Ticket #34335: 34335.2.diff

src/wp-includes/class-oembed.php

@@ -464 +464 @@
 
                 $provider = add_query_arg( 'maxwidth', (int) $args['width'], $provider );
                 $provider = add_query_arg( 'maxheight', (int) $args['height'], $provider );
-                $provider = add_query_arg( 'url', urlencode($url), $provider );
+
+                /*
+                 * Only add the 'url' query variable if it is not already present.
+                 *
+                 * @see https://core.trac.wordpress.org/ticket/34335
+                 */
+                $url_query = parse_url( $provider, PHP_URL_QUERY );
+                parse_str( $url_query, $query_variables );
+
+                if ( ! isset ( $query_variables['url'] ) ) {
+                        $provider = add_query_arg( 'url', urlencode( $url ), $provider );
+                }
 
                 /**
                  * Filters the oEmbed URL to be fetched.

tests/phpunit/tests/oembed/wpOembed.php

@@ -11 +11 @@
 
         public $pre_oembed_result_filtered = false;
 
+        /**
+         * @var string
+         */
+        protected $_provider_url = null;
+
         public function setUp() {
                 parent::setUp();
 
@@ -18 +23 @@
                 $this->oembed = _wp_oembed_get_object();
 
                 $this->pre_oembed_result_filtered = false;
+                $this->_provider_url = null;
         }
 
         public function _filter_pre_oembed_result( $result ) {
@@ -69 +75 @@
                 $this->assertTrue( false !== $this->pre_oembed_result_filtered );
                 $this->assertFalse( $actual );
         }
+
+        /**
+         * @ticket 34335
+         */
+        public function test_fetch_of_provider_with_url() {
+                add_filter( 'pre_http_request', array( $this, '_http_mock_response' ), 10, 3 );
+
+                //Discovered endpoint contains an url query variable, this should be used instead of the passed url
+                $this->oembed->fetch( 'https://example.com/provider/endpoint?url=https://example.com/foo', 'https://example.com/bar', array(
+                        'discovered' => true
+                ) );
+
+                remove_filter( 'pre_http_request', array( $this, '_http_mock_response' ) );
+
+                $url_query = parse_url( $this->_provider_url, PHP_URL_QUERY );
+                parse_str( $url_query, $query_variables );
+                $this->assertEquals( 'https://example.com/foo', $query_variables['url'] );
+        }
+
+        /**
+         * @ticket 34335
+         */
+        public function test_fetch_of_provider_without_url() {
+                add_filter( 'pre_http_request', array( $this, '_http_mock_response' ), 10, 3 );
+
+                //Discovered endpoint does not contain an url query variable, we should insert the passed url
+                $this->oembed->fetch( 'https://example.com/provider/endpoint', 'https://example.com/bar', array(
+                        'discovered' => true
+                ) );
+
+                remove_filter( 'pre_http_request', array( $this, '_http_mock_response' ) );
+
+                $url_query = parse_url( $this->_provider_url, PHP_URL_QUERY );
+                parse_str( $url_query, $query_variables );
+                $this->assertEquals( 'https://example.com/bar', $query_variables['url'] );
+        }
+
+        public function _http_mock_response( $response,  $request_args, $request_url ) {
+                $this->_provider_url = $request_url;
+                return array(
+                        'headers'  => array(),
+                        'body'     => '',
+                        'response' => array(
+                                'code'    => 200,
+                                'message' => '',
+                        ),
+                        'cookies'  => array(),
+                        'filename' => false,
+                );
+        }
 }