diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php index 25e7fc1cbc..cb23ab50bb 100644 --- a/wp-includes/formatting.php +++ b/wp-includes/formatting.php @@ -1080,12 +1080,15 @@ function clean_url( $url, $protocols = null ) { $original_url = $url; if ('' == $url) return $url; - $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%]|i', '', $url); + $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@]|i', '', $url); $strip = array('%0d', '%0a'); $url = str_replace($strip, '', $url); $url = str_replace(';//', '://', $url); - // Append http unless a relative link starting with / or a php file. - if ( strpos($url, '://') === false && + /* If the URL doesn't appear to contain a scheme, we + * presume it needs http:// appended (unless a relative + * link starting with / or a php file). + */ + if ( strpos($url, ':') === false && substr( $url, 0, 1 ) != '/' && !preg_match('/^[a-z0-9-]+?\.php/i', $url) ) $url = 'http://' . $url;