Ticket #18818: 18818.2.diff

src/wp-includes/pluggable.php

@@ -1214 +1214 @@
                 ){1,50}                              # ...one or more times
                 )/x';
         $location = preg_replace_callback( $regex, '_wp_sanitize_utf8_in_redirect', $location );
-        $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*\[\]()]|i', '', $location);
+        $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*\[\]()@]|i', '', $location);
         $location = wp_kses_no_null($location);
 
         // remove %0d and %0a from location

tests/phpunit/tests/formatting/redirect.php

@@ -18 +18 @@
                 $this->assertEquals('http://example.com/whyisthisintheurl/?param[1]=foo', wp_sanitize_redirect('http://example.com/whyisthisintheurl/?param[1]=foo'));
                 $this->assertEquals('http://[2606:2800:220:6d:26bf:1447:aa7]/', wp_sanitize_redirect('http://[2606:2800:220:6d:26bf:1447:aa7]/'));
                 $this->assertEquals('http://example.com/search.php?search=(amistillhere)', wp_sanitize_redirect('http://example.com/search.php?search=(amistillhere)'));
+                $this->assertEquals('http://example.com/@username', wp_sanitize_redirect('http://example.com/@username'));
         }
 }