From 6a33072f683fe28c3da1f7ef432ff0369537b46a Mon Sep 17 00:00:00 2001
From: John Blackbourn <johnbillion@git.wordpress.org>
Date: Thu, 29 Jun 2023 23:27:23 +0000
Subject: [PATCH] General: Ignore invalid types for the '_wp_http_referer' URL
 query variable.

It's expected that this query variable contains a string when it's set, but it's possible for its type to be something else such as an array. Ignoring non-string values prevents cascading errors when its value is passed through functions that expect a string.

Props xknown, costdev, jrf, azaozz

Fixes #57670

Built from https://develop.svn.wordpress.org/trunk@56115


git-svn-id: http://core.svn.wordpress.org/trunk@55627 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/functions.php | 6 ++++--
 wp-includes/version.php   | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/wp-includes/functions.php b/wp-includes/functions.php
index 56c3d94bf5..3267120b6f 100644
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -1976,7 +1976,9 @@ function wp_get_referer() {
 }
 
 /**
- * Retrieves unvalidated referer from '_wp_http_referer' or HTTP referer.
+ * Retrieves unvalidated referer from the '_wp_http_referer' URL query variable or the HTTP referer.
+ *
+ * If the value of the '_wp_http_referer' URL query variable is not a string then it will be ignored.
  *
  * Do not use for redirects, use wp_get_referer() instead.
  *
@@ -1985,7 +1987,7 @@ function wp_get_referer() {
  * @return string|false Referer URL on success, false on failure.
  */
 function wp_get_raw_referer() {
-	if ( ! empty( $_REQUEST['_wp_http_referer'] ) ) {
+	if ( ! empty( $_REQUEST['_wp_http_referer'] ) && is_string( $_REQUEST['_wp_http_referer'] ) ) {
 		return wp_unslash( $_REQUEST['_wp_http_referer'] );
 	} elseif ( ! empty( $_SERVER['HTTP_REFERER'] ) ) {
 		return wp_unslash( $_SERVER['HTTP_REFERER'] );
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 3275d74b07..fa716b8dec 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.3-beta2-56114';
+$wp_version = '6.3-beta2-56115';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.