Changeset 57120 for trunk/src/wp-admin/includes/user.php
- Timestamp:
- 11/17/2023 01:27:23 PM (2 years ago)
- File:
-
- 1 edited
-
trunk/src/wp-admin/includes/user.php (modified) (4 diffs)
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/wp-admin/includes/user.php
r56837 r57120 639 639 * @since 5.6.0 640 640 * @since 6.2.0 Allow insecure HTTP connections for the local environment. 641 * @since 6.3.2 Validates the success and reject URLs to prevent javascript pseudo protocolbeing executed.641 * @since 6.3.2 Validates the success and reject URLs to prevent `javascript` pseudo protocol from being executed. 642 642 * 643 643 * @param array $request { … … 701 701 702 702 /** 703 * Validates the redirect URL protocol scheme. The protocol can be anything except http and javascript.703 * Validates the redirect URL protocol scheme. The protocol can be anything except `http` and `javascript`. 704 704 * 705 705 * @since 6.3.2 706 706 * 707 * @param string $url - The redirect URL to be validated. 708 * 707 * @param string $url The redirect URL to be validated. 709 708 * @return true|WP_Error True if the redirect URL is valid, a WP_Error object otherwise. 710 709 */ … … 729 728 * @since 6.3.2 730 729 * 731 * @param string[] $bad_protocols Array of invalid protocols.732 * @param string $url The redirect URL to be validated.730 * @param string[] $bad_protocols Array of invalid protocols. 731 * @param string $url The redirect URL to be validated. 733 732 */ 734 $invalid_protocols = array_map( 'strtolower', apply_filters( 'wp_authorize_application_redirect_url_invalid_protocols', $bad_protocols, $url ) ); 733 $invalid_protocols = apply_filters( 'wp_authorize_application_redirect_url_invalid_protocols', $bad_protocols, $url ); 734 $invalid_protocols = array_map( 'strtolower', $invalid_protocols ); 735 735 736 736 $scheme = wp_parse_url( $url, PHP_URL_SCHEME ); … … 738 738 $is_local = 'local' === wp_get_environment_type(); 739 739 740 // validates if the proper URI format is applied to the $url740 // Validates if the proper URI format is applied to the URL. 741 741 if ( empty( $host ) || empty( $scheme ) || in_array( strtolower( $scheme ), $invalid_protocols, true ) ) { 742 742 return new WP_Error(
Note: See TracChangeset
for help on using the changeset viewer.