Validate referrers to prevent off-domain redirects.

git-svn-id: https://develop.svn.wordpress.org/trunk@25318 602fd350-edb4-49c9-b593-d223f7449a82

src/wp-includes/pluggable.php

@@ -964,6 +964,7 @@ if ( !function_exists('wp_validate_redirect') ) :
  * @return string redirect-sanitized URL
  **/
 function wp_validate_redirect($location, $default = '') {
+	$location = trim( $location );
 	// browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
 	if ( substr($location, 0, 2) == '//' )
 		$location = 'http:' . $location;