Search form on wp-admin/themes.php page has a lot of extra parameters in referer field

[Otto42]

Do a search on the wp-admin/themes.php page to search amongst installed themes.

The first URL you get will be like this:

​http://localhost/wp/wp-admin/themes.php?s=andrea&_ajax_fetch_list_nonce=xxxxxxxxxx&_wp_http_referer=%2Fwp%2Fwp-admin%2Fthemes.php

Hit Search again, to get this new URL:

​http://localhost/wp/wp-admin/themes.php?s=andrea&_ajax_fetch_list_nonce=xxxxxxxxxx&_wp_http_referer=%2Fwp%2Fwp-admin%2Fthemes.php%3Fs%3Dandrea%26_ajax_fetch_list_nonce%3Dxxxxxxxxxx%26_wp_http_referer%3D%252Fwp%252Fwp-admin%252Fthemes.php

And so on:

​http://localhost/wp/wp-admin/themes.php?s=andrea&_ajax_fetch_list_nonce=xxxxxxxxxx&_wp_http_referer=%2Fwp%2Fwp-admin%2Fthemes.php%3Fs%3Dandrea%26_ajax_fetch_list_nonce%3Dxxxxxxxxxx%26_wp_http_referer%3D%252Fwp%252Fwp-admin%252Fthemes.php%253Fs%253Dandrea%2526_ajax_fetch_list_nonce%253Dxxxxxxxxxx%2526_wp_http_referer%253D%25252Fwp%25252Fwp-admin%25252Fthemes.php

That form should probably be a POST, not a GET. Changing it to POST shows no ill effects for me.

[Otto42]

change get to post

[SergeyBiryukov]

Introduced in [19887].

We've had some issues with changing GET to POST in the past and had to go back (#16335, #18094).

Perhaps it's an edge case, but changing to POST here will re-introduce an issue similar to the one in #18094 for no-JS. Searching and filtering would be broken when navigating between pages if there are more themes found than the default per_page limit, which is 36 ([21768]).

An alternative solution would be to reset $_SERVER['REQUEST_URI'] to avoid the pollution of _wp_http_referer. We already do that in plugins.php and several other files: tags/3.6/wp-admin/plugins.php#L23​.

See 25270.2.diff​.

[Otto42]

That would work too. +1

[SergeyBiryukov]

Remove 'features' too

[nacin]

I'm committing this but want to make it very clear I hate that we alter $_SERVER (beyond wp_fix_server_vars()) and would really like to eliminate all usage of it. :-)

[nacin]

In 25679:

Don't let the query string pile up on successive themes.php searches.

props SergeyBiryukov.
fixes #25270.