resource|GdImage $img   Image resource.
+ * @param float|int        $angle Image rotation angle, in degrees.
  * @return resource|GdImage|false GD image resource or GdImage instance, false otherwise.
  */
 function _rotate_image_resource( $img, $angle ) {
diff --git a/wp-includes/version.php b/wp-includes/version.php
index bba4ea56af..d4d046b943 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.8-beta2-59989';
+$wp_version = '6.8-beta2-59990';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.