Changeset 40331 for branches/4.7/src/wp-admin/includes/theme.php

Timestamp:

03/25/2017 01:34:27 PM (9 years ago)

Author:

swissspidy

Message:

Customize: Prevent links to customize.php from being generated which have query vars from wp_removable_query_args() present.

Props dlh.
See #23367, #32692.
Fixes #31850.

Merges [40313] to the 4.7 branch.

Location:

branches/4.7

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/theme.php (modified) (1 diff)

branches/4.7/src/wp-admin/includes/theme.php

@@ -579 +579 @@
             $customize_action = esc_url( add_query_arg(
                 array(
-                    'return' => urlencode( esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) ),
+                    'return' => urlencode( esc_url_raw( remove_query_arg( wp_removable_query_args(), wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) ),
                 ),
                 wp_customize_url( $slug )