Ticket #42993: 42993.2.patch

src/wp-admin/includes/network.php

@@ -52 +52 @@
  */
 function allow_subdirectory_install() {
         global $wpdb;
-                /**
-                 * Filters whether to enable the subdirectory installation feature in Multisite.
-                 *
-                 * @since 3.0.0
-                 *
-                 * @param bool $allow Whether to enable the subdirectory installation feature in Multisite. Default is false.
-                 */
+        /**
+         * Filters whether to enable the subdirectory installation feature in Multisite.
+         *
+         * @since 3.0.0
+         *
+         * @param bool $allow Whether to enable the subdirectory installation feature in Multisite. Default is false.
+         */
         if ( apply_filters( 'allow_subdirectory_install', false ) ) {
                 return true;
         }
@@ -133 +133 @@
 
         $hostname  = get_clean_basedomain();
         $has_ports = strstr( $hostname, ':' );
-        if ( ( false !== $has_ports && ! in_array( $has_ports, array( ':80', ':443' ) ) ) ) {
+        /**
+         * Filters allowed HTTP ports in Multisite.
+         *
+         * @since 5.0.0
+         *
+         * @param array $allowed_ports The allowed ports. Default is [ ':80', ':443' ].
+         */
+        if ( ( false !== $has_ports && ! in_array( $has_ports, apply_filters( 'allowed_multisite_ports', array( ':80', ':443' ) ) ) ) ) {
                 echo '<div class="error"><p><strong>' . __( 'ERROR:' ) . '</strong> ' . __( 'You cannot install a network of sites with your server address.' ) . '</p></div>';
                 echo '<p>' . sprintf(
                         /* translators: %s: port number */

src/wp-admin/network/site-info.php

@@ -67 +67 @@
 
                 $blog_data['scheme'] = $update_parsed_url['scheme'];
                 $blog_data['domain'] = $update_parsed_url['host'];
+                // Add port (if it's in allowed list)
+                if ( ! empty( $update_parsed_url['port'] && in_array( ':' . $update_parsed_url['port'], apply_filters( 'allowed_multisite_ports', array( ':80', ':443' ) ) ) ) ) {
+                        $blog_data['domain'] .= ':' . $update_parsed_url['port'];
+                }
                 $blog_data['path']   = $update_parsed_url['path'];
         }
-
         $existing_details     = get_site( $id );
         $blog_data_checkboxes = array( 'public', 'archived', 'spam', 'mature', 'deleted' );
         foreach ( $blog_data_checkboxes as $c ) {

src/wp-includes/ms-functions.php

@@ -1272 +1272 @@
         );
         $meta     = wp_parse_args( $meta, $defaults );
 
+        add_filter( 'sanitize_user', 'wpmu_sanitize_domain_filter', 1, 3 );
         $domain = preg_replace( '/\s+/', '', sanitize_user( $domain, true ) );
+        remove_filter( 'sanitize_user', 'wpmu_sanitize_domain_filter', 1, 3 );
 
         if ( is_subdomain_install() ) {
                 $domain = str_replace( '@', '', $domain );
@@ -1339 +1341 @@
 }
 
 /**
+ * Callback for 'sanitize_user' filter allowing ports in domain string.
+ *
+ * @since 5.0.0
+ *
+ * @param string $domain       Sanitized domain.
+ * @param string $raw_domain   The domain prior to sanitization.
+ * @param bool   $strict       Whether to limit the sanitization to specific characters. Default false.
+ */
+function wpmu_sanitize_domain_filter ( $domain, $raw_domain, $strict ) {
+        $port = parse_url( $raw_domain, PHP_URL_PORT );
+        if ( ! empty($port) && in_array( ':' . $port, apply_filters( 'allowed_multisite_ports', array( ':80', ':443' ) ) ) ) {
+                $domain = preg_replace( "/{$port}$/", ':' . $port, $domain );
+        }
+        return $domain;
+}
+
+/**
  * Notifies the network admin that a new site has been activated.
  *
  * Filter {@see 'newblog_notify_siteadmin'} to change the content of