Ticket #12868: 12868-6.diff

wp-includes/formatting.php

@@ -2359 +2359 @@
         switch ($option) {
                 case 'admin_email':
                         $value = sanitize_email($value);
-                        if ( !$value && function_exists('add_settings_error') )
-                                add_settings_error('admin_email', 'invalid_admin_email', __('The email address submitted was not in the right format. Please enter a valid email address.'));
+                        if ( !is_email( $value ) ){
+                                $value = get_option( $option ); // Resets option to stored val in case of invalid email
+                                if( function_exists('add_settings_error') )
+                                        add_settings_error('admin_email', 'invalid_admin_email', __('The email address submitted was not in the right format. Please enter a valid email address.'));
+                        }
                         break;
 
                 case 'thumbnail_size_w':
@@ -2434 +2437 @@
                         $value = preg_replace('/[^0-9:.-]/', '', $value); // strips slashes
                         break;
 
-                case 'siteurl':
-                case 'home':
-                        $value = esc_url_raw($value);
-                        break;
+                case 'siteurl':
+                        $value = esc_url_raw($value);
+                        if ( !is_url( $value ) )
+                        {
+                                $value = get_option( $option ); // Resets option to stored val in case of empty
+                                if( function_exists('add_settings_error') )
+                                        add_settings_error('siteurl', 'invalid_siteurl', __('The WordPress address you submitted was not in the right format. Please enter a valid URL.'));
+                        }
+                        break;
+                case 'home':
+                        $value = esc_url_raw($value);
+                        if ( !is_url( $value ) )
+                        {
+                                $value = get_option( $option ); // Resets option to stored val in case of empty
+                                if( function_exists('add_settings_error') )
+                                        add_settings_error('home', 'invalid_home', __('The Site address you submitted was not in the right format. Please enter a valid URL.'));
+                        }
+                        break;
                 default :
                         $value = apply_filters("sanitize_option_{$option}", $value, $option);
                         break;

wp-includes/pluggable.php

@@ -1749 +1749 @@
         return $r;
 }
 endif;
+
+if( !function_exists('is_url') )
+{
+        /**
+         * Provides minimal validation that a string looks like a URL verifying only that it begins with http or https
+         * Note that strings without dots (i.e. localhost) are considered valid RFC domain names so validation does 
+         * not look for .com, .net, etc
+         *
+         * @since 3.0
+         * @param string $url A URL to be validated. 
+         * @return boolean
+        */
+        function is_url( $url )
+        {
+                preg_match( '#http(s?)://(.+)#i', $url, $matches );
+                if( empty( $matches ) )
+                        return false;
+                        
+                return true;
+        }
+}
+ No newline at end of file