Changeset 1751

Timestamp:

10/05/2004 04:22:31 PM (21 years ago)

Author:

saxmatt

Message:

Better redirect cleaning.

Location:

trunk

Files:

• wp-admin/options.php (modified) (1 diff)
• wp-admin/post.php (modified) (1 diff)
• wp-comments-post.php (modified) (2 diffs)
• wp-login.php (modified) (1 diff)

trunk/wp-admin/options.php

@@ -87 +87 @@
     $referred = str_replace('?updated=true' , '', $_SERVER['HTTP_REFERER']);
     $goback = str_replace('?updated=true', '', $_SERVER['HTTP_REFERER']) . '?updated=true';
-    $goback = preg_replace('|[^a-z?=&/~.:_-]|i', '', $goback);
+    $goback = preg_replace('|[^a-z0-9-~+_.?#=&;,/:]|i', '', $goback);
     header('Location: ' . $goback);
     break;

trunk/wp-admin/post.php

@@ -459 +459 @@
     $sendback = $_SERVER['HTTP_REFERER'];
     if (strstr($sendback, 'post.php')) $sendback = get_settings('siteurl') .'/wp-admin/post.php';
-    $sendback = preg_replace('|[^a-z?=&/~.:_-]|i', '', $sendback);
+    $sendback = preg_replace('|[^a-z0-9-~+_.?#=&;,/:]|i', '', $sendback);
     header ('Location: ' . $sendback);
     do_action('delete_post', $post_id);

trunk/wp-comments-post.php

@@ -90 +90 @@
 }
 
-setcookie('comment_author_' . $cookiehash, stripslashes($author), time() + 30000000, COOKIEPATH);
-setcookie('comment_author_email_' . $cookiehash, stripslashes($email), time() + 30000000, COOKIEPATH);
-setcookie('comment_author_url_' . $cookiehash, stripslashes($url), time() + 30000000, COOKIEPATH);
+setcookie('comment_author_' . COOKIEHASH, stripslashes($author), time() + 30000000, COOKIEPATH);
+setcookie('comment_author_email_' . COOKIEHASH, stripslashes($email), time() + 30000000, COOKIEPATH);
+setcookie('comment_author_url_' . COOKIEHASH, stripslashes($url), time() + 30000000, COOKIEPATH);
 
 header('Expires: Mon, 26 Jul 1997 05:00:00 GMT');
@@ -98 +98 @@
 header('Cache-Control: no-cache, must-revalidate');
 header('Pragma: no-cache');
-$location = (empty($_POST['redirect_to'])) ? $_SERVER["HTTP_REFERER"] : $_POST['redirect_to'];
-$location = preg_replace('|[^a-z?=&/~.:_-]|i', '', $location);
+
+$location = get_permalink($comment_ID);
 
 if ($is_IIS) {

trunk/wp-login.php

@@ -140 +140 @@
         $log = $_POST['log'];
         $pwd = $_POST['pwd'];
-        $redirect_to = preg_replace('|[^a-z?=&/~.:_-]|i', '', $_POST['redirect_to']);
+        $redirect_to = preg_replace('|[^a-z0-9-~+_.?#=&;,/:]|i', '', $_POST['redirect_to']);
     }