From 419de4780ce8794882919a38c8901ab08c34e7d9 Mon Sep 17 00:00:00 2001
From: Jb Audras <audrasjb@git.wordpress.org>
Date: Mon, 17 Oct 2022 12:09:54 +0000
Subject: [PATCH] General: Validate host on "Are you sure?" screen.

Props voldemortensen, xknown, peterwiloncc.

Merges [54522] to the 6.0 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/6.0@54532 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/functions.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index b4ea6fbce0..56bfa8cbc0 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -3580,10 +3580,12 @@ function wp_nonce_ays( $action ) {
 	} else {
 		$html = __( 'The link you followed has expired.' );
 		if ( wp_get_referer() ) {
+			$wp_http_referer = remove_query_arg( 'updated', wp_get_referer() );
+			$wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) );
 			$html .= '</p><p>';
 			$html .= sprintf(
 				'<a href="%s">%s</a>',
-				esc_url( remove_query_arg( 'updated', wp_get_referer() ) ),
+				esc_url( $wp_http_referer ),
 				__( 'Please try again.' )
 			);
 		}