Changeset 24481 for branches/3.5/wp-admin/includes/file.php

Timestamp:

06/21/2013 06:12:17 AM (12 years ago)

Author:

nacin

Message:

Better validation of the URL used in core HTTP requests.

Merges [24480] to the 3.5 branch.

Location:

branches/3.5

Files:

• . (modified) (1 prop)
• wp-admin/includes/file.php (modified) (1 diff)

branches/3.5/wp-admin/includes/file.php

@@ -498 +498 @@
         return new WP_Error('http_no_file', __('Could not create Temporary file.'));
 
-    $response = wp_remote_get( $url, array( 'timeout' => $timeout, 'stream' => true, 'filename' => $tmpfname ) );
+    $response = wp_remote_get( $url, array( 'timeout' => $timeout, 'stream' => true, 'filename' => $tmpfname, 'reject_unsafe_urls' => true ) );
 
     if ( is_wp_error( $response ) ) {