Changeset 31156 for trunk/src/wp-admin/network/site-info.php

Timestamp:

01/12/2015 01:56:04 AM (12 years ago)

Author:

jeremyfelt

Message:

Update home and siteurl after path slashes are validated in update_blog_details()

When editing a site, if home and siteurl are checked to be updated along with a site's domain and path, they should receive the results of any modifications in update_blog_details() rather than trusting the POST data.

Previously, it was possible to save a value without a leading slash on the path, causing an invalid URL to be stored.

Props earnjam.

Fixes #30417.

File:

• trunk/src/wp-admin/network/site-info.php (modified) (2 diffs)

trunk/src/wp-admin/network/site-info.php

@@ -51 +51 @@
         switch_to_blog( $id );
 
-        if ( isset( $_POST['update_home_url'] ) && $_POST['update_home_url'] == 'update' ) {
-                $blog_address = esc_url_raw( $_POST['blog']['domain'] . $_POST['blog']['path'] );
-                if ( get_option( 'siteurl' ) != $blog_address )
-                        update_option( 'siteurl', $blog_address );
-
-                if ( get_option( 'home' ) != $blog_address )
-                        update_option( 'home', $blog_address );
-        }
-
         // Rewrite rules can't be flushed during switch to blog.
         delete_option( 'rewrite_rules' );
@@ -74 +65 @@
         }
         update_blog_details( $id, $blog_data );
+
+        if ( isset( $_POST['update_home_url'] ) && $_POST['update_home_url'] == 'update' ) {
+                $new_details = get_blog_details( $id, false );
+                $blog_address = esc_url_raw( $new_details->domain . $new_details->path );
+                if ( get_option( 'siteurl' ) != $blog_address ) {
+                        update_option( 'siteurl', $blog_address );
+                }
+                if ( get_option( 'home' ) != $blog_address ) {
+                        update_option( 'home', $blog_address );
+                }
+        }
 
         restore_current_blog();