From bdde0261bccd962b4ae76c85a4e7d2f61f5e2cfd Mon Sep 17 00:00:00 2001 From: John Blackbourn Date: Sat, 5 Sep 2015 21:29:25 +0000 Subject: [PATCH] Bail out early from `esc_url()` if the URL becomes empty after stripping out disallowed characters. Fixes #28015 Props jesin for the unit test Built from https://develop.svn.wordpress.org/trunk@33923 git-svn-id: http://core.svn.wordpress.org/trunk@33892 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/formatting.php | 5 +++++ wp-includes/version.php | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php index cbb91ddbd6..2fda875998 100644 --- a/wp-includes/formatting.php +++ b/wp-includes/formatting.php @@ -3277,6 +3277,11 @@ function esc_url( $url, $protocols = null, $_context = 'display' ) { $url = str_replace( ' ', '%20', $url ); $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url); + + if ( '' === $url ) { + return $url; + } + if ( 0 !== stripos( $url, 'mailto:' ) ) { $strip = array('%0d', '%0a', '%0D', '%0A'); $url = _deep_replace($strip, $url); diff --git a/wp-includes/version.php b/wp-includes/version.php index 45c3802f27..d6d7f2b9a5 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.4-alpha-33922'; +$wp_version = '4.4-alpha-33923'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.