Ticket #39373: 39373.diff

src/wp-includes/rewrite.php

@@ -471 +471 @@
          */
         $url = apply_filters( 'url_to_postid', $url );
 
+        // Bail early when URL doesn't belong to this site.
+        $host = parse_url( home_url(), PHP_URL_HOST );
+        if ( false === strpos( $url, $host ) ) {
+                //return 0;
+        }
+
         // First, check to see if there is a 'p=N' or 'page_id=N' to match against
         if ( preg_match('#[?&](p|page_id|attachment_id)=(\d+)#', $url, $values) )       {
                 $id = absint($values[2]);

tests/phpunit/tests/rewrite.php

@@ -389 +389 @@
                 $this->assertInternalType( 'array', $rewrite_rules );
                 $this->assertNotEmpty( $rewrite_rules );
         }
+
+        /**
+         * @ticket 39373
+         */
+        public function test_url_to_postid_should_bail_when_host_does_not_match() {
+                $this->set_permalink_structure( '/%postname%/' );
+
+                $post_id = self::factory()->post->create( array( 'post_name' => 'foo-bar-baz' ) );
+                $permalink = get_permalink( $post_id );
+                $url = str_replace( home_url(), 'http://some-other-domain.com/', get_permalink( $post_id ) );
+
+                $this->assertSame( $post_id, url_to_postid( $permalink ) );
+                $this->assertSame( 0, url_to_postid( $url ) );
+        }
 }