#25057 closed defect (bug) (fixed)
MS function get_blogaddress_by_domain returns output escaped by esc_url() - should be esc_url_raw()
| Reported by: | tlovett1 | Owned by: | nacin |
|---|---|---|---|
| Priority: | normal | Milestone: | 3.7 |
| Component: | Multisite | Version: | |
| Severity: | normal | Keywords: | has-patch |
| Cc: | Focuses: |
Description
Title is pretty self-explanatory. get_blogaddress_by_domain() runs esc_url() on it's output. get_blogaddress_by_domain() is only called once in core:
In site-info.php:
$blog_address = get_blogaddress_by_domain( $_POST['blog']['domain'], $_POST['blog']['path'] );
if ( get_option( 'siteurl' ) != $blog_address )
update_option( 'siteurl', $blog_address );
Since get_blogaddress_by_domain() is saved straight to the options table, it should be using the correct sanitization function, esc_url_raw().
Attachments (1)
Change History (5)
Note:
See TracTickets
for help on using tickets.
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
Use esc_url_raw instead of esc_url