Changeset 41741 for trunk/src/wp-admin/includes/admin-filters.php

Timestamp:

10/04/2017 06:24:17 PM (7 years ago)

Author:

johnbillion

Message:

Security: Add a referrer policy header to the admin and login screens.

This sets a referrer policy of same-origin which adds hardening by preventing a referrer being sent from the admin area or login screens to other origins. This helps prevent unwanted exposure of potentially sensitive information that may be contained within URLs.

This change introduces a new filter, admin_referrer_policy, for filtering the referrer policy header value. The header can be disabled if necessary by removing the wp_admin_headers action from the admin_init and login_init hooks.

Props joostdevalk
Fixes #42036

File:

• trunk/src/wp-admin/includes/admin-filters.php (modified) (1 diff)

trunk/src/wp-admin/includes/admin-filters.php

@@ -39 +39 @@
 
 // Misc hooks.
+add_action( 'admin_init', 'wp_admin_headers'         );
+add_action( 'login_init', 'wp_admin_headers'         );
 add_action( 'admin_head', 'wp_admin_canonical_url'   );
 add_action( 'admin_head', 'wp_color_scheme_settings' );