Changeset 36266 for trunk/src/wp-includes/functions.php

Timestamp:

01/12/2016 08:31:10 AM (9 years ago)

Author:

swissspidy

Message:

Introduce wp_get_raw_referer() to retrieve unvalidated referer.

For things like redirects wp_get_referer() should be used instead.

Props voldemortensen for initial patch.
Fixes #27152.

File:

• trunk/src/wp-includes/functions.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -1518 +1518 @@
  */
 function wp_get_referer() {
-    if ( ! function_exists( 'wp_validate_redirect' ) )
+    if ( ! function_exists( 'wp_validate_redirect' ) ) {
         return false;
-    $ref = false;
-    if ( ! empty( $_REQUEST['_wp_http_referer'] ) )
-        $ref = wp_unslash( $_REQUEST['_wp_http_referer'] );
-    elseif ( ! empty( $_SERVER['HTTP_REFERER'] ) )
-        $ref = wp_unslash( $_SERVER['HTTP_REFERER'] );
+    }
+
+    $ref = wp_get_raw_referer();
 
     if ( $ref && $ref !== wp_unslash( $_SERVER['REQUEST_URI'] ) && $ref !== home_url() . wp_unslash( $_SERVER['REQUEST_URI'] ) ) {
         return wp_validate_redirect( $ref, false );
+    }
+
+    return false;
+}
+
+/**
+ * Retrieve unvalidated referer from '_wp_http_referer' or HTTP referer.
+ *
+ * Do not use for redirects, use wp_get_referer() instead.
+ *
+ * @since 4.5.0
+ *
+ * @return string|bool Referer URL on success, false on failure.
+ */
+function wp_get_raw_referer() {
+    if ( ! empty( $_REQUEST['_wp_http_referer'] ) ) {
+        return wp_unslash( $_REQUEST['_wp_http_referer'] );
+    } else if ( ! empty( $_SERVER['HTTP_REFERER'] ) ) {
+        return wp_unslash( $_SERVER['HTTP_REFERER'] );
     }