class-wp-list-table.php generating wrong URL

[tnash]

Line 768 within class-wp-list-table.php in the pagination function is:

$current_url = set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );

This can result in some very weird anomalies if the HTTP_HOST is being mapped in a weird way (for example behind a proxy, the result can be instead of the domain, an IP is returned).

A simple fix is to use the home_url as the substitute for the HTTP_HOST but probably better to guarantee it's returning the correct data would be to use site_url as it's calling a specific file within the site_url structure.

[nigel2]

+1 I've hit this one too. When behind a CDN, using $_SERVER returns the name of the origin server, not the site url (ie when the CDN/proxy passes the request to the origin/backend server, it is the hostname used to make that backend request that is used). As suggested below modifying to use site_url() instead of $_SERVER fixes this.

The symtpom of this issue is that pressing the pagination buttons "<" ">" in an admin screen (page list for example) logs you out, as you are now directed to a URL that is not associated with the session cookie.

Replying to tnash:

Line 768 within class-wp-list-table.php in the pagination function is:

$current_url = set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );

This can result in some very weird anomalies if the HTTP_HOST is being mapped in a weird way (for example behind a proxy, the result can be instead of the domain, an IP is returned).

A simple fix is to use the home_url as the substitute for the HTTP_HOST but probably better to guarantee it's returning the correct data would be to use site_url as it's calling a specific file within the site_url structure.

[johnbillion]

Duplicate of #36201.