vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-06 17:29:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

General: Replace all esc_url_raw() calls in core with sanitize_url().

Browse Source 
This aims to improve performance by calling `sanitize_url()` directly, instead of the `esc_url_raw()` wrapper. As of WordPress 6.1, `sanitize_url()` is the recommended function for sanitizing a URL for database or redirect usage.

Follow-up to [11383], [13096], [51597], [53452].

Props benjgrolleau, peterwilsoncc, SergeyBiryukov.
Fixes #55852.

git-svn-id: https://develop.svn.wordpress.org/trunk@53455 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Sergey Biryukov
2022-06-01 18:12:25 +00:00
parent c59af567e5
commit b316c8b25f
39 changed files with 87 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/wp-admin/edit-tag-form.php
View File

@@ -83,7 +83,7 @@ if ( $message ) {
<div id="message" class="notice notice-<?php echo $class; ?>">
<p><strong><?php echo $message; ?></strong></p>
<?php if ( $wp_http_referer ) { ?>
<p><a href="<?php echo esc_url( wp_validate_redirect( esc_url_raw( $wp_http_referer ), admin_url( 'term.php?taxonomy=' . $taxonomy ) ) ); ?>">
<p><a href="<?php echo esc_url( wp_validate_redirect( sanitize_url( $wp_http_referer ), admin_url( 'term.php?taxonomy=' . $taxonomy ) ) ); ?>">
<?php echo esc_html( $tax->labels->back_to_items ); ?>
</a></p>
<?php } ?>

2
src/wp-admin/edit-tags.php
View File

@@ -160,7 +160,7 @@ switch ( $wp_list_table->current_action() ) {
wp_die( __( 'You attempted to edit an item that does not exist. Perhaps it was deleted?' ) );
}
wp_redirect( esc_url_raw( get_edit_term_link( $term_id, $taxonomy, $post_type ) ) );
wp_redirect( sanitize_url( get_edit_term_link( $term_id, $taxonomy, $post_type ) ) );
exit;
case 'editedtag':

4
src/wp-admin/includes/ajax-actions.php
View File

@@ -431,7 +431,7 @@ function _wp_ajax_delete_comment_response( $comment_id, $delta = -1 ) {
$total = isset( $_POST['_total'] ) ? (int) $_POST['_total'] : 0;
$per_page = isset( $_POST['_per_page'] ) ? (int) $_POST['_per_page'] : 0;
$page = isset( $_POST['_page'] ) ? (int) $_POST['_page'] : 0;
$url = isset( $_POST['_url'] ) ? esc_url_raw( $_POST['_url'] ) : '';
$url = isset( $_POST['_url'] ) ? sanitize_url( $_POST['_url'] ) : '';
// JS didn't send us everything we need to know. Just die with success message.
if ( ! $total || ! $per_page || ! $page || ! $url ) {
@@ -3333,7 +3333,7 @@ function wp_ajax_send_link_to_editor() {
$src = 'http://' . $src;
}
$src = esc_url_raw( $src );
$src = sanitize_url( $src );
if ( ! $src ) {
wp_send_json_error();
}

8
src/wp-admin/includes/class-custom-background.php
View File

@@ -526,10 +526,10 @@ class Custom_Background {
wp_update_attachment_metadata( $id, wp_generate_attachment_metadata( $id, $file ) );
update_post_meta( $id, '_wp_attachment_is_custom_background', get_option( 'stylesheet' ) );
set_theme_mod( 'background_image', esc_url_raw( $url ) );
set_theme_mod( 'background_image', sanitize_url( $url ) );
$thumbnail = wp_get_attachment_image_src( $id, 'thumbnail' );
set_theme_mod( 'background_image_thumb', esc_url_raw( $thumbnail[0] ) );
set_theme_mod( 'background_image_thumb', sanitize_url( $thumbnail[0] ) );
/** This action is documented in wp-admin/includes/class-custom-image-header.php */
do_action( 'wp_create_file_in_uploads', $file, $id ); // For replication.
@@ -618,8 +618,8 @@ class Custom_Background {
$url = wp_get_attachment_image_src( $attachment_id, $size );
$thumbnail = wp_get_attachment_image_src( $attachment_id, 'thumbnail' );
set_theme_mod( 'background_image', esc_url_raw( $url[0] ) );
set_theme_mod( 'background_image_thumb', esc_url_raw( $thumbnail[0] ) );
set_theme_mod( 'background_image', sanitize_url( $url[0] ) );
set_theme_mod( 'background_image_thumb', sanitize_url( $thumbnail[0] ) );
exit;
}
}

