Changeset 10374 for sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

Timestamp:

10/13/2020 05:53:57 AM (4 years ago)

Author:

dd32

Message:

WordPress Login: SSO: When performing redirects, sanitize the requested URL prior to processing it.

This prevents notices being caused by malformed inputs.

File:

• sites/trunk/common/includes/wporg-sso/class-wporg-sso.php (modified) (1 diff)

sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

@@ -185 +185 @@
             }
 
+            // When available, sanitize the redirect prior to redirecting.
+            // This isn't strictly needed, but prevents harmless invalid inputs being passed through to the Location header.
+            if ( function_exists( 'wp_sanitize_redirect' ) ) {
+                $to = wp_sanitize_redirect( $to );
+            }
+
             if ( ! $this->_is_valid_targeted_domain( $to ) ) {
                 $to = $this->_get_safer_redirect_to();