Changeset 46472

Timestamp:

10/14/2019 10:50:41 AM (7 years ago)

Author:

SergeyBiryukov

Message:

Formatting: In wp_validate_redirect(), normalize the path when validating the location for relative URLs, to account for Windows paths.

Props peterwilsoncc, rconde, jmmathc, mat-lipe, Sixes, justinahinon, cmagrin, daxelrod, SergeyBiryukov.
Fixes #47980.

Location:

trunk

Files:

• src/wp-includes/pluggable.php (modified) (1 diff)
• tests/phpunit/tests/formatting/redirect.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -1419 +1419 @@
                         if ( ! empty( $_SERVER['REQUEST_URI'] ) ) {
                                 $path = dirname( parse_url( 'http://placeholder' . $_SERVER['REQUEST_URI'], PHP_URL_PATH ) . '?' );
+                                $path = wp_normalize_path( $path );
                         }
                         $location = '/' . ltrim( $path . '/', '/' ) . $location;

trunk/tests/phpunit/tests/formatting/redirect.php

@@ -142 +142 @@
                 );
         }
+
+        /**
+         * @ticket 47980
+         * @dataProvider relative_url_provider
+         */
+        function test_wp_validate_redirect_relative_url( $current_uri, $url, $expected ) {
+                // Backup the global.
+                $unset = false;
+                if ( ! isset( $_SERVER['REQUEST_URI'] ) ) {
+                        $unset = true;
+                } else {
+                        $backup_request_uri = $_SERVER['REQUEST_URI'];
+                }
+
+                // Set the global to current URI.
+                $_SERVER['REQUEST_URI'] = $current_uri;
+
+                $this->assertEquals( $expected, wp_validate_redirect( $url, false ) );
+
+                // Delete or reset the global as required.
+                if ( $unset ) {
+                        unset( $_SERVER['REQUEST_URI'] );
+                } else {
+                        $_SERVER['REQUEST_URI'] = $backup_request_uri;
+                }
+        }
+
+        /**
+         * Data provider for test_wp_validate_redirect_relative_url.
+         *
+         * @return array[] {
+         *      string Current URI (i.e. path and query string only).
+         *      string Redirect requested.
+         *      string Expected destination.
+         * }
+         */
+        function relative_url_provider() {
+                return array(
+                        array(
+                                '/',
+                                'wp-login.php?loggedout=true',
+                                '/wp-login.php?loggedout=true',
+                        ),
+                        array(
+                                '/src/',
+                                'wp-login.php?loggedout=true',
+                                '/src/wp-login.php?loggedout=true',
+                        ),
+                        array(
+                                '/wp-admin/settings.php?page=my-plugin',
+                                './settings.php?page=my-plugin',
+                                '/wp-admin/./settings.php?page=my-plugin',
+                        ),
+                        array(
+                                '/wp-admin/settings.php?page=my-plugin',
+                                '/wp-login.php',
+                                '/wp-login.php',
+                        ),
+                        array(
+                                '/wp-admin/settings.php?page=my-plugin',
+                                '../wp-admin/admin.php?page=my-plugin',
+                                '/wp-admin/../wp-admin/admin.php?page=my-plugin',
+                        ),
+                        array(
+                                '/2019/10/13/my-post',
+                                '../../',
+                                '/2019/10/13/../../',
+                        ),
+                        array(
+                                '/2019/10/13/my-post',
+                                '/',
+                                '/',
+                        ),
+                );
+        }
 }