Changeset 24481 for branches/3.5/wp-includes/class-oembed.php

Timestamp:

06/21/2013 06:12:17 AM (11 years ago)

Author:

nacin

Message:

Better validation of the URL used in core HTTP requests.

Merges [24480] to the 3.5 branch.

Location:

branches/3.5

Files:

• . (modified) (1 prop)
• wp-includes/class-oembed.php (modified) (2 diffs)

branches/3.5/wp-includes/class-oembed.php

@@ -109 +109 @@
 
         // Fetch URL content
-        if ( $html = wp_remote_retrieve_body( wp_remote_get( $url ) ) ) {
+        if ( $html = wp_remote_retrieve_body( wp_remote_get( $url, array( 'reject_unsafe_urls' => true ) ) ) ) {
 
             // <link> types that contain oEmbed provider URLs
@@ -191 +191 @@
     function _fetch_with_format( $provider_url_with_args, $format ) {
         $provider_url_with_args = add_query_arg( 'format', $format, $provider_url_with_args );
-        $response = wp_remote_get( $provider_url_with_args );
+        $response = wp_remote_get( $provider_url_with_args, array( 'reject_unsafe_urls' => true ) );
         if ( 501 == wp_remote_retrieve_response_code( $response ) )
             return new WP_Error( 'not-implemented' );