Changeset 2166

Timestamp:

12/06/2015 04:46:41 PM (10 years ago)

Author:

stephdau

Message:

WPORG SSO (login.wordpress.org): properly url encoding redirect_to query string parameter.

Location:

sites/trunk/common/includes/wporg-sso

Files:

• bb-plugin.php (modified) (1 diff)
• class-wporg-sso.php (modified) (1 diff)
• wp-plugin.php (modified) (2 diffs)

sites/trunk/common/includes/wporg-sso/bb-plugin.php

@@ -54 +54 @@
                     
                 // Pay extra attention to the post-process redirect_to
-                $redirect_to_sso_login = add_query_arg( 'redirect_to', $this->_get_safer_redirect_to(), $redirect_to_sso_login );
+                $redirect_to_sso_login = add_query_arg( 'redirect_to', urlencode( $this->_get_safer_redirect_to() ), $redirect_to_sso_login );
                 
                 // Redirect to SSO login, trying to pass on a decent redirect_to request.

sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

@@ -74 +74 @@
             if ( ! empty( $redirect_to ) && $this->_is_valid_targeted_domain( $redirect_to ) ) {
                 $redirect_to = preg_replace( '/\/wp-(login|signup)\.php\??.*$/', '/', $redirect_to );
-                $login_url = add_query_arg( 'redirect_to', $redirect_to, $login_url );
+                $login_url = add_query_arg( 'redirect_to', urlencode( $redirect_to ), $login_url );
             }
             return $login_url;

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -45 +45 @@
             if ( preg_match( '/\/wp-signup\.php$/', $this->script ) ) {
                 // If we're on any WP signup screen, redirect to the SSO host one,respecting the user's redirect_to request
-                $this->_safe_redirect( add_query_arg( 'redirect_to', $redirect_req, $this->sso_signup_url ) );
+                $this->_safe_redirect( add_query_arg( 'redirect_to', urlencode( $redirect_req ), $this->sso_signup_url ) );
             
             } else if ( self::SSO_HOST !== $this->host ) {
@@ -59 +59 @@
                     
                     // Pay extra attention to the post-process redirect_to
-                    $redirect_to_sso_login = add_query_arg( 'redirect_to', $redirect_req, $redirect_to_sso_login );
+                    $redirect_to_sso_login = add_query_arg( 'redirect_to', urlencode( $redirect_req ), $redirect_to_sso_login );
                     
                     // And actually redirect to the SSO login