sergiotarxz
/
Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update `home` and `siteurl` after path slashes are validated in `update_blog_details()` 

When editing a site, if `home` and `siteurl` are checked to be updated along with a site's domain and path, they should receive the results of any modifications in `update_blog_details()` rather than trusting the POST data.

Previously, it was possible to save a value without a leading slash on the path, causing an invalid URL to be stored.

Props earnjam.

Fixes #30417.


git-svn-id: https://develop.svn.wordpress.org/trunk@31156 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Jeremy Felt 2015-01-12 01:56:04 +00:00
parent f9e9287875
commit 331262b544
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/wp-admin/network/site-info.php
View File

@ -50,15 +50,6 @@ if ( isset($_REQUEST['action']) && 'update-site' == $_REQUEST['action'] ) {
switch_to_blog( $id );
if ( isset( $_POST['update_home_url'] ) && $_POST['update_home_url'] == 'update' ) {
$blog_address = esc_url_raw( $_POST['blog']['domain'] . $_POST['blog']['path'] );
if ( get_option( 'siteurl' ) != $blog_address )
update_option( 'siteurl', $blog_address );
if ( get_option( 'home' ) != $blog_address )
update_option( 'home', $blog_address );
}
// Rewrite rules can't be flushed during switch to blog.
delete_option( 'rewrite_rules' );
@ -74,6 +65,17 @@ if ( isset($_REQUEST['action']) && 'update-site' == $_REQUEST['action'] ) {
}
update_blog_details( $id, $blog_data );
if ( isset( $_POST['update_home_url'] ) && $_POST['update_home_url'] == 'update' ) {
$new_details = get_blog_details( $id, false );
$blog_address = esc_url_raw( $new_details->domain . $new_details->path );
if ( get_option( 'siteurl' ) != $blog_address ) {
update_option( 'siteurl', $blog_address );
}
if ( get_option( 'home' ) != $blog_address ) {
update_option( 'home', $blog_address );
}
}
restore_current_blog();
wp_redirect( add_query_arg( array( 'update' => 'updated', 'id' => $id ), 'site-info.php') );
exit;