Changeset 34920 for trunk/src/wp-includes/formatting.php

Timestamp:

10/07/2015 11:38:22 PM (9 years ago)

Author:

johnbillion

Message:

Avoid stripping square brackets from URLs, and instead correctly encode them. Square brackets must be encoded in the path, path parameters, query parameters, and fragment, but must not be encoded in anything up to the domain and port.

Adds tests.

Fixes #16859

File:

• trunk/src/wp-includes/formatting.php (modified) (5 diffs)

trunk/src/wp-includes/formatting.php

@@ -2138 +2138 @@
     $dest = $matches[2];
     $dest = 'http://' . $dest;
-    $dest = esc_url($dest);
-    if ( empty($dest) )
-        return $matches[0];
 
     // removed trailing [.,;:)] from URL
@@ -2147 +2144 @@
         $dest = substr($dest, 0, strlen($dest)-1);
     }
+
+    $dest = esc_url($dest);
+    if ( empty($dest) )
+        return $matches[0];
+
     return $matches[1] . "<a href=\"$dest\" rel=\"nofollow\">$dest</a>$ret";
 }
@@ -3353 +3355 @@
 
     $url = str_replace( ' ', '%20', $url );
-    $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url);
+    $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\\x80-\\xff]|i', '', $url);
 
     if ( '' === $url ) {
@@ -3366 +3368 @@
     $url = str_replace(';//', '://', $url);
     /* If the URL doesn't appear to contain a scheme, we
-     * presume it needs http:// appended (unless a relative
+     * presume it needs http:// prepended (unless a relative
      * link starting with /, # or ? or a php file).
      */
@@ -3378 +3380 @@
         $url = str_replace( '&amp;', '&#038;', $url );
         $url = str_replace( "'", '&#039;', $url );
+    }
+
+    if ( ( false !== strpos( $url, '[' ) ) || ( false !== strpos( $url, ']' ) ) ) {
+
+        $parsed = parse_url( $url );
+        $front  = '';
+
+        if ( isset( $parsed['scheme'] ) ) {
+            $front .= $parsed['scheme'] . '://';
+        } elseif ( '/' === $url[0] ) {
+            $front .= '//';
+        }
+
+        if ( isset( $parsed['user'] ) ) {
+            $front .= $parsed['user'];
+        }
+
+        if ( isset( $parsed['pass'] ) ) {
+            $front .= ':' . $parsed['pass'];
+        }
+
+        if ( isset( $parsed['user'] ) || isset( $parsed['pass'] ) ) {
+            $front .= '@';
+        }
+
+        if ( isset( $parsed['host'] ) ) {
+            $front .= $parsed['host'];
+        }
+
+        if ( isset( $parsed['port'] ) ) {
+            $front .= ':' . $parsed['port'];
+        }
+
+        $end_dirty = str_replace( $front, '', $url );
+        $end_clean = str_replace( array( '[', ']' ), array( '%5B', '%5D' ), $end_dirty );
+        $url       = str_replace( $end_dirty, $end_clean, $url );
+
     }