From b57c4ae1651471f2632db289a38d30e1731404b4 Mon Sep 17 00:00:00 2001 From: John Blackbourn Date: Mon, 1 Dec 2014 03:15:24 +0000 Subject: [PATCH] Allow square brackets in a URL when it's sanitised for a redirect. Square brackets are valid in query parameters and IPv6 addresses. Fixes #17052 Props voldemortensen git-svn-id: https://develop.svn.wordpress.org/trunk@30683 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/pluggable.php | 2 +- tests/phpunit/tests/formatting/redirect.php | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/wp-includes/pluggable.php b/src/wp-includes/pluggable.php index 02377203a2..639230f702 100644 --- a/src/wp-includes/pluggable.php +++ b/src/wp-includes/pluggable.php @@ -1190,7 +1190,7 @@ if ( !function_exists('wp_sanitize_redirect') ) : * @return string redirect-sanitized URL **/ function wp_sanitize_redirect($location) { - $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*]|i', '', $location); + $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*\[\]]|i', '', $location); $location = wp_kses_no_null($location); // remove %0d and %0a from location diff --git a/tests/phpunit/tests/formatting/redirect.php b/tests/phpunit/tests/formatting/redirect.php index cd9f0f2bd5..5da5f82dce 100644 --- a/tests/phpunit/tests/formatting/redirect.php +++ b/tests/phpunit/tests/formatting/redirect.php @@ -14,5 +14,7 @@ class Tests_Formatting_Redirect extends WP_UnitTestCase { //Nesting checks $this->assertEquals('http://example.com/watchthecarriagereturngo', wp_sanitize_redirect('http://example.com/watchthecarriagereturn%0%0ddgo')); $this->assertEquals('http://example.com/watchthecarriagereturngo', wp_sanitize_redirect('http://example.com/watchthecarriagereturn%0%0DDgo')); + $this->assertEquals('http://example.com/whyisthisintheurl/?param[1]=foo', wp_sanitize_redirect('http://example.com/whyisthisintheurl/?param[1]=foo')); + $this->assertEquals('http://[2606:2800:220:6d:26bf:1447:aa7]/', wp_sanitize_redirect('http://[2606:2800:220:6d:26bf:1447:aa7]/')); } }