Ticket #39373: 39373.patch

tests/phpunit/tests/rewrite.php

@@ -389 +389 @@
                 $this->assertInternalType( 'array', $rewrite_rules );
                 $this->assertNotEmpty( $rewrite_rules );
         }
+
+        /**
+         * @ticket 39373
+         */
+        public function test_url_to_postid_from_external_url(){
+                $this->set_permalink_structure( '/%category%/%postname%/' );
+                $cat1 = wp_create_category( 'something' );
+                self::factory()->post->create( array( 'post_title' => 'External URL', 'post_type' => 'post', 'post_name' => 'external-url', 'post_category' => array( $cat1 ) ) );
+
+                $test_external = 'http://www.external-domain.com/something/external-url/';
+                $this->assertSame( 0, url_to_postid( $test_external ) );
+        }
 }

src/wp-includes/rewrite.php

@@ -517 +517 @@
         if ( !$wp_rewrite->using_index_permalinks() )
                 $url = str_replace( $wp_rewrite->index . '/', '', $url );
 
+        // Before we truncate $url, we temporary store it
+        $temporary_url = $url;
         if ( false !== strpos( trailingslashit( $url ), home_url( '/' ) ) ) {
                 // Chop off http://domain.com/[path]
                 $url = str_replace(home_url(), '', $url);
@@ -527 +529 @@
                 $url = preg_replace( sprintf( '#^%s#', preg_quote( $home_path ) ), '', trailingslashit( $url ) );
         }
 
+        // If the $url is not truncated, that means the $url is not from our current domain. Bail. @ticket 39373
+        if( false !== strpos( $url, $temporary_url ) ){
+                return 0;
+        }
+
         // Trim leading and lagging slashes
         $url = trim($url, '/');