diff --git a/src/wp-includes/class-wp-customize-manager.php b/src/wp-includes/class-wp-customize-manager.php index 5b68a76943..4ac25232ff 100644 --- a/src/wp-includes/class-wp-customize-manager.php +++ b/src/wp-includes/class-wp-customize-manager.php @@ -3896,7 +3896,7 @@ final class WP_Customize_Manager { $this->add_setting( 'external_header_video', array( 'theme_supports' => array( 'custom-header', 'video' ), 'transport' => 'postMessage', - 'sanitize_callback' => 'esc_url_raw', + 'sanitize_callback' => array( $this, '_sanitize_external_header_video' ), 'validate_callback' => array( $this, '_validate_external_header_video' ), ) ); @@ -4318,6 +4318,18 @@ final class WP_Customize_Manager { return $validity; } + /** + * Callback for sanitizing the external_header_video value. + * + * @since 4.7.1 + * + * @param string $value URL. + * @return string Sanitized URL. + */ + public function _sanitize_external_header_video( $value ) { + return esc_url_raw( trim( $value ) ); + } + /** * Callback for rendering the custom logo, used in the custom_logo partial. * diff --git a/tests/phpunit/tests/customize/manager.php b/tests/phpunit/tests/customize/manager.php index 39f304f04e..2ead05ea08 100644 --- a/tests/phpunit/tests/customize/manager.php +++ b/tests/phpunit/tests/customize/manager.php @@ -2580,6 +2580,31 @@ class Tests_WP_Customize_Manager extends WP_UnitTestCase { $result = $this->manager->panels(); $this->assertEquals( $panels_sorted, array_keys( $result ) ); } + + /** + * Verify sanitization of external header video URL will trim the whitespaces in the beginning and end of the URL. + * + * @ticket 39125 + */ + function test_sanitize_external_header_video_trim() { + $this->manager->register_controls(); + $setting = $this->manager->get_setting( 'external_header_video' ); + $video_url = 'https://www.youtube.com/watch?v=KiS8rZBeIO0'; + + $whitespaces = array( + ' ', // space + "\t", // horizontal tab + "\n", // line feed + "\r", // carriage return, + "\f", // form feed, + "\v", // vertical tab + ); + + foreach ( $whitespaces as $whitespace ) { + $sanitized = $setting->sanitize( $whitespace . $video_url . $whitespace ); + $this->assertEquals( $video_url, $sanitized ); + } + } } require_once ABSPATH . WPINC . '/class-wp-customize-setting.php';