Changeset 3146

Timestamp:

05/14/2016 01:32:14 PM (9 years ago)

Author:

ocean90

Message:

WordPress.org SSO: Encode spaces in $_REQUEST['redirect_to'] so they don't get stripped by wp_sanitize_redirect().

Fixes URLs like https://login.wordpress.org/?redirect_to=https://core.trac.wordpress.org/newticket?component=Networks%20and%20Sites.

File:

• sites/trunk/common/includes/wporg-sso/class-wporg-sso.php (modified) (1 diff)

sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

@@ -101 +101 @@
             if ( ! empty( $_REQUEST['redirect_to'] ) ) {
                 // User is requesting a further redirect afterward, let's make sure it's a legit target.
+                $redirect_to = str_replace( ' ', '%20', $_REQUEST['redirect_to'] ); // Encode spaces.
                 $redirect_to_requested = function_exists( 'wp_sanitize_redirect' ) ? wp_sanitize_redirect( $redirect_to ) : $redirect_to;
                 if ( $this->_is_valid_targeted_domain( $redirect_to_requested ) ) {