Changeset 30443

Timestamp:

11/20/2014 02:00:26 PM (12 years ago)

Author:

nacin

Message:

Better validation of the URL used in core HTTP requests.

File:

• trunk/src/wp-includes/http.php (modified) (3 diffs)

trunk/src/wp-includes/http.php

@@ -445 +445 @@
  */
 function wp_http_validate_url( $url ) {
+        $original_url = $url;
         $url = wp_kses_bad_protocol( $url, array( 'http', 'https' ) );
-        if ( ! $url )
+        if ( ! $url || strtolower( $url ) !== strtolower( $original_url ) )
                 return false;
 
@@ -456 +457 @@
                 return false;
 
-        if ( false !== strpos( $parsed_url['host'], ':' ) )
+        if ( false !== strpbrk( $parsed_url['host'], ':#?[]' ) )
                 return false;
 
@@ -474 +475 @@
                 if ( $ip ) {
                         $parts = array_map( 'intval', explode( '.', $ip ) );
-                        if ( '127.0.0.1' === $ip
-                                || ( 10 === $parts[0] )
+                        if ( 127 === $parts[0] || 10 === $parts[0]
                                 || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
                                 || ( 192 === $parts[0] && 168 === $parts[1] )