WordPress.org

Make WordPress Core

Changeset 45972


Ignore:
Timestamp:
09/04/2019 04:57:35 PM (2 months ago)
Author:
SergeyBiryukov
Message:

Improve URL validation in wp_validate_redirect().

Merges [45971] to the 5.2 branch.
Props vortfu, whyisjake, peterwilsoncc.

Location:
branches/5.2
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/5.2

  • branches/5.2/src/wp-includes/pluggable.php

    r45204 r45972  
    13951395        if ( isset( $lp['scheme'] ) && ! ( 'http' == $lp['scheme'] || 'https' == $lp['scheme'] ) ) {
    13961396            return $default;
     1397        }
     1398
     1399        if ( ! isset( $lp['host'] ) && ! empty( $lp['path'] ) && '/' !== $lp['path'][0] ) {
     1400            $path = '';
     1401            if ( ! empty( $_SERVER['REQUEST_URI'] ) ) {
     1402                $path = dirname( parse_url( 'http://placeholder' . $_SERVER['REQUEST_URI'], PHP_URL_PATH ) . '?' );
     1403            }
     1404            $location = '/' . ltrim( $path . '/', '/' ) . $location;
    13971405        }
    13981406
Note: See TracChangeset for help on using the changeset viewer.