Changeset 47982 for branches/4.3/src/wp-includes/pluggable.php

Timestamp:

06/10/2020 07:03:59 PM (6 years ago)

Author:

whyisjake

Message:

General: Backport several commits for release.

• Embeds: Ensure that the title attribute is set correctly on embeds.
• Editor: Prevent HTML decoding on by setting the proper editor context.
• Formatting: Ensure that wp_validate_redirect() sanitizes a wider variety of characters.
• Themes: Ensure a broken theme name is returned properly.
• Administration: Add a new filter to extend set-screen-option.

Merges [47947-47951] to the 4.3 branch.

Props xknown, sstoqnov, vortfu, SergeyBiryukov, whyisjake.

File:

• branches/4.3/src/wp-includes/pluggable.php (modified) (2 diffs)

branches/4.3/src/wp-includes/pluggable.php

@@ -1232 +1232 @@
         )/x';
     $location = preg_replace_callback( $regex, '_wp_sanitize_utf8_in_redirect', $location );
-    $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*\[\]()]|i', '', $location);
+    $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*\[\]()@]|i', '', $location);
     $location = wp_kses_no_null($location);
 
@@ -1304 +1304 @@
  **/
 function wp_validate_redirect($location, $default = '') {
-    $location = trim( $location, " \t\n\r\0\x08\x0B" );
+    $location = wp_sanitize_redirect( trim( $location, " \t\n\r\0\x08\x0B" ) );
     // browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
     if ( substr($location, 0, 2) == '//' )