Changeset 11610

Timestamp:

06/19/2009 07:30:17 PM (16 years ago)

Author:

markjaquith

Message:

Create wp_validate_redirect(), have the upgrade done link use it. props Westi. fixes #10193 for trunk

Location:

trunk

Files:

• wp-admin/upgrade.php (modified) (1 diff)
• wp-includes/pluggable.php (modified) (3 diffs)

trunk/wp-admin/upgrade.php

@@ -69 +69 @@
     case 1:
         wp_upgrade();
-
-        if ( empty( $_GET['backto'] ) )
-            $backto = __get_option( 'home' ) . '/';
-        else {
-            $backto = stripslashes( urldecode( $_GET['backto'] ) );
+            
+            $backto = empty($_GET['backto']) ? '' : $_GET['backto'] ;
+            $backto = stripslashes( urldecode( $backto ) );
             $backto = esc_url_raw( $backto  );
-        }
+            $backto = wp_validate_redirect($backto, __get_option( 'home' ) . '/');
 ?>
 <h2><?php _e( 'Upgrade Complete' ); ?></h2>

trunk/wp-includes/pluggable.php

@@ -909 +909 @@
  *
  * @since 2.3
- * @uses apply_filters() Calls 'allowed_redirect_hosts' on an array containing
- *      WordPress host string and $location host string.
+ * @uses wp_validate_redirect() To validate the redirect is to an allowed host.
  *
  * @return void Does not return anything
@@ -919 +918 @@
     $location = wp_sanitize_redirect($location);
 
+    $location = wp_validate_redirect($location, admin_url());
+
+    wp_redirect($location, $status);
+}
+endif;
+
+if ( !function_exists('wp_validate_redirect') ) :
+/**
+ * Validates a URL for use in a redirect.
+ *
+ * Checks whether the $location is using an allowed host, if it has an absolute
+ * path. A plugin can therefore set or remove allowed host(s) to or from the
+ * list.
+ *
+ * If the host is not allowed, then the redirect is to $default supplied
+ *
+ * @since 2.8.1
+ * @uses apply_filters() Calls 'allowed_redirect_hosts' on an array containing
+ *      WordPress host string and $location host string.
+ *
+ * @param string $location The redirect to validate
+ * @param string $default The value to return is $location is not allowed
+ * @return string redirect-sanitized URL
+ **/
+function wp_validate_redirect($location, $default = '') {
     // browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
     if ( substr($location, 0, 2) == '//' )
@@ -932 +956 @@
 
     if ( isset($lp['host']) && ( !in_array($lp['host'], $allowed_hosts) && $lp['host'] != strtolower($wpp['host'])) )
-        $location = admin_url();
-
-    wp_redirect($location, $status);
+        $location = $default;
+
+    return $location;
 }
 endif;