From 9173df8e250223b2f6ce8e2fa3909649eba08667 Mon Sep 17 00:00:00 2001 From: Jake Spurlock Date: Wed, 10 Jun 2020 16:44:14 +0000 Subject: [PATCH] Formatting: Ensure that `wp_validate_redirect()` sanitizes a wider variety of characters. Props: xknow, vortfu. git-svn-id: https://develop.svn.wordpress.org/trunk@47949 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/pluggable.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wp-includes/pluggable.php b/src/wp-includes/pluggable.php index 39180c6513..9db601cb85 100644 --- a/src/wp-includes/pluggable.php +++ b/src/wp-includes/pluggable.php @@ -1412,7 +1412,7 @@ if ( ! function_exists( 'wp_validate_redirect' ) ) : * @return string redirect-sanitized URL */ function wp_validate_redirect( $location, $default = '' ) { - $location = trim( $location, " \t\n\r\0\x08\x0B" ); + $location = wp_sanitize_redirect( trim( $location, " \t\n\r\0\x08\x0B" ) ); // Browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'. if ( '//' === substr( $location, 0, 2 ) ) { $location = 'http:' . $location;