Ticket #9508: 9508.patch

wp-admin/includes/theme-install.php

@@ -616 +616 @@
                 return;
         }
 
-        $theme = isset($_REQUEST['theme']) ? stripslashes( $_REQUEST['theme'] ) : '';
+        $theme        = isset($_REQUEST['theme'])        ? stripslashes( $_REQUEST['theme'] )        : '';
+        $theme_name   = isset($_REQUEST['theme_name'])   ? stripslashes( $_REQUEST['theme_name'] )   : '';
+        $download_url = isset($_REQUEST['download_url']) ? stripslashes( $_REQUEST['download_url'] ) : '';
 
         $url = 'theme-install.php?tab=install';
-        $url = add_query_arg(array('theme' => $theme, 'theme_name' => stripslashes( $_REQUEST['theme_name'] ), 'download_url' => stripslashes( $_REQUEST['download_url'] ) ), $url);
+        $url = add_query_arg(array('theme' => $theme, 'theme_name' => $theme_name, 'download_url' => $download_url ), $url);
 
         $url = wp_nonce_url($url, 'install-theme_' . $theme);
         if ( false === ($credentials = request_filesystem_credentials($url)) )