4
src/wp-admin/includes/class-custom-image-header.php
View File

@@ -1159,7 +1159,7 @@ endif;
return;
}
$choice['url'] = esc_url_raw( $choice['url'] );
$choice['url'] = sanitize_url( $choice['url'] );
$header_image_data = (object) array(
'attachment_id' => $choice['attachment_id'],
@@ -1197,7 +1197,7 @@ endif;
}
}
set_theme_mod( 'header_image', esc_url_raw( $header_image_data['url'] ) );
set_theme_mod( 'header_image', sanitize_url( $header_image_data['url'] ) );
set_theme_mod( 'header_image_data', $header_image_data );
}

2
src/wp-admin/includes/export.php
View File

@@ -632,7 +632,7 @@ function export_wp( $args = array() ) {
<wp:comment_id><?php echo (int) $c->comment_ID; ?></wp:comment_id>
<wp:comment_author><?php echo wxr_cdata( $c->comment_author ); ?></wp:comment_author>
<wp:comment_author_email><?php echo wxr_cdata( $c->comment_author_email ); ?></wp:comment_author_email>
<wp:comment_author_url><?php echo esc_url_raw( $c->comment_author_url ); ?></wp:comment_author_url>
<wp:comment_author_url><?php echo sanitize_url( $c->comment_author_url ); ?></wp:comment_author_url>
<wp:comment_author_IP><?php echo wxr_cdata( $c->comment_author_IP ); ?></wp:comment_author_IP>
<wp:comment_date><?php echo wxr_cdata( $c->comment_date ); ?></wp:comment_date>
<wp:comment_date_gmt><?php echo wxr_cdata( $c->comment_date_gmt ); ?></wp:comment_date_gmt>

4
src/wp-admin/includes/media.php
View File

@@ -917,7 +917,7 @@ function wp_media_upload_handler() {
* @param string $src Media source URL.
* @param string $title Media title.
*/
$html = apply_filters( "{$type}_send_to_editor_url", $html, esc_url_raw( $src ), $title );
$html = apply_filters( "{$type}_send_to_editor_url", $html, sanitize_url( $src ), $title );
} else {
$align = '';
$alt = esc_attr( wp_unslash( $_POST['alt'] ) );
@@ -942,7 +942,7 @@ function wp_media_upload_handler() {
* @param string $align The image alignment. Default 'alignnone'. Possible values include
* 'alignleft', 'aligncenter', 'alignright', 'alignnone'.
*/
$html = apply_filters( 'image_send_to_editor_url', $html, esc_url_raw( $src ), $alt, $align );
$html = apply_filters( 'image_send_to_editor_url', $html, sanitize_url( $src ), $alt, $align );
}
return media_send_to_editor( $html );

2
src/wp-admin/includes/post.php
View File

@@ -322,7 +322,7 @@ function edit_post( $post_data = null ) {
foreach ( $format_meta_urls as $format_meta_url ) {
$keyed = '_format_' . $format_meta_url;
if ( isset( $post_data[ $keyed ] ) ) {
update_post_meta( $post_ID, $keyed, wp_slash( esc_url_raw( wp_unslash( $post_data[ $keyed ] ) ) ) );
update_post_meta( $post_ID, $keyed, wp_slash( sanitize_url( wp_unslash( $post_data[ $keyed ] ) ) ) );
}
}

4
src/wp-admin/includes/privacy-tools.php
View File

@@ -706,10 +706,10 @@ All at ###SITENAME###
$content = apply_filters( 'wp_privacy_personal_data_email_content', $email_text, $request_id, $email_data );
$content = str_replace( '###EXPIRATION###', $expiration_date, $content );
$content = str_replace( '###LINK###', esc_url_raw( $export_file_url ), $content );
$content = str_replace( '###LINK###', sanitize_url( $export_file_url ), $content );
$content = str_replace( '###EMAIL###', $request_email, $content );
$content = str_replace( '###SITENAME###', $site_name, $content );
$content = str_replace( '###SITEURL###', esc_url_raw( $site_url ), $content );
$content = str_replace( '###SITEURL###', sanitize_url( $site_url ), $content );
$headers = '';

