WordPress.org

Make WordPress Core


Ignore:
Timestamp:
01/12/2016 08:31:10 AM (6 years ago)
Author:
swissspidy
Message:

Introduce wp_get_raw_referer() to retrieve unvalidated referer.

For things like redirects wp_get_referer() should be used instead.

Props voldemortensen for initial patch.
Fixes #27152.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/functions.php

    r36242 r36266  
    15181518 */
    15191519function wp_get_referer() {
    1520     if ( ! function_exists( 'wp_validate_redirect' ) )
     1520    if ( ! function_exists( 'wp_validate_redirect' ) ) {
    15211521        return false;
    1522     $ref = false;
    1523     if ( ! empty( $_REQUEST['_wp_http_referer'] ) )
    1524         $ref = wp_unslash( $_REQUEST['_wp_http_referer'] );
    1525     elseif ( ! empty( $_SERVER['HTTP_REFERER'] ) )
    1526         $ref = wp_unslash( $_SERVER['HTTP_REFERER'] );
     1522    }
     1523
     1524    $ref = wp_get_raw_referer();
    15271525
    15281526    if ( $ref && $ref !== wp_unslash( $_SERVER['REQUEST_URI'] ) && $ref !== home_url() . wp_unslash( $_SERVER['REQUEST_URI'] ) ) {
    15291527        return wp_validate_redirect( $ref, false );
     1528    }
     1529
     1530    return false;
     1531}
     1532
     1533/**
     1534 * Retrieve unvalidated referer from '_wp_http_referer' or HTTP referer.
     1535 *
     1536 * Do not use for redirects, use wp_get_referer() instead.
     1537 *
     1538 * @since 4.5.0
     1539 *
     1540 * @return string|bool Referer URL on success, false on failure.
     1541 */
     1542function wp_get_raw_referer() {
     1543    if ( ! empty( $_REQUEST['_wp_http_referer'] ) ) {
     1544        return wp_unslash( $_REQUEST['_wp_http_referer'] );
     1545    } else if ( ! empty( $_SERVER['HTTP_REFERER'] ) ) {
     1546        return wp_unslash( $_SERVER['HTTP_REFERER'] );
    15301547    }
    15311548
Note: See TracChangeset for help on using the changeset viewer.