From c2ad4403de7a2626396b42c8140460dc70c89ed9 Mon Sep 17 00:00:00 2001
From: Andrew Nacin <nacin@git.wordpress.org>
Date: Wed, 7 Nov 2012 19:56:10 +0000
Subject: [PATCH] Don't return encoded ampersands from
 get_post_comments_feed_link() to avoid canonical redirect issues. Apply
 esc_url() when appropriate.

props markjaquith, SergeyBiryukov. fixes #21841.



git-svn-id: https://develop.svn.wordpress.org/trunk@22431 602fd350-edb4-49c9-b593-d223f7449a82
---
 wp-includes/deprecated.php                  | 2 +-
 wp-includes/feed-atom-comments.php          | 4 ++--
 wp-includes/feed-atom.php                   | 2 +-
 wp-includes/link-template.php               | 6 +++---
 wp-includes/theme-compat/comments-popup.php | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/wp-includes/deprecated.php b/wp-includes/deprecated.php
index a9744e89aa..abdd265e3a 100644
--- a/wp-includes/deprecated.php
+++ b/wp-includes/deprecated.php
@@ -1215,7 +1215,7 @@ function get_author_rss_link($echo = false, $author_id = 1) {
  */
 function comments_rss() {
 	_deprecated_function( __FUNCTION__, '2.2', 'get_post_comments_feed_link()' );
-	return get_post_comments_feed_link();
+	return esc_url( get_post_comments_feed_link() );
 }
 
 /**
diff --git a/wp-includes/feed-atom-comments.php b/wp-includes/feed-atom-comments.php
index 1577db7b11..174670379c 100644
--- a/wp-includes/feed-atom-comments.php
+++ b/wp-includes/feed-atom-comments.php
@@ -28,8 +28,8 @@ echo '<?xml version="1.0" encoding="' . get_option('blog_charset') . '" ?' . '>'
 
 <?php if ( is_singular() ) { ?>
 	<link rel="alternate" type="<?php bloginfo_rss('html_type'); ?>" href="<?php comments_link_feed(); ?>" />
-	<link rel="self" type="application/atom+xml" href="<?php echo get_post_comments_feed_link('', 'atom'); ?>" />
-	<id><?php echo get_post_comments_feed_link('', 'atom'); ?></id>
+	<link rel="self" type="application/atom+xml" href="<?php echo esc_url( get_post_comments_feed_link('', 'atom') ); ?>" />
+	<id><?php echo esc_url( get_post_comments_feed_link('', 'atom') ); ?></id>
 <?php } elseif(is_search()) { ?>
 	<link rel="alternate" type="<?php bloginfo_rss('html_type'); ?>" href="<?php echo home_url() . '?s=' . get_search_query(); ?>" />
 	<link rel="self" type="application/atom+xml" href="<?php echo get_search_comments_feed_link('', 'atom'); ?>" />
diff --git a/wp-includes/feed-atom.php b/wp-includes/feed-atom.php
index b79caefdae..983c8f4a3d 100644
--- a/wp-includes/feed-atom.php
+++ b/wp-includes/feed-atom.php
@@ -48,7 +48,7 @@ echo '<?xml version="1.0" encoding="'.get_option('blog_charset').'"?'.'>'; ?>
 <?php atom_enclosure(); ?>
 <?php do_action('atom_entry'); ?>
 		<link rel="replies" type="<?php bloginfo_rss('html_type'); ?>" href="<?php the_permalink_rss() ?>#comments" thr:count="<?php echo get_comments_number()?>"/>
-		<link rel="replies" type="application/atom+xml" href="<?php echo get_post_comments_feed_link(0,'atom') ?>" thr:count="<?php echo get_comments_number()?>"/>
+		<link rel="replies" type="application/atom+xml" href="<?php echo esc_url( get_post_comments_feed_link(0, 'atom') ); ?>" thr:count="<?php echo get_comments_number()?>"/>
 		<thr:total><?php echo get_comments_number()?></thr:total>
 	</entry>
 	<?php endwhile ; ?>
diff --git a/wp-includes/link-template.php b/wp-includes/link-template.php
index f80cfb66ff..10c43564da 100644
--- a/wp-includes/link-template.php
+++ b/wp-includes/link-template.php
@@ -484,9 +484,9 @@ function get_post_comments_feed_link($post_id = 0, $feed = '') {
 	} else {
 		$type = get_post_field('post_type', $post_id);
 		if ( 'page' == $type )
-			$url = home_url("?feed=$feed&amp;page_id=$post_id");
+			$url = add_query_arg( array( 'feed' => $feed, 'page_id' => $post_id ), home_url( '/' ) );
 		else
-			$url = home_url("?feed=$feed&amp;p=$post_id");
+			$url = add_query_arg( array( 'feed' => $feed, 'p' => $post_id ), home_url( '/' ) );
 	}
 
 	return apply_filters('post_comments_feed_link', $url);
@@ -509,7 +509,7 @@ function get_post_comments_feed_link($post_id = 0, $feed = '') {
  * @return string Link to the comment feed for the current post.
 */
 function post_comments_feed_link( $link_text = '', $post_id = '', $feed = '' ) {
-	$url = get_post_comments_feed_link($post_id, $feed);
+	$url = esc_url( get_post_comments_feed_link( $post_id, $feed ) );
 	if ( empty($link_text) )
 		$link_text = __('Comments Feed');
 
diff --git a/wp-includes/theme-compat/comments-popup.php b/wp-includes/theme-compat/comments-popup.php
index 79dccbef5b..eb74834cd3 100644
--- a/wp-includes/theme-compat/comments-popup.php
+++ b/wp-includes/theme-compat/comments-popup.php
@@ -32,7 +32,7 @@ while( have_posts()) : the_post();
 ?>
 <h2 id="comments"><?php _e('Comments'); ?></h2>
 
-<p><a href="<?php echo get_post_comments_feed_link($post->ID); ?>"><?php _e('<abbr title="Really Simple Syndication">RSS</abbr> feed for comments on this post.'); ?></a></p>
+<p><a href="<?php echo esc_url( get_post_comments_feed_link($post->ID) ); ?>"><?php _e('<abbr title="Really Simple Syndication">RSS</abbr> feed for comments on this post.'); ?></a></p>
 
 <?php if ( pings_open() ) { ?>
 <p><?php printf(__('The <abbr title="Universal Resource Locator">URL</abbr> to TrackBack this entry is: <em>%s</em>'), get_trackback_url()); ?></p>