Ticket #23350: 23350.patch

wp-includes/comment.php

@@ -1976 +1976 @@
 
         $parsed_home = @parse_url( get_option( 'home' ) );
 
-        $same_host = strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );
+        $same_host = strcasecmp( $parsed_home['host'], $parsed_url['host'] ) === 0;
 
         if ( ! $same_host ) {
                 $host = trim( $parsed_url['host'], '.' );
-                if ( preg_match( '#^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$#', $host ) ) {
-                        $ip = $host;
-                } else {
+                $ip = filter_var( $host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 );
+                if ( ! $ip ) {
                         $ip = gethostbyname( $host );
                         if ( $ip === $host ) // Error condition for gethostbyname()
                                 $ip = false;
                 }
                 if ( $ip ) {
-                        if ( '127.0.0.1' === $ip )
+                        if ( ! filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_RES_RANGE | FILTER_FLAG_NO_PRIV_RANGE ) ) {
                                 return '';
-                        $parts = array_map( 'intval', explode( '.', $ip ) );
-                        if ( 10 === $parts[0] )
-                                return '';
-                        if ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
-                                return '';
-                        if ( 192 === $parts[0] && 168 === $parts[1] )
-                                return '';
-                }
-        }
+                        }
+                }
 
         if ( empty( $parsed_url['port'] ) )
                 return $uri;
@@ -2007 +1999 @@
         if ( 80 === $port || 443 === $port || 8080 === $port )
                 return $uri;
 
-        if ( $parsed_home && $same_host && $parsed_home['port'] === $port )
+        if ( $same_host && isset( $parsed_home['port'] ) && $parsed_home['port'] === $port )
                 return $uri;
 
         return '';