diff --git a/wp-includes/class-http.php b/wp-includes/class-http.php index 32ff9f3602..12e73bbb86 100644 --- a/wp-includes/class-http.php +++ b/wp-includes/class-http.php @@ -87,7 +87,7 @@ class WP_Http { 'redirection' => apply_filters( 'http_request_redirection_count', 5), 'httpversion' => apply_filters( 'http_request_version', '1.0'), 'user-agent' => apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' ) ), - 'reject_unsafe_urls' => apply_filters( 'http_request_reject_unsafe_urls', true ), + 'reject_unsafe_urls' => apply_filters( 'http_request_reject_unsafe_urls', false ), 'blocking' => true, 'headers' => array(), 'cookies' => array(), diff --git a/wp-includes/http.php b/wp-includes/http.php index c51794495e..4b1a60e611 100644 --- a/wp-includes/http.php +++ b/wp-includes/http.php @@ -28,6 +28,84 @@ function _wp_http_get_object() { return $http; } +/** + * Retrieve the raw response from a safe HTTP request. + * + * This function is ideal when the HTTP request is being made to an arbitrary + * URL. The URL is validated to avoid redirection and request forgery attacks. + * + * @see wp_remote_request() For more information on the response array format + * and default arguments. + * + * @since 3.6.0 + * + * @param string $url Site URL to retrieve. + * @param array $args Optional. Override the defaults. + * @return WP_Error|array The response or WP_Error on failure. + */ +function wp_safe_remote_request( $url, $args = array() ) { + $args['reject_unsafe_urls'] = true; + $http = _wp_http_get_object(); + return $http->request( $url, $args ); +} + +/** + * Retrieve the raw response from a safe HTTP request using the GET method. + * + * @see wp_remote_request() For more information on the response array format + * and default arguments. + * + * @since 3.6.0 + * + * @param string $url Site URL to retrieve. + * @param array $args Optional. Override the defaults. + * @return WP_Error|array The response or WP_Error on failure. + */ +function wp_safe_remote_get( $url, $args = array() ) { + $args['reject_unsafe_urls'] = true; + $http = _wp_http_get_object(); + return $http->get( $url, $args ); +} + +/** + * Retrieve the raw response from a safe HTTP request using the POST method. + * + * @see wp_remote_request() For more information on the response array format + * and default arguments. + * + * @since 3.6.0 + * + * @param string $url Site URL to retrieve. + * @param array $args Optional. Override the defaults. + * @return WP_Error|array The response or WP_Error on failure. + */ +function wp_safe_remote_post( $url, $args = array() ) { + $args['reject_unsafe_urls'] = true; + $http = _wp_http_get_object(); + return $http->post( $url, $args ); +} + +/** + * Retrieve the raw response from a safe HTTP request using the HEAD method. + * + * This function is ideal when the HTTP request is being made to an arbitrary + * URL. The URL is validated to avoid redirection and request forgery attacks. + * + * @see wp_remote_request() For more information on the response array format + * and default arguments. + * + * @since 3.6.0 + * + * @param string $url Site URL to retrieve. + * @param array $args Optional. Override the defaults. + * @return WP_Error|array The response or WP_Error on failure. + */ +function wp_safe_remote_head( $url, $args = array() ) { + $args['reject_unsafe_urls'] = true; + $http = _wp_http_get_object(); + return $http->head( $url, $args ); +} + /** * Retrieve the raw response from the HTTP request. *