mirror of
https://github.com/WordPress/WordPress.git
synced 2024-09-29 23:57:41 +02:00
Improve URL validation in wp_validate_redirect()
.
Merges [45971] to the 5.2 branch. Props vortfu, whyisjake, peterwilsoncc. Built from https://develop.svn.wordpress.org/branches/5.2@45972 git-svn-id: http://core.svn.wordpress.org/branches/5.2@45783 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
parent
4315d85d65
commit
684ef4e3a7
@ -1396,6 +1396,14 @@ if ( ! function_exists( 'wp_validate_redirect' ) ) :
|
|||||||
return $default;
|
return $default;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if ( ! isset( $lp['host'] ) && ! empty( $lp['path'] ) && '/' !== $lp['path'][0] ) {
|
||||||
|
$path = '';
|
||||||
|
if ( ! empty( $_SERVER['REQUEST_URI'] ) ) {
|
||||||
|
$path = dirname( parse_url( 'http://placeholder' . $_SERVER['REQUEST_URI'], PHP_URL_PATH ) . '?' );
|
||||||
|
}
|
||||||
|
$location = '/' . ltrim( $path . '/', '/' ) . $location;
|
||||||
|
}
|
||||||
|
|
||||||
// Reject if certain components are set but host is not. This catches urls like https:host.com for which parse_url does not set the host field.
|
// Reject if certain components are set but host is not. This catches urls like https:host.com for which parse_url does not set the host field.
|
||||||
if ( ! isset( $lp['host'] ) && ( isset( $lp['scheme'] ) || isset( $lp['user'] ) || isset( $lp['pass'] ) || isset( $lp['port'] ) ) ) {
|
if ( ! isset( $lp['host'] ) && ( isset( $lp['scheme'] ) || isset( $lp['user'] ) || isset( $lp['pass'] ) || isset( $lp['port'] ) ) ) {
|
||||||
return $default;
|
return $default;
|
||||||
|
@ -13,7 +13,7 @@
|
|||||||
*
|
*
|
||||||
* @global string $wp_version
|
* @global string $wp_version
|
||||||
*/
|
*/
|
||||||
$wp_version = '5.2.3-RC1-45938';
|
$wp_version = '5.2.3-RC1-45972';
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
|
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
|
||||||
|
Loading…
Reference in New Issue
Block a user