Ticket #16855: 16855.3.patch

wp-includes/class-http.php

@@ -981 +981 @@
         function request($url, $args = array()) {
                 $defaults = array(
                         'method' => 'GET', 'timeout' => 5,
-                        'redirection' => 5, 'httpversion' => '1.0',
+                        'redirection' => 5, 'followlocation' => true,
+                        'httpversion' => '1.0',
                         'blocking' => true,
                         'headers' => array(), 'body' => null, 'cookies' => array()
                 );
@@ -1027 +1028 @@
                                 'method' => strtoupper($r['method']),
                                 'user_agent' => $r['user-agent'],
                                 'max_redirects' => $r['redirection'] + 1, // See #11557
+                                'follow_location' => (int) $r['followlocation'],
                                 'protocol_version' => (float) $r['httpversion'],
                                 'header' => $strHeaders,
                                 'ignore_errors' => true, // Return non-200 requests.
@@ -1304 +1306 @@
         function request($url, $args = array()) {
                 $defaults = array(
                         'method' => 'GET', 'timeout' => 5,
-                        'redirection' => 5, 'httpversion' => '1.0',
-                        'blocking' => true,
+                        'redirection' => 5, 'followlocation' => !(ini_get('safe_mode') || ini_get('open_basedir')), 
+                        'httpversion' => '1.0', 'blocking' => true,
                         'headers' => array(), 'body' => null, 'cookies' => array()
                 );
 
@@ -1367 +1369 @@
                 curl_setopt( $handle, CURLOPT_SSL_VERIFYPEER, $ssl_verify );
                 curl_setopt( $handle, CURLOPT_USERAGENT, $r['user-agent'] );
                 curl_setopt( $handle, CURLOPT_MAXREDIRS, $r['redirection'] );
+                curl_setopt( $handle, CURLOPT_FOLLOWLOCATION, $r['followlocation'] );
 
                 switch ( $r['method'] ) {
                         case 'HEAD':
@@ -1448 +1451 @@
                 curl_close( $handle );
 
                 // See #11305 - When running under safe mode, redirection is disabled above. Handle it manually.
-                if ( !empty($theHeaders['headers']['location']) && (ini_get('safe_mode') || ini_get('open_basedir')) ) {
+                if ( $r['followlocation'] && !empty($theHeaders['headers']['location']) && (ini_get('safe_mode') || ini_get('open_basedir')) ) {
                         if ( $r['redirection']-- > 0 ) {
                                 return $this->request($theHeaders['headers']['location'], $r);
                         } else {