Changeset 54449

Timestamp:

10/10/2022 06:57:44 PM (4 years ago)

Author:

audrasjb

Message:

General: Remove instances of _wp_http_referer from GET forms in the admin.

This changeset removes all instances of _wp_http_referer variable from the URL when creating a hidden input for _wp_http_referer. It prevents the hidden field from having an additional version of _wp_http_referer each time the form is submitted.

Props msolution, justinahinon, pbearne, mikeschroder, mukesh27, audrasjb, Clorith, chaion07, robinwpdeveloper, hztyfoon, davidbaumwald, costdev, adamsilverstein.
Fixes #54106.

Location:

trunk

Files:

• src/wp-includes/functions.php (modified) (1 diff)
• tests/phpunit/tests/functions/wpRefererField.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -1900 +1900 @@
  */
 function wp_referer_field( $echo = true ) {
-        $referer_field = '<input type="hidden" name="_wp_http_referer" value="' . esc_attr( wp_unslash( $_SERVER['REQUEST_URI'] ) ) . '" />';
+        $request_url   = remove_query_arg( '_wp_http_referer' );
+        $referer_field = '<input type="hidden" name="_wp_http_referer" value="' . esc_url( $request_url ) . '" />';
 
         if ( $echo ) {

trunk/tests/phpunit/tests/functions/wpRefererField.php

@@ -30 +30 @@
                 $this->assertSame( '<input type="hidden" name="_wp_http_referer" value="/test/" />', wp_referer_field( false ) );
         }
+
+        /**
+         * Tests that the echo argument is respected.
+         *
+         * @ticket 54106
+         *
+         * @dataProvider data_wp_referer_field_should_respect_echo_arg
+         *
+         * @param mixed $echo Whether to echo or return the referer field.
+         */
+        public function test_wp_referer_field_should_respect_echo_arg( $echo ) {
+                $actual = $echo ? get_echo( 'wp_referer_field' ) : wp_referer_field( false );
+
+                $this->assertSame( '<input type="hidden" name="_wp_http_referer" value="" />', $actual );
+        }
+
+        /**
+         * Data provider for test_wp_referer_field_should_respect_echo_arg().
+         *
+         * @return array
+         */
+        public function data_wp_referer_field_should_respect_echo_arg() {
+                return array(
+                        'true'         => array( true ),
+                        '(int) 1'      => array( 1 ),
+                        '(string) "1"' => array( '1' ),
+                        'false'        => array( false ),
+                        'null'         => array( null ),
+                        '(int) 0'      => array( 0 ),
+                        '(string) "0"' => array( '0' ),
+                );
+        }
+
+        /**
+         * @ticket 54106
+         */
+        public function test_wp_referer_field_with_referer() {
+                $old_request_uri        = $_SERVER['REQUEST_URI'];
+                $_SERVER['REQUEST_URI'] = 'edit.php?_wp_http_referer=edit.php';
+
+                $actual = wp_referer_field( false );
+
+                $_SERVER['REQUEST_URI'] = $old_request_uri;
+
+                $this->assertSame( '<input type="hidden" name="_wp_http_referer" value="edit.php" />', $actual );
+        }
 }