sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

PressThis: update _limit_url(), use esc_url_raw(). Fixes checking of urlencoded strings.

Browse Source 
See #31373.

git-svn-id: https://develop.svn.wordpress.org/trunk@31737 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Ozz 2015-03-11 23:22:21 +00:00
parent 62dd55f7d7
commit 962ba7c52e
1 changed files with 4 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/wp-admin/includes/class-wp-press-this.php
View File

@ -342,23 +342,17 @@ class WP_Press_This {
return '';
}
$url = $this->_limit_string( $url );
// HTTP 1.1 allows 8000 chars but the "de-facto" standard supported in all current browsers is 2048.
if ( mb_strlen( $url ) > 2048 ) {
if ( strlen( $url ) > 2048 ) {
return ''; // Return empty rather than a trunacted/invalid URL
}
// Only allow http(s) or protocol relative URLs.
if ( ! preg_match( '%^(https?:)?//%i', $url ) ) {
// Does it look like an URL?
if ( ! preg_match( '/^([!#$&-;=?-\[\]_a-z~]|%[0-9a-fA-F]{2})+$/', $url ) ) {
return '';
}
if ( strpos( $url, '"' ) !== false || strpos( $url, ' ' ) !== false ) {
return '';
}
return $url;
return esc_url_raw( $url, array( 'http', 'https' ) );
}
private function _limit_img( $src ) {