Ticket #25840: 25840.3.diff

src/wp-includes/class-http.php

@@ -519 +519 @@
                 if ( $check['host'] == 'localhost' || $check['host'] == $home['host'] )
                         return apply_filters('block_local_requests', false);
 
-                if ( !defined('WP_ACCESSIBLE_HOSTS') )
-                        return true;
+                static $wp_accessible_hosts;
+                if ( null == $wp_accessible_hosts ) {
+                        if ( defined( 'WP_ACCESSIBLE_HOSTS' ) )
+                                $wp_accessible_hosts = preg_split( '|,\s*|', WP_ACCESSIBLE_HOSTS );
+                        else
+                                $wp_accessible_hosts = array();
+                }
 
-                static $accessible_hosts;
-                static $wildcard_regex = false;
-                if ( null == $accessible_hosts ) {
-                        $accessible_hosts = preg_split('|,\s*|', WP_ACCESSIBLE_HOSTS);
+                /**
+                 * Filter the list of accessible hosts.
+                 *
+                 * @since 3.8
+                 *
+                 * @param array $wp_accessible_hosts List of accessible hosts.
+                 * @param string $uri The URL being accessed.
+                 * @param array $check The pasesed URL being accessed.
+                 */
+                $accessible_hosts = apply_filters( 'wp_http_accessible_hosts', $wp_accessible_hosts, $uri, $check );
 
-                        if ( false !== strpos(WP_ACCESSIBLE_HOSTS, '*') ) {
-                                $wildcard_regex = array();
-                                foreach ( $accessible_hosts as $host )
-                                        $wildcard_regex[] = str_replace( '\*', '.+', preg_quote( $host, '/' ) );
-                                $wildcard_regex = '/^(' . implode('|', $wildcard_regex) . ')$/i';
-                        }
+                // Check if there's an exact match
+                if ( in_array( $accessible_hosts, $check['host'] ) )
+                        return false; // do not block
+
+                // Check to see if there's a wildcard match
+                foreach ( $accessible_hosts as $host ) {
+                        // Skip non-wildcard entries
+                        if ( false === strpos( $host, '*' ) )
+                                continue;
+
+                        $regex = str_replace( '\*', '.+', preg_quote( $host, '!' ) );
+                        if ( preg_match( '!^(' . $regex . ')$!i', $check['host'] ) )
+                                return false; // do not block
                 }
 
-                if ( !empty($wildcard_regex) )
-                        return !preg_match($wildcard_regex, $check['host']);
-                else
-                        return !in_array( $check['host'], $accessible_hosts ); //Inverse logic, If it's in the array, then we can't access it.
-
+                // Otherwise, block the request
+                return true;
         }
 
         static function make_absolute_url( $maybe_relative_path, $url ) {