Changeset 37777

Timestamp:

06/21/2016 02:19:01 PM (7 years ago)

Author:

ocean90

Message:

Customize: Make sure that preview and return URLs are URLs.

Merge of [37527] to the 3.9 branch.

File:

• branches/3.9/src/wp-admin/customize.php (modified) (1 diff)

branches/3.9/src/wp-admin/customize.php

@@ -18 +18 @@
 wp_reset_vars( array( 'url', 'return' ) );
 $url = urldecode( $url );
+$url = esc_url_raw( $url );
 $url = wp_validate_redirect( $url, home_url( '/' ) );
 if ( $return )
-    $return = wp_validate_redirect( urldecode( $return ) );
+    $return = wp_validate_redirect( esc_url_raw( urldecode( $return ) ) );
 if ( ! $return )
     $return = $url;