Changeset 47963 for branches/5.1/src/wp-includes/pluggable.php

Timestamp:

06/10/2020 06:18:25 PM (5 years ago)

Author:

desrosj

Message:

General: Backport several commits for release.

• Embeds: Ensure that the title attribute is set correctly on embeds.
• Editor: Prevent HTML decoding on by setting the proper editor context.
• Formatting: Ensure that wp_validate_redirect() sanitizes a wider variety of characters.
• Themes: Ensure a broken theme name is returned properly.
• Administration: Add a new filter to extend set-screen-option.

Merges [47947-47951] to the 5.1 branch.
Props xknown, sstoqnov, vortfu, SergeyBiryukov, whyisjake.

Location:

branches/5.1

Files:

• . (modified) (1 prop)
• src/wp-includes/pluggable.php (modified) (1 diff)

branches/5.1/src/wp-includes/pluggable.php

@@ -1375 +1375 @@
      */
     function wp_validate_redirect( $location, $default = '' ) {
-        $location = trim( $location, " \t\n\r\0\x08\x0B" );
-        // browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
-        if ( substr( $location, 0, 2 ) == '//' ) {
+        $location = wp_sanitize_redirect( trim( $location, " \t\n\r\0\x08\x0B" ) );
+        // Browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'.
+        if ( '//' === substr( $location, 0, 2 ) ) {
             $location = 'http:' . $location;
         }