2
src/wp-admin/includes/theme.php
View File

@@ -712,7 +712,7 @@ function wp_prepare_themes_for_js( $themes = null ) {
$customize_action = esc_url(
add_query_arg(
array(
'return' => urlencode( esc_url_raw( remove_query_arg( wp_removable_query_args(), wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) ),
'return' => urlencode( sanitize_url( remove_query_arg( wp_removable_query_args(), wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) ),
),
wp_customize_url( $slug )
)

2
src/wp-admin/includes/user.php
View File

@@ -84,7 +84,7 @@ function edit_user( $user_id = 0 ) {
if ( empty( $_POST['url'] ) || 'http://' === $_POST['url'] ) {
$user->user_url = '';
} else {
$user->user_url = esc_url_raw( $_POST['url'] );
$user->user_url = sanitize_url( $_POST['url'] );
$protocols = implode( '|', array_map( 'preg_quote', wp_allowed_protocols() ) );
$user->user_url = preg_match( '/^(' . $protocols . '):/is', $user->user_url ) ? $user->user_url : 'http://' . $user->user_url;
}

4
src/wp-admin/network/site-info.php
View File

@@ -90,7 +90,7 @@ if ( isset( $_REQUEST['action'] ) && 'update-site' === $_REQUEST['action'] ) {
$old_home_parsed = parse_url( $old_home_url );
if ( $old_home_parsed['host'] === $existing_details->domain && $old_home_parsed['path'] === $existing_details->path ) {
$new_home_url = untrailingslashit( esc_url_raw( $blog_data['scheme'] . '://' . $new_details->domain . $new_details->path ) );
$new_home_url = untrailingslashit( sanitize_url( $blog_data['scheme'] . '://' . $new_details->domain . $new_details->path ) );
update_option( 'home', $new_home_url );
}
@@ -98,7 +98,7 @@ if ( isset( $_REQUEST['action'] ) && 'update-site' === $_REQUEST['action'] ) {
$old_site_parsed = parse_url( $old_site_url );
if ( $old_site_parsed['host'] === $existing_details->domain && $old_site_parsed['path'] === $existing_details->path ) {
$new_site_url = untrailingslashit( esc_url_raw( $blog_data['scheme'] . '://' . $new_details->domain . $new_details->path ) );
$new_site_url = untrailingslashit( sanitize_url( $blog_data['scheme'] . '://' . $new_details->domain . $new_details->path ) );
update_option( 'siteurl', $new_site_url );
}

2
src/wp-admin/term.php
View File

@@ -20,7 +20,7 @@ if ( empty( $_REQUEST['tag_ID'] ) ) {
$sendback = add_query_arg( 'post_type', get_current_screen()->post_type, $sendback );
}
wp_redirect( esc_url_raw( $sendback ) );
wp_redirect( sanitize_url( $sendback ) );
exit;
}

2
src/wp-admin/upgrade.php
View File

@@ -133,7 +133,7 @@ else :
case 0:
$goback = wp_get_referer();
if ( $goback ) {
$goback = esc_url_raw( $goback );
$goback = sanitize_url( $goback );
$goback = urlencode( $goback );
}
?>

2
src/wp-admin/user-edit.php
View File

@@ -209,7 +209,7 @@ switch ( $action ) {
<p><strong><?php _e( 'User updated.' ); ?></strong></p>
<?php endif; ?>
<?php if ( $wp_http_referer && false === strpos( $wp_http_referer, 'user-new.php' ) && ! IS_PROFILE_PAGE ) : ?>
<p><a href="<?php echo esc_url( wp_validate_redirect( esc_url_raw( $wp_http_referer ), self_admin_url( 'users.php' ) ) ); ?>"><?php _e( '&larr; Go to Users' ); ?></a></p>
<p><a href="<?php echo esc_url( wp_validate_redirect( sanitize_url( $wp_http_referer ), self_admin_url( 'users.php' ) ) ); ?>"><?php _e( '&larr; Go to Users' ); ?></a></p>
<?php endif; ?>
</div>
<?php endif; ?>