Changeset 59712

Timestamp:

01/27/2025 02:39:18 PM (34 hours ago)

Author:

johnbillion

Message:

Security: Enable the referrer policy header on the login screen.

This sets the same referrer policy of strict-origin-when-cross-origin that's used in the admin area to prevent a referrer being sent to other origins. This helps prevent unwanted exposure of potentially sensitive information that may be contained within the URL.

The header can be disabled if necessary by removing the wp_admin_headers action from the login_init hook.

Props kkmuffme, sagarlakhani, albatross10

Fixes #62273
See #42036

Location:

trunk/src

Files:

• wp-admin/includes/admin-filters.php (modified) (1 diff)
• wp-admin/includes/misc.php (modified) (1 diff)
• wp-includes/default-filters.php (modified) (1 diff)
• wp-includes/functions.php (modified) (1 diff)

trunk/src/wp-admin/includes/admin-filters.php

@@ -45 +45 @@
 // Misc hooks.
 add_action( 'admin_init', 'wp_admin_headers' );
-add_action( 'login_init', 'wp_admin_headers' );
 add_action( 'admin_init', 'send_frame_options_header', 10, 0 );
 add_action( 'admin_head', 'wp_admin_canonical_url' );

trunk/src/wp-admin/includes/misc.php

@@ -1417 +1417 @@
 
 /**
- * Sends a referrer policy header so referrers are not sent externally from administration screens.
- *
- * @since 4.9.0
- */
-function wp_admin_headers() {
-    $policy = 'strict-origin-when-cross-origin';
-
-    /**
-     * Filters the admin referrer policy header value.
-     *
-     * @since 4.9.0
-     * @since 4.9.5 The default value was changed to 'strict-origin-when-cross-origin'.
-     *
-     * @link https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
-     *
-     * @param string $policy The admin referrer policy header value. Default 'strict-origin-when-cross-origin'.
-     */
-    $policy = apply_filters( 'admin_referrer_policy', $policy );
-
-    header( sprintf( 'Referrer-Policy: %s', $policy ) );
-}
-
-/**
  * Outputs JS that reloads the page if the user navigated to it with the Back or Forward button.
  *

trunk/src/wp-includes/default-filters.php

@@ -390 +390 @@
 add_action( 'login_footer', 'wp_print_footer_scripts', 20 );
 add_action( 'login_init', 'send_frame_options_header', 10, 0 );
+add_action( 'login_init', 'wp_admin_headers' );
 
 // Feed generator tags.

trunk/src/wp-includes/functions.php

@@ -7146 +7146 @@
 
 /**
+ * Sends a referrer policy header so referrers are not sent externally from administration screens.
+ *
+ * @since 4.9.0
+ * @since 6.8.0 This function was moved from `wp-admin/includes/misc.php` to `wp-includes/functions.php`.
+ */
+function wp_admin_headers() {
+    $policy = 'strict-origin-when-cross-origin';
+
+    /**
+     * Filters the admin referrer policy header value.
+     *
+     * @since 4.9.0
+     * @since 4.9.5 The default value was changed to 'strict-origin-when-cross-origin'.
+     *
+     * @link https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
+     *
+     * @param string $policy The admin referrer policy header value. Default 'strict-origin-when-cross-origin'.
+     */
+    $policy = apply_filters( 'admin_referrer_policy', $policy );
+
+    header( sprintf( 'Referrer-Policy: %s', $policy ) );
+}
+
+/**
  * Retrieves a list of protocols to allow in HTML attributes.
  *