id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
19032	"home_url() malfunctions when the passed URL contains two dots in a row ("".."")"	markjaquith	markjaquith	"{{{home_url()}}} (and a bunch of other similar functions) will spit back your WordPress Site URL if the URL/path you pass in to it has two dots ("".."") in a row. It was an unexplained addition to the original code that has persisted.

Reproduction:

{{{echo home_url( '/foo-bar/elipsis...no-work/' );}}}

Observed:

{{{http://example.com}}}

Expected:

{{{http://example.com/foo-bar/elipsis...no-work/}}}

It is due to this:

{{{
if ( !empty( $path ) && is_string( $path ) && strpos( $path, '..' ) === false )
    $url .= '/' . ltrim( $path, '/' );
}}}

We should just remove that part of the condition. It doesn't serve any legitimate purpose that Nacin or I can tell, and it makes legitimate URLs with two (or more) dots fail in a very unexpected way."	defect (bug)	closed	high	3.6	General	2.6	normal	fixed	has-patch 2nd-opinion	kpayne@…