From 962ba7c52e6ac9739bce7e9c6900395df1114d97 Mon Sep 17 00:00:00 2001 From: Andrew Ozz Date: Wed, 11 Mar 2015 23:22:21 +0000 Subject: [PATCH] PressThis: update _limit_url(), use esc_url_raw(). Fixes checking of urlencoded strings. See #31373. git-svn-id: https://develop.svn.wordpress.org/trunk@31737 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/includes/class-wp-press-this.php | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/src/wp-admin/includes/class-wp-press-this.php b/src/wp-admin/includes/class-wp-press-this.php index 240c61f2a9..4e468aab21 100644 --- a/src/wp-admin/includes/class-wp-press-this.php +++ b/src/wp-admin/includes/class-wp-press-this.php @@ -342,23 +342,17 @@ class WP_Press_This { return ''; } - $url = $this->_limit_string( $url ); - // HTTP 1.1 allows 8000 chars but the "de-facto" standard supported in all current browsers is 2048. - if ( mb_strlen( $url ) > 2048 ) { + if ( strlen( $url ) > 2048 ) { return ''; // Return empty rather than a trunacted/invalid URL } - // Only allow http(s) or protocol relative URLs. - if ( ! preg_match( '%^(https?:)?//%i', $url ) ) { + // Does it look like an URL? + if ( ! preg_match( '/^([!#$&-;=?-\[\]_a-z~]|%[0-9a-fA-F]{2})+$/', $url ) ) { return ''; } - if ( strpos( $url, '"' ) !== false || strpos( $url, ' ' ) !== false ) { - return ''; - } - - return $url; + return esc_url_raw( $url, array( 'http', 'https' ) ); } private function _limit_img( $src ) {