Strip control characters before validating redirect.

git-svn-id: https://develop.svn.wordpress.org/trunk@40183 602fd350-edb4-49c9-b593-d223f7449a82

src/wp-includes/pluggable.php

@@ -1293,7 +1293,7 @@ if ( !function_exists('wp_validate_redirect') ) :
  * @return string redirect-sanitized URL
  **/
 function wp_validate_redirect($location, $default = '') {
-	$location = trim( $location );
+	$location = trim( $location, " \t\n\r\0\x08\x0B" );
 	// browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
 	if ( substr($location, 0, 2) == '//' )
 		$location = 'http:' . $location;