Fix nonce double escaping

stellarwp · Nov 14, 2023 · f57fb87 · f57fb87
1 parent eef8106
commit f57fb87
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 5 deletions.
diff --git a/src/Uplink/Auth/Nonce.php b/src/Uplink/Auth/Nonce.php
@@ -62,14 +62,14 @@ public function create(): string {
 	/**
 	 * Attach a nonce to a URL.
 	 *
+	 * @note Unlike WordPress' function, you should escape this manually.
+	 *
 	 * @param  string  $url The existing URL to attach the nonce to.
 	 *
 	 * @return string
 	 */
 	public function create_url( string $url ): string {
-		$url = str_replace( '&amp;', '&', $url );
-
-		return esc_html( add_query_arg( '_uplink_nonce', $this->create(), $url ) );
+		return add_query_arg( '_uplink_nonce', $this->create(), $url );
 	}
 
 	/**

diff --git a/tests/wpunit/Auth/NonceTest.php b/tests/wpunit/Auth/NonceTest.php
@@ -54,8 +54,7 @@ public function test_it_creates_a_nonce_url(): void {
 	public function test_it_creates_a_nonce_url_with_extra_query_arguments(): void {
 		$url = 'http://wordpress.test/wp-admin/post.php?post=1&action=edit';
 
-		// URL is escaped, reverse that.
-		$nonce_url = html_entity_decode( $this->nonce->create_url( $url ) );
+		$nonce_url = $this->nonce->create_url( $url );
 
 		$this->assertStringStartsWith(
 			'http://wordpress.test/wp-admin/post.php?post=1&action=edit&_uplink_nonce=',