Make WordPress Core


Ignore:
Timestamp:
06/10/2020 06:25:17 PM (4 years ago)
Author:
whyisjake
Message:

General: Backport several commits for release.

  • Embeds: Ensure that the title attribute is set correctly on embeds.
  • Editor: Prevent HTML decoding on by setting the proper editor context.
  • Formatting: Ensure that wp_validate_redirect() sanitizes a wider variety of characters.
  • Themes: Ensure a broken theme name is returned properly.
  • Administration: Add a new filter to extend set-screen-option.

Merges [47947-47951] to the 3.9 branch.
Props xknown, sstoqnov, vortfu, SergeyBiryukov, whyisjake.

Location:
branches/3.9
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/3.9

  • branches/3.9/src/wp-includes/pluggable.php

    r46503 r47966  
    11391139 **/
    11401140function wp_sanitize_redirect($location) {
    1141     $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!]|i', '', $location);
     1141    $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!@]|i', '', $location);
    11421142    $location = wp_kses_no_null($location);
    11431143
     
    11951195 **/
    11961196function wp_validate_redirect($location, $default = '') {
    1197     $location = trim( $location, " \t\n\r\0\x08\x0B" );
     1197    $location = wp_sanitize_redirect( trim( $location, " \t\n\r\0\x08\x0B" ) );
    11981198    // browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
    11991199    if ( substr($location, 0, 2) == '//' )
Note: See TracChangeset for help on using the changeset viewer.