Ticket #3299: 3299-clean_url.patch

wp-includes/formatting.php

@@ -1076 +1076 @@
 }
 
 function clean_url( $url, $protocols = null ) {
+        /* It's not at all well defined what this fuction is really
+         * meant to achieve. I presume it doesn't just check if a 
+         * URL is well formed but also that undesirable content
+         * is removed.
+        */
         if ('' == $url) return $url;
-        $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%]|i', '', $url);
+        $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@]|i', '', $url);
         $strip = array('%0d', '%0a');
         $url = str_replace($strip, '', $url);
         $url = str_replace(';//', '://', $url);
-        // Append http unless a relative link starting with / or a php file.
-        if ( strpos($url, '://') === false &&
+        /* If the URL doesn't appear to contain a scheme, we
+         * presume it needs http:// appended (unless a relative 
+         * link starting with / or a php file).
+         */
+        if ( strpos($url, ':') === false &&
                 substr( $url, 0, 1 ) != '/' && !preg_match('/^[a-z0-9-]+?\.php/i', $url) )
                 $url = 'http://' . $url;