Ticket #23098: 23098.diff

Index: wp-includes/link-template.php
===================================================================
--- wp-includes/link-template.php       (revision 23244)
+++ wp-includes/link-template.php       (working copy)
@@ -1865,6 +1865,22 @@
 }
 
 /**
+ * Append a path to a URL
+ *
+ * @package WordPress
+ * @since 3.6.0
+ *
+ * @param      string $url URL to append a path to
+ * @param      string $path (optional) Path relative to the home URL
+ * @return string URL with optional path appended
+ */
+function append_path( $url, $path = '' ) {
+       if ( ! empty( $path ) && is_string( $path ) && strpos( $path, '..' ) === false )
+               $url = $url . '/' . ltrim( $path, '/' );
+       return $url;
+}
+
+/**
  * Retrieve the home url for the current site.
  *
  * Returns the 'home' option with the appropriate protocol, 'https' if
@@ -1919,8 +1935,7 @@
 
        $url = set_url_scheme( $url, $scheme );
 
-       if ( ! empty( $path ) && is_string( $path ) && strpos( $path, '..' ) === false )
-               $url .= '/' . ltrim( $path, '/' );
+       $url = append_path( $url, $path );
 
        return apply_filters( 'home_url', $url, $path, $orig_scheme, $blog_id );
 }
@@ -1971,8 +1986,7 @@
 
        $url = set_url_scheme( $url, $scheme );
 
-       if ( ! empty( $path ) && is_string( $path ) && strpos( $path, '..' ) === false )
-               $url .= '/' . ltrim( $path, '/' );
+       $url = append_path( $url, $path );
 
        return apply_filters( 'site_url', $url, $path, $scheme, $blog_id );
 }
@@ -2005,8 +2019,7 @@
 function get_admin_url( $blog_id = null, $path = '', $scheme = 'admin' ) {
        $url = get_site_url($blog_id, 'wp-admin/', $scheme);
 
-       if ( !empty( $path ) && is_string( $path ) && strpos( $path, '..' ) === false )
-               $url .= ltrim( $path, '/' );
+       $url = append_path( $url, $path );
 
        return apply_filters( 'admin_url', $url, $path, $blog_id );
 }
@@ -2023,8 +2036,7 @@
 function includes_url($path = '') {
        $url = site_url() . '/' . WPINC . '/';
 
-       if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
-               $url .= ltrim($path, '/');
+       $url = append_path( $url, $path );
 
        return apply_filters('includes_url', $url, $path);
 }
@@ -2041,8 +2053,7 @@
 function content_url($path = '') {
        $url = set_url_scheme( WP_CONTENT_URL );
 
-       if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
-               $url .= '/' . ltrim($path, '/');
+       $url = append_path( $url, $path );
 
        return apply_filters('content_url', $url, $path);
 }
@@ -2080,8 +2091,7 @@
                        $url .= '/' . ltrim($folder, '/');
        }
 
-       if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
-               $url .= '/' . ltrim($path, '/');
+       $url = append_path( $url, $path );
 
        return apply_filters('plugins_url', $url, $path, $plugin);
 }
@@ -2111,8 +2121,7 @@
        else
                $url = set_url_scheme( 'http://' . $current_site->domain . $current_site->path, $scheme );
 
-       if ( ! empty( $path ) && is_string( $path ) && strpos( $path, '..' ) === false )
-               $url .= ltrim( $path, '/' );
+       $url = append_path( $url, $path );
 
        return apply_filters( 'network_site_url', $url, $path, $scheme );
 }
@@ -2147,8 +2156,7 @@
        else
                $url = set_url_scheme( 'http://' . $current_site->domain . $current_site->path, $scheme );
 
-       if ( ! empty( $path ) && is_string( $path ) && strpos( $path, '..' ) === false )
-               $url .= ltrim( $path, '/' );
+       $url = append_path( $url, $path );
 
        return apply_filters( 'network_home_url', $url, $path, $orig_scheme);
 }
@@ -2169,8 +2177,7 @@
 
        $url = network_site_url('wp-admin/network/', $scheme);
 
-       if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
-               $url .= ltrim($path, '/');
+       $url = append_path( $url, $path );
 
        return apply_filters('network_admin_url', $url, $path);
 }
@@ -2188,8 +2195,7 @@
 function user_admin_url( $path = '', $scheme = 'admin' ) {
        $url = network_site_url('wp-admin/user/', $scheme);
 
-       if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
-               $url .= ltrim($path, '/');
+       $url = append_path( $url, $path );
 
        return apply_filters('user_admin_url', $url, $path);
 }