Changeset 24480 for trunk/wp-includes/class-oembed.php

Timestamp:

06/21/2013 06:07:47 AM (11 years ago)

Author:

nacin

Message:

Better validation of the URL used in core HTTP requests.

File:

• trunk/wp-includes/class-oembed.php (modified) (2 diffs)

trunk/wp-includes/class-oembed.php

@@ -114 +114 @@
 
         // Fetch URL content
-        if ( $html = wp_remote_retrieve_body( wp_remote_get( $url ) ) ) {
+        if ( $html = wp_remote_retrieve_body( wp_remote_get( $url, array( 'reject_unsafe_urls' => true ) ) ) ) {
 
             // <link> types that contain oEmbed provider URLs
@@ -196 +196 @@
     function _fetch_with_format( $provider_url_with_args, $format ) {
         $provider_url_with_args = add_query_arg( 'format', $format, $provider_url_with_args );
-        $response = wp_remote_get( $provider_url_with_args );
+        $response = wp_remote_get( $provider_url_with_args, array( 'reject_unsafe_urls' => true ) );
         if ( 501 == wp_remote_retrieve_response_code( $response ) )
             return new WP_Error( 'not-implemented' );