WordPress.org

Make WordPress Core


Ignore:
Timestamp:
09/04/2019 05:18:16 PM (20 months ago)
Author:
SergeyBiryukov
Message:

Improve URL validation in wp_validate_redirect().

Merges [45971] to the 3.7 branch.
Props vortfu, whyisjake, peterwilsoncc.

Location:
branches/3.7
Files:
3 edited

Legend:

Unmodified
Added
Removed
  • branches/3.7

  • branches/3.7/src

  • branches/3.7/src/wp-includes/pluggable.php

    r40194 r45988  
    992992        return $default;
    993993
     994    if ( ! isset( $lp['host'] ) && ! empty( $lp['path'] ) && '/' !== $lp['path'][0] ) {
     995        $path = '';
     996        if ( ! empty( $_SERVER['REQUEST_URI'] ) ) {
     997            $path = dirname( parse_url( 'http://placeholder' . $_SERVER['REQUEST_URI'], PHP_URL_PATH ) . '?' );
     998        }
     999        $location = '/' . ltrim( $path . '/', '/' ) . $location;
     1000    }
     1001
    9941002    // Reject if certain components are set but host is not. This catches urls like https:host.com for which parse_url does not set the host field.
    9951003    if ( ! isset( $lp['host'] ) && ( isset( $lp['scheme'] ) || isset( $lp['user'] ) || isset( $lp['pass'] ) || isset( $lp['port'] ) ) ) {
Note: See TracChangeset for help on using the changeset viewer.