Changeset 25323 for branches/3.6

Timestamp:

09/10/2013 06:42:32 PM (11 years ago)

Author:

nacin

Message:

Validate referrers to prevent off-domain redirects. Merges [25318] to 3.6.

Location:

branches/3.6

Files:

• . (modified) (1 prop)
• wp-includes/functions.php (modified) (2 diffs)
• wp-includes/pluggable.php (modified) (1 diff)

branches/3.6/wp-includes/functions.php

@@ -1284 +1284 @@
 
     if ( $ref && $ref !== wp_unslash( $_SERVER['REQUEST_URI'] ) )
-        return wp_unslash( $ref );
+        return wp_validate_redirect( $ref, false );
     return false;
 }
@@ -1299 +1299 @@
 function wp_get_original_referer() {
     if ( !empty( $_REQUEST['_wp_original_http_referer'] ) )
-        return wp_unslash( $_REQUEST['_wp_original_http_referer'] );
+        return wp_validate_redirect( wp_unslash( $_REQUEST['_wp_original_http_referer'] ), false );
     return false;
 }

branches/3.6/wp-includes/pluggable.php

@@ -943 +943 @@
  **/
 function wp_validate_redirect($location, $default = '') {
+    $location = trim( $location );
     // browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
     if ( substr($location, 0, 2) == '//' )