When evaluating path in get_*_url(), '..' can match the query string

[wonderboymusic]

​http://nacins-beard.com/gallery/?s=... is a valid URL. A common way to generate it and URLs like it is:

home_url( '/gallery/?s=..' )

This will return:

http://nacins-beard.com

Why? Because most of the get_*_url functions check for .. on the entire URI, not limited to the path. My patch fixes this and uses a function that all of the url functions share, eliminating a bunch of dupe'd code.

[nacin]

add_to_path() sounds a bit like join_with_slashes(), see #19796 for patches.

[wonderboymusic]

join_with_slashes never made it into 3.5 - add_path_to_url works generically with any URL that already has a path or not and the passed path. The main point of it: it condenses code that is repeated all over the place (10 other functions!), and join_with_slashes does not.

[wonderboymusic]

#23098 was marked as a duplicate.

[DrewAPicture]

Rereading dot-dot.diff, wouldn't you want to require $url? set_url_scheme() is going to return a formed host regardless but the path will only be appended if it both exists and is valid.

[SergeyBiryukov]

Related: #19032

Appears to be fixed in [23537].