Changeset 31156

Timestamp:

01/12/2015 01:56:04 AM (6 years ago)

Author:

jeremyfelt

Message:

Update home and siteurl after path slashes are validated in update_blog_details()

When editing a site, if home and siteurl are checked to be updated along with a site's domain and path, they should receive the results of any modifications in update_blog_details() rather than trusting the POST data.

Previously, it was possible to save a value without a leading slash on the path, causing an invalid URL to be stored.

Props earnjam.

Fixes #30417.

File:

• trunk/src/wp-admin/network/site-info.php (modified) (2 diffs)

trunk/src/wp-admin/network/site-info.php

@@ -51 +51 @@
     switch_to_blog( $id );
 
-    if ( isset( $_POST['update_home_url'] ) && $_POST['update_home_url'] == 'update' ) {
-        $blog_address = esc_url_raw( $_POST['blog']['domain'] . $_POST['blog']['path'] );
-        if ( get_option( 'siteurl' ) != $blog_address )
-            update_option( 'siteurl', $blog_address );
-
-        if ( get_option( 'home' ) != $blog_address )
-            update_option( 'home', $blog_address );
-    }
-
     // Rewrite rules can't be flushed during switch to blog.
     delete_option( 'rewrite_rules' );
@@ -74 +65 @@
     }
     update_blog_details( $id, $blog_data );
+
+    if ( isset( $_POST['update_home_url'] ) && $_POST['update_home_url'] == 'update' ) {
+        $new_details = get_blog_details( $id, false );
+        $blog_address = esc_url_raw( $new_details->domain . $new_details->path );
+        if ( get_option( 'siteurl' ) != $blog_address ) {
+            update_option( 'siteurl', $blog_address );
+        }
+        if ( get_option( 'home' ) != $blog_address ) {
+            update_option( 'home', $blog_address );
+        }
+    }
 
     restore_current_blog();