Changeset 12232 for sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

Timestamp:

11/10/2022 03:59:53 AM (2 years ago)

Author:

dd32

Message:

Login: SSO: Pass a full URI to _safe_redirect() and remove relative-url support.

Supporting relative URIs causes some redirects to land on the incorrect domain.

File:

• sites/trunk/common/includes/wporg-sso/class-wporg-sso.php (modified) (1 diff)

sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

@@ -231 +231 @@
             }
 
-            // If it's a full URI, validate the host.
-            if ( ! str_starts_with( $to, '/' ) && ! $this->_is_valid_targeted_domain( $to ) ) {
+            // This function MUST be passed a full URI, a relative or root-relative URI is not valid.
+            if ( ! $this->_is_valid_targeted_domain( $to ) ) {
                 $to = $this->_get_safer_redirect_to();
             }