Changeset 37780

Timestamp:

06/21/2016 02:19:42 PM (4 years ago)

Author:

ocean90

Message:

Customize: Make sure that preview and return URLs are URLs.

Merge of [37527] to the 3.7 branch.

File:

• branches/3.7/src/wp-admin/customize.php (modified) (1 diff)

branches/3.7/src/wp-admin/customize.php

@@ -16 +16 @@
 wp_reset_vars( array( 'url', 'return' ) );
 $url = urldecode( $url );
+$url = esc_url_raw( $url );
 $url = wp_validate_redirect( $url, home_url( '/' ) );
 if ( $return )
-    $return = wp_validate_redirect( urldecode( $return ) );
+    $return = wp_validate_redirect( esc_url_raw( urldecode( $return ) ) );
 if ( ! $return )
     $return = $url;