diff --git a/src/wp-includes/formatting.php b/src/wp-includes/formatting.php index 5d42ab2bcd..29f67fedb9 100644 --- a/src/wp-includes/formatting.php +++ b/src/wp-includes/formatting.php @@ -3274,11 +3274,14 @@ function esc_url( $url, $protocols = null, $_context = 'display' ) { if ( '' == $url ) return $url; + + $url = str_replace( ' ', '%20', $url ); $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url); if ( 0 !== stripos( $url, 'mailto:' ) ) { $strip = array('%0d', '%0a', '%0D', '%0A'); $url = _deep_replace($strip, $url); } + $url = str_replace(';//', '://', $url); /* If the URL doesn't appear to contain a scheme, we * presume it needs http:// appended (unless a relative diff --git a/tests/phpunit/tests/formatting/EscUrl.php b/tests/phpunit/tests/formatting/EscUrl.php index be7d99527a..c61522d287 100644 --- a/tests/phpunit/tests/formatting/EscUrl.php +++ b/tests/phpunit/tests/formatting/EscUrl.php @@ -4,9 +4,18 @@ * @group formatting */ class Tests_Formatting_EscUrl extends WP_UnitTestCase { + + /** + * @ticket 23605 + */ function test_spaces() { - $this->assertEquals('http://example.com/MrWordPress', esc_url('http://example.com/Mr WordPress')); - $this->assertEquals('http://example.com/Mr%20WordPress', esc_url('http://example.com/Mr%20WordPress')); + $this->assertEquals( 'http://example.com/Mr%20WordPress', esc_url( 'http://example.com/Mr WordPress' ) ); + $this->assertEquals( 'http://example.com/Mr%20WordPress', esc_url( 'http://example.com/Mr%20WordPress' ) ); + $this->assertEquals( 'http://example.com/Mr%20%20WordPress', esc_url( 'http://example.com/Mr%20%20WordPress' ) ); + $this->assertEquals( 'http://example.com/Mr+WordPress', esc_url( 'http://example.com/Mr+WordPress' ) ); + + $this->assertEquals( 'http://example.com/?foo=one%20two%20three&bar=four', esc_url( 'http://example.com/?foo=one two three&bar=four' ) ); + $this->assertEquals( 'http://example.com/?foo=one%20two%20three&bar=four', esc_url( 'http://example.com/?foo=one%20two%20three&bar=four' ) ); } function test_bad_characters() { @@ -136,6 +145,7 @@ EOT; $email_link = esc_url( $email_link ); $this->assertEquals( 'mailto:?body=Hi%20there%2C%0A%0AI%20thought%20you%20might%20want%20to%20sign%20up%20for%20this%20newsletter', $email_link ); } + /** * @ticket 31632 */ @@ -150,4 +160,16 @@ EOT; $this->assertEquals( 'http://example.com/mailto:?body=Hi%20there%2CI%20thought%20you%20might%20want%20to%20sign%20up%20for%20this%20newsletter', $email_link ); } + /** + * @ticket 23605 + */ + function test_mailto_with_spaces() { + $body = 'Hi there, I thought you might want to sign up for this newsletter'; + + $email_link = 'mailto:?body=' . $body; + $email_link = esc_url( $email_link ); + $this->assertEquals( 'mailto:?body=Hi%20there,%20I%20thought%20you%20might%20want%20to%20sign%20up%20for%20this%20newsletter', $email_link ); + } + + }