Ticket #24646: 24646.2.diff

wp-includes/http.php

@@ -442 +442 @@
         $same_host = strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );
 
         if ( ! $same_host ) {
-                $host = trim( $parsed_url['host'], '.' );
+                $host = strtolower( trim( $parsed_url['host'], '.' ) );
                 if ( preg_match( '#^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$#', $host ) ) {
                         $ip = $host;
                 } else {
@@ -451 +451 @@
                                 $ip = false;
                 }
                 if ( $ip ) {
+                        $maybe_local = false;
+                        $parts = array_map( 'intval', explode( '.', $ip ) );
                         if ( '127.0.0.1' === $ip )
-                                return false;
-                        $parts = array_map( 'intval', explode( '.', $ip ) );
-                        if ( 10 === $parts[0] )
-                                return false;
-                        if ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
-                                return false;
-                        if ( 192 === $parts[0] && 168 === $parts[1] )
-                                return false;
+                                $maybe_local = true;
+                        elseif ( 10 === $parts[0] )
+                                $maybe_local = true;
+                        elseif ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
+                                $maybe_local = true;
+                        elseif ( 192 === $parts[0] && 168 === $parts[1] )
+                                $maybe_local = true;
+
+                        if ( $maybe_local ) {
+                                $allowed_hosts = (array) apply_filters( 'allowed_http_request_hosts', array(), $host );
+                                if ( in_array( $host, $allowed_hosts ) ) {
+                                        $maybe_local = false;
+                                } elseif ( wp_validate_redirect( 'http://' . $host ) ) {
+                                        $maybe_local = false;
+                                } elseif ( is_multisite() ) {
+                                        if ( $wpdb->get_var( $wpdb->prepare( "SELECT domain FROM $wpdb->blogs WHERE domain = %s LIMIT 1", $host ) ) )
+                                                $maybe_local = false;
+                                }
+
+                                if ( $maybe_local )
+                                        return false;
+                        }
                 }
         }