sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Correctly encode spaces in URLs passed to esc_url() instead of removing them.

Browse Source 
Fixes #23605
Props enshrined, johnbillion


git-svn-id: https://develop.svn.wordpress.org/trunk@33858 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
John Blackbourn 2015-09-02 17:19:29 +00:00
parent 1ec4b77ac2
commit 65c7f9113d
2 changed files with 27 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/wp-includes/formatting.php
View File

@ -3274,11 +3274,14 @@ function esc_url( $url, $protocols = null, $_context = 'display' ) {
if ( '' == $url ) if ( '' == $url )
return $url; return $url;
$url = str_replace( ' ', '%20', $url );
$url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url); $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url);
if ( 0 !== stripos( $url, 'mailto:' ) ) { if ( 0 !== stripos( $url, 'mailto:' ) ) {
$strip = array('%0d', '%0a', '%0D', '%0A'); $strip = array('%0d', '%0a', '%0D', '%0A');
$url = _deep_replace($strip, $url); $url = _deep_replace($strip, $url);
} }
$url = str_replace(';//', '://', $url); $url = str_replace(';//', '://', $url);
/* If the URL doesn't appear to contain a scheme, we /* If the URL doesn't appear to contain a scheme, we
* presume it needs http:// appended (unless a relative * presume it needs http:// appended (unless a relative

26
tests/phpunit/tests/formatting/EscUrl.php
View File

@ -4,9 +4,18 @@
* @group formatting * @group formatting
*/ */
class Tests_Formatting_EscUrl extends WP_UnitTestCase { class Tests_Formatting_EscUrl extends WP_UnitTestCase {
/**
* @ticket 23605
*/
function test_spaces() { function test_spaces() {
$this->assertEquals('http://example.com/MrWordPress', esc_url('http://example.com/Mr WordPress')); $this->assertEquals( 'http://example.com/Mr%20WordPress', esc_url( 'http://example.com/Mr WordPress' ) );
$this->assertEquals('http://example.com/Mr%20WordPress', esc_url('http://example.com/Mr%20WordPress')); $this->assertEquals( 'http://example.com/Mr%20WordPress', esc_url( 'http://example.com/Mr%20WordPress' ) );
$this->assertEquals( 'http://example.com/Mr%20%20WordPress', esc_url( 'http://example.com/Mr%20%20WordPress' ) );
$this->assertEquals( 'http://example.com/Mr+WordPress', esc_url( 'http://example.com/Mr+WordPress' ) );
$this->assertEquals( 'http://example.com/?foo=one%20two%20three&bar=four', esc_url( 'http://example.com/?foo=one two three&bar=four' ) );
$this->assertEquals( 'http://example.com/?foo=one%20two%20three&bar=four', esc_url( 'http://example.com/?foo=one%20two%20three&bar=four' ) );
} }
function test_bad_characters() { function test_bad_characters() {
@ -136,6 +145,7 @@ EOT;
$email_link = esc_url( $email_link ); $email_link = esc_url( $email_link );
$this->assertEquals( 'mailto:?body=Hi%20there%2C%0A%0AI%20thought%20you%20might%20want%20to%20sign%20up%20for%20this%20newsletter', $email_link ); $this->assertEquals( 'mailto:?body=Hi%20there%2C%0A%0AI%20thought%20you%20might%20want%20to%20sign%20up%20for%20this%20newsletter', $email_link );
} }
/** /**
* @ticket 31632 * @ticket 31632
*/ */
@ -150,4 +160,16 @@ EOT;
$this->assertEquals( 'http://example.com/mailto:?body=Hi%20there%2CI%20thought%20you%20might%20want%20to%20sign%20up%20for%20this%20newsletter', $email_link ); $this->assertEquals( 'http://example.com/mailto:?body=Hi%20there%2CI%20thought%20you%20might%20want%20to%20sign%20up%20for%20this%20newsletter', $email_link );
} }
/**
* @ticket 23605
*/
function test_mailto_with_spaces() {
$body = 'Hi there, I thought you might want to sign up for this newsletter';
$email_link = 'mailto:?body=' . $body;
$email_link = esc_url( $email_link );
$this->assertEquals( 'mailto:?body=Hi%20there,%20I%20thought%20you%20might%20want%20to%20sign%20up%20for%20this%20newsletter', $email_link );
}
} }