Changeset 7541

Timestamp:

11/09/2013 01:09:57 PM (12 years ago)

Author:

johnjamesjacoby

Message:

Port updates to bp_verify_nonce_request() from bbPress. Fixes issues with home_url() matching, and allows filtering for advanced configurations.

File:

• trunk/bp-core/bp-core-functions.php (modified) (2 diffs)

trunk/bp-core/bp-core-functions.php

@@ -1424 +1424 @@
 function bp_verify_nonce_request( $action = '', $query_arg = '_wpnonce' ) {
 
-    // Get the home URL
-    $home_url = strtolower( home_url() );
-
-    $requested_url = bp_get_requested_url();
+    /** Home URL **************************************************************/
+
+    // Parse home_url() into pieces to remove query-strings, strange characters,
+    // and other funny things that plugins might to do to it.
+    $parsed_home = parse_url( home_url( '/', ( is_ssl() ? 'https://' : 'http://' ) ) );
+
+    // Maybe include the port, if it's included
+    if ( isset( $parsed_home['port'] ) ) {
+        $parsed_host = $parsed_home['host'] . ':' . $parsed_home['port'];
+    } else {
+        $parsed_host = $parsed_home['host'];
+    }
+
+    // Set the home URL for use in comparisons
+    $home_url = trim( strtolower( $parsed_home['scheme'] . '://' . $parsed_host . $parsed_home['path'] ), '/' );
+
+    /** Requested URL *********************************************************/
+
+    // Maybe include the port, if it's included in home_url()
+    if ( isset( $parsed_home['port'] ) ) {
+        $request_host = $_SERVER['HTTP_HOST'] . ':' . $_SERVER['SERVER_PORT'];
+    } else {
+        $request_host = $_SERVER['HTTP_HOST'];
+    }
+
+    // Build the currently requested URL
+    $scheme        = is_ssl() ? 'https://' : 'http://';
+    $requested_url = strtolower( $scheme . $request_host . $_SERVER['REQUEST_URI'] );
+
+    /** Look for match ********************************************************/
+
+    // Filter the requested URL, for configurations like reverse proxying
+    $matched_url = apply_filters( 'bp_verify_nonce_request_url', $requested_url );
 
     // Check the nonce
@@ -1433 +1462 @@
 
     // Nonce check failed
-    if ( empty( $result ) || empty( $action ) || ( strpos( $requested_url, $home_url ) !== 0 ) )
+    if ( empty( $result ) || empty( $action ) || ( strpos( $matched_url, $home_url ) !== 0 ) ) {
         $result = false;
+    }
 
     // Do extra things