Changeset 33707

Timestamp:

08/22/2015 05:04:17 PM (9 years ago)

Author:

wonderboymusic

Message:

In wp_sanitize_redirect(), don't eat @ characters. According to RFC 3986, "@" is a perfectly valid character in a URL path or query string.

Adds unit test.

Props markjaquith.
Fixes #18818.

Location:

trunk

Files:

• src/wp-includes/pluggable.php (modified) (1 diff)
• tests/phpunit/tests/formatting/redirect.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -1233 +1233 @@
         )/x';
     $location = preg_replace_callback( $regex, '_wp_sanitize_utf8_in_redirect', $location );
-    $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*\[\]()]|i', '', $location);
+    $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*\[\]()@]|i', '', $location);
     $location = wp_kses_no_null($location);
 

trunk/tests/phpunit/tests/formatting/redirect.php

@@ -19 +19 @@
         $this->assertEquals('http://[2606:2800:220:6d:26bf:1447:aa7]/', wp_sanitize_redirect('http://[2606:2800:220:6d:26bf:1447:aa7]/'));
         $this->assertEquals('http://example.com/search.php?search=(amistillhere)', wp_sanitize_redirect('http://example.com/search.php?search=(amistillhere)'));
+        $this->assertEquals('http://example.com/@username', wp_sanitize_redirect('http://example.com/@username'));
     }
 }