Changeset 37775 for branches/4.0/src/wp-admin/customize.php

Timestamp:

06/21/2016 02:18:28 PM (8 years ago)

Author:

ocean90

Message:

Customize: Make sure that preview and return URLs are URLs.

Merge of [37527] to the 4.0 branch.

File:

• branches/4.0/src/wp-admin/customize.php (modified) (1 diff)

branches/4.0/src/wp-admin/customize.php

@@ -19 +19 @@
 wp_reset_vars( array( 'url', 'return' ) );
 $url = wp_unslash( $url );
+$url = esc_url_raw( $url );
 $url = wp_validate_redirect( $url, home_url( '/' ) );
 if ( $return ) {
     $return = wp_unslash( $return );
+    $return = esc_url_raw( $return );
     $return = wp_validate_redirect( $return );
 }