Ticket #34028: 34028.diff

wp-includes/pluggable.php

@@ -1321 +1321 @@
 function wp_validate_redirect($location, $default = '') {
         $location = trim( $location );
         // browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
-        if ( substr($location, 0, 2) == '//' )
+        if ( substr($location, 0, 2) == '//' ) {
                 $location = 'http:' . $location;
+        }
 
         // In php 5 parse_url may fail if the URL query part contains http://, bug #38143
         $test = ( $cut = strpos($location, '?') ) ? substr( $location, 0, $cut ) : $location;
@@ -1330 +1331 @@
         $lp  = parse_url($test);
 
         // Give up if malformed URL
-        if ( false === $lp )
+        if ( false === $lp ) {
                 return $default;
+        }
 
         // Allow only http and https schemes. No data:, etc.
-        if ( isset($lp['scheme']) && !('http' == $lp['scheme'] || 'https' == $lp['scheme']) )
+        if ( isset($lp['scheme']) && !('http' == $lp['scheme'] || 'https' == $lp['scheme']) ) {
                 return $default;
+        }
 
         // Reject if scheme is set but host is not. This catches urls like https:host.com for which parse_url does not set the host field.
-        if ( isset($lp['scheme'])  && !isset($lp['host']) )
+        if ( isset($lp['scheme'])  && !isset($lp['host']) ) {
                 return $default;
+        }
 
-        $wpp = parse_url(home_url());
+        $home = parse_url(home_url());
+        $site = parse_url(site_url());
 
         /**
          * Filter the whitelist of hosts to redirect to.
@@ -1351 +1356 @@
          * @param array       $hosts An array of allowed hosts.
          * @param bool|string $host  The parsed host; empty if not isset.
          */
-        $allowed_hosts = (array) apply_filters( 'allowed_redirect_hosts', array($wpp['host']), isset($lp['host']) ? $lp['host'] : '' );
+        $allowed_hosts = (array) apply_filters( 'allowed_redirect_hosts', array( $home['host'], $site['host'] ), isset( $lp['host'] ) ? $lp['host'] : '' );
 
-        if ( isset($lp['host']) && ( !in_array($lp['host'], $allowed_hosts) && $lp['host'] != strtolower($wpp['host'])) )
+        if ( isset( $lp['host'] ) && ( !in_array( $lp['host'], $allowed_hosts ) && ( $lp['host'] != strtolower( $home['host'] ) || $lp['host'] != strtolower( $site['host'] ) ) ) ) {
                 $location = $default;
+        }
 
         return $location;
 }