Changeset 31818

Timestamp:

03/18/2015 08:42:38 PM (11 years ago)

Author:

azaozz

Message:

Press This: prepend the site domain to root-relative URLs. Reject other relative URLs.
Part props stephdau, kraftbj. Fixes #31645.

File:

• trunk/src/wp-admin/includes/class-wp-press-this.php (modified) (3 diffs)

trunk/src/wp-admin/includes/class-wp-press-this.php

@@ -18 +18 @@
 
         private $embeds = array();
+
+        private $domain = '';
 
         /**
@@ -326 +328 @@
                 // Does it look like an URL?
                 if ( ! preg_match( '/^([!#$&-;=?-\[\]_a-z~]|%[0-9a-fA-F]{2})+$/', $url ) ) {
+                        return '';
+                }
+
+                // If the URL is root-relative, prepend the protocol and domain name
+                if ( $url && $this->domain && preg_match( '%^/[^/]+%', $url ) ) {
+                        $url = $this->domain . $url;
+                }
+
+                // Not absolute or protocol-relative URL.
+                if ( ! preg_match( '%^(?:https?:)?//[^/]+%', $url ) ) {
                         return '';
                 }
@@ -574 +586 @@
                         if ( 'u' === $key ) {
                                 $value = $this->_limit_url( $value );
+
+                                if ( preg_match( '%^(?:https?:)?//[^/]+%i', $value, $domain_match ) ) {
+                                        $this->domain = $domain_match[0];
+                                }
                         } else {
                                 $value = $this->_limit_string( $value );