Ticket #4606: wp2-4606.002.diff

wp-includes/pluggable-functions.php

@@ -284 +284 @@
 }
 endif;
 
+if ( !function_exists('wp_safe_redirect') ) : 
+/** 
+* performs a safe (local) redirect, using wp_redirect() 
+* @return void 
+**/ 
+function wp_safe_redirect($location, $status = 302) { 
+        if ( $location{0} == '/' ) { 
+                if ( $location{1} == '/' ) 
+                        $location = get_option('home') . '/'; 
+        } else { 
+                if ( substr($location, 0, strlen(get_option('home'))) != get_option('home') ) 
+                        $location = get_option('home') . '/'; 
+        } 
+ 
+        wp_redirect($location, $status); 
+}
+endif; 
+
 if ( !function_exists('wp_get_cookie_login') ):
 function wp_get_cookie_login() {
         if ( empty($_COOKIE[USER_COOKIE]) || empty($_COOKIE[PASS_COOKIE]) )

wp-login.php

@@ -29 +29 @@
         if ( isset($_REQUEST['redirect_to']) )
                 $redirect_to = $_REQUEST['redirect_to'];
                         
-        wp_redirect($redirect_to);
+        wp_safe_redirect($redirect_to);
         exit();
 
 break;
@@ -198 +198 @@
                         if ( !$using_cookie )
                                 wp_setcookie($user_login, $user_pass, false, '', '', $rememberme);
                         do_action('wp_login', $user_login);
-                        wp_redirect($redirect_to);
+                        wp_safe_redirect($redirect_to);
                         exit;
                 } else {
                         if ( $using_cookie )                    

wp-pass.php

@@ -7 +7 @@
 // 10 days
 setcookie('wp-postpass_' . COOKIEHASH, $_POST['post_password'], time() + 864000, COOKIEPATH);
 
-wp_redirect(wp_get_referer());
+wp_safe_redirect(wp_get_referer());
 ?>
+ No newline at end of file