Changeset 36266

Timestamp:

01/12/2016 08:31:10 AM (9 years ago)

Author:

swissspidy

Message:

Introduce wp_get_raw_referer() to retrieve unvalidated referer.

For things like redirects wp_get_referer() should be used instead.

Props voldemortensen for initial patch.
Fixes #27152.

Location:

trunk

Files:

• src/wp-includes/functions.php (modified) (1 diff)
• tests/phpunit/tests/functions/referer.php (modified) (3 diffs)

trunk/src/wp-includes/functions.php

@@ -1518 +1518 @@
  */
 function wp_get_referer() {
-    if ( ! function_exists( 'wp_validate_redirect' ) )
+    if ( ! function_exists( 'wp_validate_redirect' ) ) {
         return false;
-    $ref = false;
-    if ( ! empty( $_REQUEST['_wp_http_referer'] ) )
-        $ref = wp_unslash( $_REQUEST['_wp_http_referer'] );
-    elseif ( ! empty( $_SERVER['HTTP_REFERER'] ) )
-        $ref = wp_unslash( $_SERVER['HTTP_REFERER'] );
+    }
+
+    $ref = wp_get_raw_referer();
 
     if ( $ref && $ref !== wp_unslash( $_SERVER['REQUEST_URI'] ) && $ref !== home_url() . wp_unslash( $_SERVER['REQUEST_URI'] ) ) {
         return wp_validate_redirect( $ref, false );
+    }
+
+    return false;
+}
+
+/**
+ * Retrieve unvalidated referer from '_wp_http_referer' or HTTP referer.
+ *
+ * Do not use for redirects, use wp_get_referer() instead.
+ *
+ * @since 4.5.0
+ *
+ * @return string|bool Referer URL on success, false on failure.
+ */
+function wp_get_raw_referer() {
+    if ( ! empty( $_REQUEST['_wp_http_referer'] ) ) {
+        return wp_unslash( $_REQUEST['_wp_http_referer'] );
+    } else if ( ! empty( $_SERVER['HTTP_REFERER'] ) ) {
+        return wp_unslash( $_SERVER['HTTP_REFERER'] );
     }
 

trunk/tests/phpunit/tests/functions/referer.php

@@ -7 +7 @@
  */
 class Tests_Functions_Referer extends WP_UnitTestCase {
-    private $request = array();
-    private $server = array();
-
     public function setUp() {
         parent::setUp();
 
-        $this->server  = $_SERVER;
-        $this->request = $_REQUEST;
+        $_SERVER['HTTP_REFERER']      = '';
+        $_SERVER['REQUEST_URI']       = '';
+        $_REQUEST['_wp_http_referer'] = '';
     }
 
@@ -20 +18 @@
         parent::tearDown();
 
-        $_SERVER  = $this->server;
-        $_REQUEST = $this->request;
+        $_SERVER['HTTP_REFERER']      = '';
+        $_SERVER['REQUEST_URI']       = '';
+        $_REQUEST['_wp_http_referer'] = '';
     }
 
@@ -123 +122 @@
         remove_filter( 'allowed_redirect_hosts', array( $this, 'filter_allowed_redirect_hosts' ) );
     }
+
+    /**
+     * @ticket 27152
+     */
+    public function test_raw_referer_empty(  ) {
+        $this->assertFalse( wp_get_raw_referer() );
+    }
+
+    /**
+     * @ticket 27152
+     */
+    public function test_raw_referer(  ) {
+        $_SERVER['HTTP_REFERER'] = addslashes( 'http://example.com/foo?bar' );
+        $this->assertSame( 'http://example.com/foo?bar', wp_get_raw_referer() );
+    }
+
+    /**
+     * @ticket 27152
+     */
+    public function test_raw_referer_from_request(  ) {
+        $_REQUEST['_wp_http_referer'] = addslashes( 'http://foo.bar/baz' );
+        $this->assertSame( 'http://foo.bar/baz', wp_get_raw_referer() );
+    }
+
+    /**
+     * @ticket 27152
+     */
+    public function test_raw_referer_both(  ) {
+        $_SERVER['HTTP_REFERER'] = addslashes( 'http://example.com/foo?bar' );
+        $_REQUEST['_wp_http_referer'] = addslashes( 'http://foo.bar/baz' );
+        $this->assertSame( 'http://foo.bar/baz', wp_get_raw_referer() );
+    }
 }