Changeset 13657 for trunk/wp-includes/pluggable.php

Timestamp:

03/11/2010 02:54:11 PM (16 years ago)

Author:

ryan

Message:

Restrict schemes allowed in wp_validate_redirect()

File:

• trunk/wp-includes/pluggable.php (modified) (1 diff)

trunk/wp-includes/pluggable.php

@@ -985 +985 @@
 
         $lp  = parse_url($test);
+
+        // Give up if malformed URL
+        if ( false === $lp )
+                return $default;
+
+        // Allow only http and https schemes. No data:, etc.
+        if ( isset($lp['scheme']) && !('http' == $lp['scheme'] || 'https' == $lp['scheme']) )
+                return $default;
+
         $wpp = parse_url(home_url());