mirror_php/wordpress
1
0
Fork 0
mirror of git://develop.git.wordpress.org/ synced 2025-06-02 00:34:58 +02:00
Code Issues Actions 11 Packages Projects Releases Wiki Activity

Asterisk is an allowed character in a URI and should not be stripped out by wp_sanitize_redirect().

Browse Source 
fixes #28362.

git-svn-id: https://develop.svn.wordpress.org/trunk@28939 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Sergey Biryukov 2014-07-01 15:55:04 +00:00
parent ef5e962cfb
commit 92a7523362
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/wp-includes/pluggable.php
View File

@ -1160,7 +1160,7 @@ if ( !function_exists('wp_sanitize_redirect') ) :
* @return string redirect-sanitized URL
**/
function wp_sanitize_redirect($location) {
$location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!]|i', '', $location);
$location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*]|i', '', $location);
$location = wp_kses_no_null($location);
// remove %0d and %0a from location

1
tests/phpunit/tests/formatting/redirect.php
View File

@ -10,6 +10,7 @@ class Tests_Formatting_Redirect extends WP_UnitTestCase {
$this->assertEquals('http://example.com/watchthelinefeedgo', wp_sanitize_redirect('http://example.com/watchthelinefeed%0ago'));
$this->assertEquals('http://example.com/watchthecarriagereturngo', wp_sanitize_redirect('http://example.com/watchthecarriagereturn%0Dgo'));
$this->assertEquals('http://example.com/watchthecarriagereturngo', wp_sanitize_redirect('http://example.com/watchthecarriagereturn%0dgo'));
$this->assertEquals('http://example.com/watchtheallowedcharacters-~+_.?#=&;,/:%!*stay', wp_sanitize_redirect('http://example.com/watchtheallowedcharacters-~+_.?#=&;,/:%!*stay'));
//Nesting checks
$this->assertEquals('http://example.com/watchthecarriagereturngo', wp_sanitize_redirect('http://example.com/watchthecarriagereturn%0%0ddgo'));
$this->assertEquals('http://example.com/watchthecarriagereturngo', wp_sanitize_redirect('http://example.com/watchthecarriagereturn%0%0DDgo'));