WordPress post editor pagination uses inconsistent URL variable to rest of site

[roballshouse]

/wp-admin/edit.php

uses functions in class-wp-list-table.php

Which uses
$current_url = set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );

While all other pages use
WP_SITE_URL

Thus, when in the post editor, the "Next page" goes to (in my case) https://127.0.0.1:8090/wp-admin/edit.php?paged=2, instead of to <my_url>/wp-admin/edit.php?paged=2 like the rest of wp_admin

[sabernhardt]

Related: #16858, #36201

[sabernhardt]

also related: #53998

[ironprogrammer]

Welcome to Trac, @roballshouse, and thank you for the report!

This ticket could use some ​testing steps that would make reproduction of the issue more straightforward, so I've added the appropriate keyword.

[roballshouse]

Testing Instructions

Setup a WP environment with separate SERVERHTTP_HOST values (such as 127.0.0.1) and WP_SITE_URL value (such as a custom domain, pointing to the host)

Navigate to Post editor, and look at "Next Page" URL

Steps to Test

1. Navigate to <server>/wp-admin/edit.php on remote system using domain (e.g. ww.myblog.com/wp-admin/edit.php)
2. Attempt to click <Next Page>
3. Fail due to invalid URL (such as ​https://127.0.0.1:8090/wp-admin/edit.php?paged=2)

Expected Results

Lists each expected result or behavior, i.e. what should happen when running the test(s):

• ✅ Able to navigate between post edit pages

[jorgelopezrepiso]

I confirm that this issue is reproducible on a standard wordpress-develop installation using Docker.

Simply set $_SERVER['HTTP_HOST'] = '127.0.0.1:8889'; in your wp-config.php, navigate to the Posts page, and add enough posts to activate the pagination buttons. Then, check or click the "Next Page" link; it will point to 127.0.0.1:8889/wp-admin/... instead of localhost:8889/wp-admin/..., which kicks you out of the admin and forces you to log in again.

Additionally, PHPCS warns that the following line of code:

$current_url = set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );

triggers the following errors:

phpcs: error
WordPress.Security.ValidatedSanitizedInput.InputNotValidated - Detected usage of a possibly undefined superglobal array index: $_SERVERHTTP_HOST. Check that the array index exists before using it.

phpcs: error
WordPress.Security.ValidatedSanitizedInput.MissingUnslash - $_SERVERHTTP_HOST not unslashed before sanitization. Use wp_unslash() or similar

phpcs: error
WordPress.Security.ValidatedSanitizedInput.InputNotSanitized - Detected usage of a non-sanitized input variable: $_SERVERHTTP_HOST

phpcs: error
WordPress.Security.ValidatedSanitizedInput.InputNotValidated - Detected usage of a possibly undefined superglobal array index: $_SERVERREQUEST_URI. Check that the array index exists before using it.

phpcs: error
WordPress.Security.ValidatedSanitizedInput.MissingUnslash - $_SERVERREQUEST_URI not unslashed before sanitization. Use wp_unslash() or similar

phpcs: error
WordPress.Security.ValidatedSanitizedInput.InputNotSanitized - Detected usage of a non-sanitized input variable: $_SERVERREQUEST_URI

Might it be necessary to rewrite this variable using native WP functions instead, so that it complies with PHPCS?

[sukhendu2002]

I checked this on the latest trunk.

WP_List_Table::pagination() and WP_List_Table::print_column_headers() still build URLs from $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']:

So when HTTP_HOST differs from the configured site/admin URL, list table links can use the wrong host, e.g. 127.0.0.1:8090, instead of the configured admin domain.

This affects pagination links and sortable column header links, and it is not limited to /wp-admin/edit.php; it applies to WP_List_Table consumers generally.

This looks related to #36201 / #16858. A fix should avoid using HTTP_HOST here and derive the URL from WordPress admin URL APIs instead.

Trac ticket: https://core.trac.wordpress.org/ticket/58161