Changeset 46641

Timestamp:

11/03/2019 10:08:56 PM (7 years ago)

Author:

jorbin

Message:

General: wp_safe_redirect() and wp_redirect() shouldn't allow non-3xx status codes

Redirects should use redirect status codes and if you attempt to call wp_safe_redirect or wp_redirect with a non redirect status it can lead to undesired behavior and head scratching.

Fixes #44317.
Props spenserhale, johnbillion, mjnewman for initial patch.

Location:

trunk

Files:

• src/wp-includes/pluggable.php (modified) (2 diffs)
• tests/phpunit/tests/pluggable.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -1216 +1216 @@
          * @since 1.5.1
          * @since 5.1.0 The `$x_redirect_by` parameter was added.
+         * @since 5.4.0 On invalid status codes, wp_die() is called.
          *
          * @global bool $is_IIS
@@ -1249 +1250 @@
                 if ( ! $location ) {
                         return false;
+                }
+
+                if ( 300 > $status || 399 < $status ) {
+                        wp_die( __( 'HTTP redirect status code must be a redirection code, 3xx.' ) );
                 }
 

trunk/tests/phpunit/tests/pluggable.php

@@ -5 +5 @@
  */
 class Tests_Pluggable extends WP_UnitTestCase {
+
+        /**
+         * @dataProvider get_good_status_codes
+         *
+         * @ticket 44317
+         * @param string $location The path or URL to redirect to.
+         * @param int $status HTTP response status code to use.
+         */
+        public function test_wp_redirect_good_status_code( $location, $status ) {
+                $this->assertTrue( wp_redirect( $location, $status ) );
+        }
+
+        public function get_good_status_codes() {
+                return [
+                        // Expected Statuses
+                        [ '/wp-admin', 301 ],
+                        [ '/wp-admin', 302 ],
+                        [ '/wp-admin', 307 ],
+                        // Outliers that are valid
+                        [ '/wp-admin', 300 ],
+                        [ '/wp-admin', 399 ],
+                ];
+        }
+
+        /**
+         * @expectedException WPDieException
+         * @dataProvider get_bad_status_codes
+         *
+         * @ticket 44317
+         * @param string $location The path or URL to redirect to.
+         * @param int $status HTTP response status code to use.
+         */
+        public function test_wp_redirect_bad_status_code( $location, $status ) {
+                wp_redirect( $location, $status );
+        }
+
+        public function get_bad_status_codes() {
+                return [
+                        // Tests for bad arguments
+                        [ '/wp-admin', 404 ],
+                        [ '/wp-admin', 410 ],
+                        [ '/wp-admin', 500 ],
+                        // Tests for condition.
+                        [ '/wp-admin', 299 ],
+                        [ '/wp-admin', 400 ],
+                ];
+        }
 
         /**