Changeset 23570

Timestamp:

03/01/2013 05:20:32 PM (12 years ago)

Author:

ryan

Message:

Always wp_unslash() the return of wp_get_referer().

see #21767

Location:

trunk

Files:

• wp-admin/edit-form-advanced.php (modified) (1 diff)
• wp-admin/upgrade.php (modified) (1 diff)
• wp-admin/user-edit.php (modified) (1 diff)
• wp-includes/functions.php (modified) (1 diff)

trunk/wp-admin/edit-form-advanced.php

@@ -315 +315 @@
 <input type="hidden" id="post_type" name="post_type" value="<?php echo esc_attr( $post_type ) ?>" />
 <input type="hidden" id="original_post_status" name="original_post_status" value="<?php echo esc_attr( $post->post_status) ?>" />
-<input type="hidden" id="referredby" name="referredby" value="<?php echo esc_url(wp_unslash(wp_get_referer())); ?>" />
+<input type="hidden" id="referredby" name="referredby" value="<?php echo esc_url(wp_get_referer()); ?>" />
 <?php if ( ! empty( $active_post_lock ) ) { ?>
 <input type="hidden" id="active_post_lock" value="<?php echo esc_attr( implode( ':', $active_post_lock ) ); ?>" />

trunk/wp-admin/upgrade.php

@@ -78 +78 @@
 switch ( $step ) :
     case 0:
-        $goback = wp_unslash( wp_get_referer() );
+        $goback = wp_get_referer();
         $goback = esc_url_raw( $goback );
         $goback = urlencode( $goback );

trunk/wp-admin/user-edit.php

@@ -55 +55 @@
 );
 
-$wp_http_referer = remove_query_arg(array('update', 'delete_count'), stripslashes($wp_http_referer));
+$wp_http_referer = remove_query_arg(array('update', 'delete_count'), $wp_http_referer );
 
 $user_can_edit = current_user_can( 'edit_posts' ) || current_user_can( 'edit_pages' );

trunk/wp-includes/functions.php

@@ -1284 +1284 @@
 
     if ( $ref && $ref !== $_SERVER['REQUEST_URI'] )
-        return $ref;
+        return wp_unslash( $ref );
     return false;
 }