Changeset 11723 for trunk/src/bp-members/classes/class-bp-members-admin.php

Timestamp:

11/02/2017 02:35:03 PM (9 years ago)

Author:

boonebgorges

Message:

Improved sanitization for redirect params on user edit Dashboard pages.

File:

• trunk/src/bp-members/classes/class-bp-members-admin.php (modified) (3 diffs)

trunk/src/bp-members/classes/class-bp-members-admin.php

@@ -681 +681 @@
                 // Conditionally add a referer if it exists in the existing request.
                 if ( ! empty( $_REQUEST['wp_http_referer'] ) ) {
-                        $query_args['wp_http_referer'] = urlencode( stripslashes_deep( $_REQUEST['wp_http_referer'] ) );
+                        $wp_http_referer = wp_unslash( $_REQUEST['wp_http_referer'] );
+                        $wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) );
+                        $query_args['wp_http_referer'] = urlencode( $wp_http_referer );
                 }
 
@@ -920 +922 @@
                 $wp_http_referer = false;
                 if ( ! empty( $_REQUEST['wp_http_referer'] ) ) {
-                        $wp_http_referer = remove_query_arg( array( 'action', 'updated' ), $_REQUEST['wp_http_referer'] );
+                        $wp_http_referer = wp_unslash( $_REQUEST['wp_http_referer'] );
+                        $wp_http_referer = remove_query_arg( array( 'action', 'updated' ), $wp_http_referer );
+                        $wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) );
                 }
 
@@ -1242 +1246 @@
 
                 // Add the referer.
-                $args['wp_http_referer'] = urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) );
+                $wp_http_referer = wp_unslash( $_SERVER['REQUEST_URI'] );
+                $wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) );
+                $args['wp_http_referer'] = urlencode( $wp_http_referer );
 
                 // Add the "Extended" link if the current user can edit this user.