Changeset 33707 for trunk/src/wp-includes/pluggable.php

Timestamp:

08/22/2015 05:04:17 PM (9 years ago)

Author:

wonderboymusic

Message:

In wp_sanitize_redirect(), don't eat @ characters. According to RFC 3986, "@" is a perfectly valid character in a URL path or query string.

Adds unit test.

Props markjaquith.
Fixes #18818.

File:

• trunk/src/wp-includes/pluggable.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -1233 +1233 @@
         )/x';
     $location = preg_replace_callback( $regex, '_wp_sanitize_utf8_in_redirect', $location );
-    $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*\[\]()]|i', '', $location);
+    $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*\[\]()@]|i', '', $location);
     $location = wp_kses_no_null($location);