Changeset 24481 for branches/3.5/wp-includes/class-http.php

Timestamp:

06/21/2013 06:12:17 AM (12 years ago)

Author:

nacin

Message:

Better validation of the URL used in core HTTP requests.

Merges [24480] to the 3.5 branch.

Location:

branches/3.5

Files:

• . (modified) (1 prop)
• wp-includes/class-http.php (modified) (3 diffs)

branches/3.5/wp-includes/class-http.php

@@ -87 +87 @@
             'redirection' => apply_filters( 'http_request_redirection_count', 5),
             'httpversion' => apply_filters( 'http_request_version', '1.0'),
-            'user-agent' => apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' )  ),
+            'user-agent' => apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' ) ),
+            'reject_unsafe_urls' => apply_filters( 'http_request_reject_unsafe_urls', false ),
             'blocking' => true,
             'headers' => array(),
@@ -117 +118 @@
             return $pre;
 
-        $arrURL = parse_url( $url );
+        if ( $r['reject_unsafe_urls'] )
+            $url = wp_http_validate_url( $url );
+        $url = wp_kses_bad_protocol( $url, array( 'http', 'https', 'ssl' ) );
+
+        $arrURL = @parse_url( $url );
 
         if ( empty( $url ) || empty( $arrURL['scheme'] ) )
@@ -1089 +1094 @@
         // bug #17490 with redirected POST requests, so handle redirections outside Curl.
         curl_setopt( $handle, CURLOPT_FOLLOWLOCATION, false );
+        if ( defined( 'CURLOPT_PROTOCOLS' ) ) // PHP 5.2.10 / cURL 7.19.4
+            curl_setopt( $handle, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS );
 
         switch ( $r['method'] ) {