From 09d2c65970c6f5ecadeda603e7b4fd816f2ddd67 Mon Sep 17 00:00:00 2001
From: Ryan Boren <ryan@boren.nu>
Date: Fri, 1 Mar 2013 17:20:32 +0000
Subject: [PATCH] Always wp_unslash() the return of wp_get_referer().

see #21767


git-svn-id: http://core.svn.wordpress.org/trunk@23570 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/edit-form-advanced.php | 2 +-
 wp-admin/upgrade.php            | 2 +-
 wp-admin/user-edit.php          | 2 +-
 wp-includes/functions.php       | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/wp-admin/edit-form-advanced.php b/wp-admin/edit-form-advanced.php
index 2f5509e766..1c8b1b7ad3 100644
--- a/wp-admin/edit-form-advanced.php
+++ b/wp-admin/edit-form-advanced.php
@@ -314,7 +314,7 @@ if ( isset( $post_new_file ) && current_user_can( $post_type_object->cap->create
 <input type="hidden" id="post_author" name="post_author" value="<?php echo esc_attr( $post->post_author ); ?>" />
 <input type="hidden" id="post_type" name="post_type" value="<?php echo esc_attr( $post_type ) ?>" />
 <input type="hidden" id="original_post_status" name="original_post_status" value="<?php echo esc_attr( $post->post_status) ?>" />
-<input type="hidden" id="referredby" name="referredby" value="<?php echo esc_url(wp_unslash(wp_get_referer())); ?>" />
+<input type="hidden" id="referredby" name="referredby" value="<?php echo esc_url(wp_get_referer()); ?>" />
 <?php if ( ! empty( $active_post_lock ) ) { ?>
 <input type="hidden" id="active_post_lock" value="<?php echo esc_attr( implode( ':', $active_post_lock ) ); ?>" />
 <?php
diff --git a/wp-admin/upgrade.php b/wp-admin/upgrade.php
index 32f448c4cb..b04287735d 100644
--- a/wp-admin/upgrade.php
+++ b/wp-admin/upgrade.php
@@ -77,7 +77,7 @@ else
 <?php else :
 switch ( $step ) :
 	case 0:
-		$goback = wp_unslash( wp_get_referer() );
+		$goback = wp_get_referer();
 		$goback = esc_url_raw( $goback );
 		$goback = urlencode( $goback );
 ?>
diff --git a/wp-admin/user-edit.php b/wp-admin/user-edit.php
index 01552bd38b..9b15c81411 100644
--- a/wp-admin/user-edit.php
+++ b/wp-admin/user-edit.php
@@ -54,7 +54,7 @@ get_current_screen()->set_help_sidebar(
     '<p>' . __('<a href="http://wordpress.org/support/" target="_blank">Support Forums</a>') . '</p>'
 );
 
-$wp_http_referer = remove_query_arg(array('update', 'delete_count'), stripslashes($wp_http_referer));
+$wp_http_referer = remove_query_arg(array('update', 'delete_count'), $wp_http_referer );
 
 $user_can_edit = current_user_can( 'edit_posts' ) || current_user_can( 'edit_pages' );
 
diff --git a/wp-includes/functions.php b/wp-includes/functions.php
index aa4a317130..79bba12117 100644
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -1283,7 +1283,7 @@ function wp_get_referer() {
 		$ref = $_SERVER['HTTP_REFERER'];
 
 	if ( $ref && $ref !== $_SERVER['REQUEST_URI'] )
-		return $ref;
+		return wp_unslash( $ref );
 	return false;
 }