some Location headers are using relative url's (2)

[hakre]

I started this in #14062 and already did some fixes for 3.1.

Just collecting some more and providing patches.

[hakre]

Some leftover

[hakre]

Fix strategy: admin_url -> self_admin_url as we did in first round as well.

[dd32]

admin_url will return a absolute URL. self_admin_url() is only needed for pages accessible from both the Network admin (or users admin) as well as the normal admin.

[hakre]

Replying to dd32:

admin_url will return a absolute URL. self_admin_url() is only needed for pages
accessible from both the Network admin (or users admin) as well as the normal
admin.

Ah, okay. Had not thought about that, the first patch was mainly a regex search, so I assume most of it does not apply any longer.

what about /wp-admin/network/edit.php and /wp-amin/user/admin.php? Is it the same?

[hakre]

those two

[hakre]

referer field

[hakre]

Found it via the options page. A _wp_http_referer is placed in there and later used in options.php to redirect to (/wp-admin/options.php:161). It was no full absolute location.

[hakre]

Triggered by logout of the admin bar on frontend

[hakre]

​Better HTTP Redirects now supports WB_DEBUG and displays extensive information about the redirect.

[hakre]

Related: #16907

[hakre]

/wp-admin/includes/dashboard.php:127 creates a redirect w/o an absolute URI.

[hakre]

Triggered by dashboard.php

[hakre]

/wp-admin/user-new.php:100, /wp-admin/users.php:131

Related: #17018

[dd32]

Location headers may contain relative paths. All browsers support this.

Early revisions of the HTTP/1.1 specification specified absolute URI's only (ie. ​RFC2616) however later revisions allow for a relative URI as all browsers handle it and it matches the usage in the wild ​RFC7231.