TOTP: Escape spinner admin URL.

See #487 (comment)
WordPress · Nov 9, 2022 · 7961d39 · 7961d39
1 parent ac63e64
commit 7961d39
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/providers/class-two-factor-totp.php b/providers/class-two-factor-totp.php
@@ -178,7 +178,7 @@ public function user_two_factor_options( $user ) {
 			<p id="two-factor-qr-code">
 				<a href="<?php echo $totp_url; ?>">
 					Loading...
-					<img src="<?php echo admin_url('images/spinner.gif'); ?>" alt="" />
+					<img src="<?php echo esc_url( admin_url( 'images/spinner.gif' ) ); ?>" alt="" />
 				</a>
 			</p>