WordPress post editor pagination uses inconsistent URL variable to rest of site

[roballshouse]

/wp-admin/edit.php

uses functions in class-wp-list-table.php

Which uses
$current_url = set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );

While all other pages use
WP_SITE_URL

Thus, when in the post editor, the "Next page" goes to (in my case) https://127.0.0.1:8090/wp-admin/edit.php?paged=2, instead of to <my_url>/wp-admin/edit.php?paged=2 like the rest of wp_admin

[sabernhardt]

Related: #16858, #36201

[sabernhardt]

also related: #53998

[ironprogrammer]

Welcome to Trac, @roballshouse, and thank you for the report!

This ticket could use some ​testing steps that would make reproduction of the issue more straightforward, so I've added the appropriate keyword. Please feel free to add these steps, or the keyword may also signal other contributors to do the same.

[roballshouse]

Testing Instructions

Setup a WP environment with separate SERVERHTTP_HOST values (such as 127.0.0.1) and WP_SITE_URL value (such as a custom domain, pointing to the host)

Navigate to Post editor, and look at "Next Page" URL

Steps to Test

1. Navigate to <server>/wp-admin/edit.php on remote system using domain (e.g. ww.myblog.com/wp-admin/edit.php)
2. Attempt to click <Next Page>
3. Fail due to invalid URL (such as ​https://127.0.0.1:8090/wp-admin/edit.php?paged=2)

Expected Results

Lists each expected result or behavior, i.e. what should happen when running the test(s):

• ✅ Able to navigate between post edit pages

[jorgelopezrepiso]

I confirm that this issue is reproducible on a standard wordpress-develop installation using Docker.

Simply set $_SERVER['HTTP_HOST'] = '127.0.0.1:8889'; in your wp-config.php, navigate to the Posts page, and add enough posts to activate the pagination buttons. Then, check or click the "Next Page" link; it will point to 127.0.0.1:8889/wp-admin/... instead of localhost:8889/wp-admin/..., which kicks you out of the admin and forces you to log in again.

Additionally, PHPCS warns that the following line of code:

$current_url = set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );

triggers the following errors:

phpcs: error
WordPress.Security.ValidatedSanitizedInput.InputNotValidated - Detected usage of a possibly undefined superglobal array index: $_SERVERHTTP_HOST. Check that the array index exists before using it.

phpcs: error
WordPress.Security.ValidatedSanitizedInput.MissingUnslash - $_SERVERHTTP_HOST not unslashed before sanitization. Use wp_unslash() or similar

phpcs: error
WordPress.Security.ValidatedSanitizedInput.InputNotSanitized - Detected usage of a non-sanitized input variable: $_SERVERHTTP_HOST

phpcs: error
WordPress.Security.ValidatedSanitizedInput.InputNotValidated - Detected usage of a possibly undefined superglobal array index: $_SERVERREQUEST_URI. Check that the array index exists before using it.

phpcs: error
WordPress.Security.ValidatedSanitizedInput.MissingUnslash - $_SERVERREQUEST_URI not unslashed before sanitization. Use wp_unslash() or similar

phpcs: error
WordPress.Security.ValidatedSanitizedInput.InputNotSanitized - Detected usage of a non-sanitized input variable: $_SERVERREQUEST_URI

Might it be necessary to rewrite this variable using native WP functions instead, so that it complies with PHPCS?

[sukhendu2002]

I checked this on the latest trunk.

WP_List_Table::pagination() and WP_List_Table::print_column_headers() still build URLs from $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']:

So when HTTP_HOST differs from the configured site/admin URL, list table links can use the wrong host, e.g. 127.0.0.1:8090, instead of the configured admin domain.

This affects pagination links and sortable column header links, and it is not limited to /wp-admin/edit.php; it applies to WP_List_Table consumers generally.

This looks related to #36201 / #16858. A fix should avoid using HTTP_HOST here and derive the URL from WordPress admin URL APIs instead.

Trac ticket: https://core.trac.wordpress.org/ticket/58161