From 182873dfaa7e8d47104deae5093aea06c7958de2 Mon Sep 17 00:00:00 2001
From: Ryan Boren <ryan@git.wordpress.org>
Date: Thu, 11 Mar 2010 14:54:11 +0000
Subject: [PATCH] Restrict schemes allowed in wp_validate_redirect()

git-svn-id: https://develop.svn.wordpress.org/trunk@13657 602fd350-edb4-49c9-b593-d223f7449a82
---
 wp-includes/pluggable.php | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php
index 019ba88cf1..175eb496a5 100644
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -984,6 +984,15 @@ function wp_validate_redirect($location, $default = '') {
 	$test = ( $cut = strpos($location, '?') ) ? substr( $location, 0, $cut ) : $location;
 
 	$lp  = parse_url($test);
+
+	// Give up if malformed URL
+	if ( false === $lp )
+		return $default;
+
+	// Allow only http and https schemes. No data:, etc.
+	if ( isset($lp['scheme']) && !('http' == $lp['scheme'] || 'https' == $lp['scheme']) )
+		return $default;
+
 	$wpp = parse_url(home_url());
 
 	$allowed_hosts = (array) apply_filters('allowed_redirect_hosts', array($wpp['host']), isset($lp['host']) ? $lp['host'] : '');