From cafa85c01408e6862d4453096b3d628676c238d1 Mon Sep 17 00:00:00 2001 From: Weston Ruter Date: Wed, 22 Mar 2017 23:03:28 +0000 Subject: [PATCH] Customize: Prevent links to `customize.php` from being generated which have query vars from `wp_removable_query_args()` present. Props dlh. See #23367, #32692. Fixes #31850. git-svn-id: https://develop.svn.wordpress.org/trunk@40313 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/includes/theme.php | 2 +- src/wp-admin/menu.php | 2 +- src/wp-admin/nav-menus.php | 2 +- src/wp-admin/widgets.php | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/wp-admin/includes/theme.php b/src/wp-admin/includes/theme.php index 822fb5b656..c5de5e5c9c 100644 --- a/src/wp-admin/includes/theme.php +++ b/src/wp-admin/includes/theme.php @@ -578,7 +578,7 @@ function wp_prepare_themes_for_js( $themes = null ) { if ( current_user_can( 'edit_theme_options' ) && current_user_can( 'customize' ) ) { $customize_action = esc_url( add_query_arg( array( - 'return' => urlencode( esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) ), + 'return' => urlencode( esc_url_raw( remove_query_arg( wp_removable_query_args(), wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) ), ), wp_customize_url( $slug ) ) ); diff --git a/src/wp-admin/menu.php b/src/wp-admin/menu.php index f258e5639b..42a26ddfcb 100644 --- a/src/wp-admin/menu.php +++ b/src/wp-admin/menu.php @@ -157,7 +157,7 @@ $appearance_cap = current_user_can( 'switch_themes') ? 'switch_themes' : 'edit_t $menu[60] = array( __( 'Appearance' ), $appearance_cap, 'themes.php', '', 'menu-top menu-icon-appearance', 'menu-appearance', 'dashicons-admin-appearance' ); $submenu['themes.php'][5] = array( __( 'Themes' ), $appearance_cap, 'themes.php' ); - $customize_url = add_query_arg( 'return', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), 'customize.php' ); + $customize_url = add_query_arg( 'return', urlencode( remove_query_arg( wp_removable_query_args(), wp_unslash( $_SERVER['REQUEST_URI'] ) ) ), 'customize.php' ); $submenu['themes.php'][6] = array( __( 'Customize' ), 'customize', esc_url( $customize_url ), '', 'hide-if-no-customize' ); if ( current_theme_supports( 'menus' ) || current_theme_supports( 'widgets' ) ) { diff --git a/src/wp-admin/nav-menus.php b/src/wp-admin/nav-menus.php index 974d910d20..d8fc77f01d 100644 --- a/src/wp-admin/nav-menus.php +++ b/src/wp-admin/nav-menus.php @@ -584,7 +584,7 @@ require_once( ABSPATH . 'wp-admin/admin-header.php' ); ' %2$s', esc_url( add_query_arg( array( array( 'autofocus' => $focus ), - 'return' => urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), + 'return' => urlencode( remove_query_arg( wp_removable_query_args(), wp_unslash( $_SERVER['REQUEST_URI'] ) ) ), ), admin_url( 'customize.php' ) ) ), __( 'Manage with Live Preview' ) ); diff --git a/src/wp-admin/widgets.php b/src/wp-admin/widgets.php index 8793cab2d5..db4459b387 100644 --- a/src/wp-admin/widgets.php +++ b/src/wp-admin/widgets.php @@ -357,7 +357,7 @@ if ( current_user_can( 'customize' ) ) { esc_url( add_query_arg( array( array( 'autofocus' => array( 'panel' => 'widgets' ) ), - 'return' => urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ) + 'return' => urlencode( remove_query_arg( wp_removable_query_args(), wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) ), admin_url( 'customize.php' ) ) ),