Changeset 24481 for branches/3.5/wp-includes/class-feed.php

Timestamp:

06/21/2013 06:12:17 AM (11 years ago)

Author:

nacin

Message:

Better validation of the URL used in core HTTP requests.

Merges [24480] to the 3.5 branch.

Location:

branches/3.5

Files:

• . (modified) (1 prop)
• wp-includes/class-feed.php (modified) (2 diffs)

branches/3.5/wp-includes/class-feed.php

@@ -67 +67 @@
 
         if ( preg_match('/^http(s)?:\/\//i', $url) ) {
-            $args = array( 'timeout' => $this->timeout, 'redirection' => $this->redirects);
+            $args = array(
+                'timeout' => $this->timeout,
+                'redirection' => $this->redirects,
+                'reject_unsafe_urls' => true,
+            );
 
             if ( !empty($this->headers) )
@@ -86 +90 @@
             }
         } else {
-            if ( ! file_exists($url) || ( ! $this->body = file_get_contents($url) ) ) {
-                $this->error = 'file_get_contents could not read the file';
-                $this->success = false;
-            }
+            $this->error = '';
+            $this->success = false;
         }
     }