Ticket #40353: 40353.2.patch

src/wp-includes/formatting.php

@@ -2948 +2948 @@
 }
 
 /**
+ * Verifies that an URL is valid wordpress one.
+ *
+ * @since 0.71
+ *
+ * @param string $url URL to verify
+ * @return string|bool Either false or the valid url.
+ */
+function is_wordpress_url( $url ) {
+        $parsed = parse_url($url, PHP_URL_SCHEME);
+        if (false === $parsed) {
+                return apply_filters( 'is_wordpress_url', false, $url, 'invalid_url' );
+        }
+
+        if (null === $parsed || ($parsed !== 'http' && $parsed !== 'https')) {
+                return apply_filters( 'is_wordpress_url', false, $url, 'invalid_scheme' );
+        }
+
+        return apply_filters( 'is_wordpress_url', $url, $url, null );
+}
+
+/**
  * Convert to ASCII from email subjects.
  *
  * @since 1.2.0
@@ -4159 +4180 @@
                         if ( is_wp_error( $value ) ) {
                                 $error = $value->get_error_message();
                         } else {
-                                if ( preg_match( '#http(s?)://(.+)#i', $value ) ) {
+                                if ( is_wordpress_url($value) ) {
                                         $value = esc_url_raw( $value );
                                 } else {
                                         $error = __( 'The WordPress address you entered did not appear to be a valid URL. Please enter a valid URL.' );
@@ -4172 +4193 @@
                         if ( is_wp_error( $value ) ) {
                                 $error = $value->get_error_message();
                         } else {
-                                if ( preg_match( '#http(s?)://(.+)#i', $value ) ) {
+                                if ( is_wordpress_url($value) ) {
                                         $value = esc_url_raw( $value );
                                 } else {
                                         $error = __( 'The Site address you entered did not appear to be a valid URL. Please enter a valid URL.' );