WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Introduce `wp_get_raw_referer()` to retrieve unvalidated referer. 

For things like redirects `wp_get_referer()` should be used instead.

Props voldemortensen for initial patch.
Fixes #27152.
Built from https://develop.svn.wordpress.org/trunk@36266


git-svn-id: http://core.svn.wordpress.org/trunk@36233 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Pascal Birchler 2016-01-12 08:32:28 +00:00
parent 5bd888497d
commit e7660a104d
2 changed files with 24 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
wp-includes/functions.php
View File

@ -1517,13 +1517,11 @@ function wp_original_referer_field( $echo = true, $jump_back_to = 'current' ) {
* @return false|string False on failure. Referer URL on success.
*/
function wp_get_referer() {
if ( ! function_exists( 'wp_validate_redirect' ) )
if ( ! function_exists( 'wp_validate_redirect' ) ) {
return false;
$ref = false;
if ( ! empty( $_REQUEST['_wp_http_referer'] ) )
$ref = wp_unslash( $_REQUEST['_wp_http_referer'] );
elseif ( ! empty( $_SERVER['HTTP_REFERER'] ) )
$ref = wp_unslash( $_SERVER['HTTP_REFERER'] );
}
$ref = wp_get_raw_referer();
if ( $ref && $ref !== wp_unslash( $_SERVER['REQUEST_URI'] ) && $ref !== home_url() . wp_unslash( $_SERVER['REQUEST_URI'] ) ) {
return wp_validate_redirect( $ref, false );
@ -1532,6 +1530,25 @@ function wp_get_referer() {
return false;
}
/**
* Retrieve unvalidated referer from '_wp_http_referer' or HTTP referer.
*
* Do not use for redirects, use wp_get_referer() instead.
*
* @since 4.5.0
*
* @return string|bool Referer URL on success, false on failure.
*/
function wp_get_raw_referer() {
if ( ! empty( $_REQUEST['_wp_http_referer'] ) ) {
return wp_unslash( $_REQUEST['_wp_http_referer'] );
} else if ( ! empty( $_SERVER['HTTP_REFERER'] ) ) {
return wp_unslash( $_SERVER['HTTP_REFERER'] );
}
return false;
}
/**
* Retrieve original referer that was posted, if it exists.
*

2
wp-includes/version.php
View File

@ -4,7 +4,7 @@
*
* @global string $wp_version
*/
$wp_version = '4.5-alpha-36265';
$wp_version = '4.5-alpha-36266';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.