Ticket #28362: 28362.patch

src/wp-includes/pluggable.php

@@ -1156 +1156 @@
  * @return string redirect-sanitized URL
  **/
 function wp_sanitize_redirect($location) {
-        $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!]|i', '', $location);
+        $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*]|i', '', $location);
         $location = wp_kses_no_null($location);
 
         // remove %0d and %0a from location

tests/phpunit/tests/formatting/redirect.php

@@ -10 +10 @@
                 $this->assertEquals('http://example.com/watchthelinefeedgo', wp_sanitize_redirect('http://example.com/watchthelinefeed%0ago'));
                 $this->assertEquals('http://example.com/watchthecarriagereturngo', wp_sanitize_redirect('http://example.com/watchthecarriagereturn%0Dgo'));
                 $this->assertEquals('http://example.com/watchthecarriagereturngo', wp_sanitize_redirect('http://example.com/watchthecarriagereturn%0dgo'));
+                $this->assertEquals('http://example.com/watchtheallowedcharacters-~+_.?#=&;,/:%!*stay', wp_sanitize_redirect('http://example.com/watchtheallowedcharacters-~+_.?#=&;,/:%!*stay'));
                 //Nesting checks
                 $this->assertEquals('http://example.com/watchthecarriagereturngo', wp_sanitize_redirect('http://example.com/watchthecarriagereturn%0%0ddgo'));
                 $this->assertEquals('http://example.com/watchthecarriagereturngo', wp_sanitize_redirect('http://example.com/watchthecarriagereturn%0%0DDgo'));