Changeset 23578 for trunk/wp-includes/functions.php

Timestamp:

03/01/2013 05:58:43 PM (12 years ago)

Author:

nacin

Message:

Ensure the referer functions operate completely on unslashed data: wp_referer_field(), wp_original_referer_field(), wp_get_referer(), wp_get_original_referer().

Use wp_slash() instead of addslashes().

see #21767.

File:

• trunk/wp-includes/functions.php (modified) (5 diffs)

trunk/wp-includes/functions.php

@@ -1234 +1234 @@
  */
 function wp_referer_field( $echo = true ) {
-    $ref = esc_attr( $_SERVER['REQUEST_URI'] );
-    $referer_field = '<input type="hidden" name="_wp_http_referer" value="'. $ref . '" />';
+    $referer_field = '<input type="hidden" name="_wp_http_referer" value="'. esc_attr( wp_unslash( $_SERVER['REQUEST_URI'] ) ) . '" />';
 
     if ( $echo )
@@ -1258 +1257 @@
  */
 function wp_original_referer_field( $echo = true, $jump_back_to = 'current' ) {
-    $jump_back_to = ( 'previous' == $jump_back_to ) ? wp_get_referer() : $_SERVER['REQUEST_URI'];
-    $ref = ( wp_get_original_referer() ) ? wp_get_original_referer() : $jump_back_to;
-    $orig_referer_field = '<input type="hidden" name="_wp_original_http_referer" value="' . esc_attr( stripslashes( $ref ) ) . '" />';
+    if ( ! $ref = wp_get_original_referer() ) {
+        $ref = 'previous' == $jump_back_to ? wp_get_referer() : wp_unslash( $_SERVER['REQUEST_URI'] );
+    }
+    $orig_referer_field = '<input type="hidden" name="_wp_original_http_referer" value="' . esc_attr( $ref ) . '" />';
     if ( $echo )
         echo $orig_referer_field;
@@ -1279 +1279 @@
     $ref = false;
     if ( ! empty( $_REQUEST['_wp_http_referer'] ) )
-        $ref = $_REQUEST['_wp_http_referer'];
+        $ref = wp_unslash( $_REQUEST['_wp_http_referer'] );
     else if ( ! empty( $_SERVER['HTTP_REFERER'] ) )
-        $ref = $_SERVER['HTTP_REFERER'];
-
-    if ( $ref && $ref !== $_SERVER['REQUEST_URI'] )
+        $ref = wp_unslash( $_SERVER['HTTP_REFERER'] );
+
+    if ( $ref && $ref !== wp_unslash( $_SERVER['REQUEST_URI'] ) )
         return wp_unslash( $ref );
     return false;
@@ -1299 +1299 @@
 function wp_get_original_referer() {
     if ( !empty( $_REQUEST['_wp_original_http_referer'] ) )
-        return $_REQUEST['_wp_original_http_referer'];
+        return wp_unslash( $_REQUEST['_wp_original_http_referer'] );
     return false;
 }
@@ -3907 +3907 @@
 /**
  * Output the JS that shows the wp-login iframe when the user is no longer logged in
- */ 
+ */
 function wp_auth_check_js() {
     ?>