Changeset 46641 for trunk/src/wp-includes/pluggable.php

Timestamp:

11/03/2019 10:08:56 PM (5 years ago)

Author:

jorbin

Message:

General: wp_safe_redirect() and wp_redirect() shouldn't allow non-3xx status codes

Redirects should use redirect status codes and if you attempt to call wp_safe_redirect or wp_redirect with a non redirect status it can lead to undesired behavior and head scratching.

Fixes #44317.
Props spenserhale, johnbillion, mjnewman for initial patch.

File:

• trunk/src/wp-includes/pluggable.php (modified) (2 diffs)

trunk/src/wp-includes/pluggable.php

@@ -1216 +1216 @@
      * @since 1.5.1
      * @since 5.1.0 The `$x_redirect_by` parameter was added.
+     * @since 5.4.0 On invalid status codes, wp_die() is called.
      *
      * @global bool $is_IIS
@@ -1249 +1250 @@
         if ( ! $location ) {
             return false;
+        }
+
+        if ( 300 > $status || 399 < $status ) {
+            wp_die( __( 'HTTP redirect status code must be a redirection code, 3xx.' ) );
         }