[wp-trac] [WordPress Trac] #24823: Importing attachments fails from intranet blog due to URL validation

[WordPress Trac]

#24823: Importing attachments fails from intranet blog due to URL validation
--------------------------+--------------------
 Reporter:  bbs_felix     |       Owner:
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  3.5.3
Component:  Import        |     Version:  3.5.2
 Severity:  normal        |  Resolution:
 Keywords:  needs-patch   |
--------------------------+--------------------
Changes (by SergeyBiryukov):

 * component:  General => Import
 * milestone:  Awaiting Review => 3.5.3


Old description:

> Scenario:
> * Two Wordpress instances in our local intranet using IPs from the
> 10.0.0.0/8 range.
> * Blog 1 (B1) is a site on an old WP-MU (the version I cannot tell,
> sorry), Blog 2 (B2) is a site on a fresh WP 3.5.2 with Multisite enabled.
> * B1 is supposed to be migrated to B2
> * The Wordpress WXR format is used to export B1
> * The Wordpress Import Plugin is used to import the WXR to B2
> * During import the option to fetch attachments is checked
> * The import of attachment fails with the error message "Remote server
> did not respond"
>
> The bug here comes with [24481] (which means 3.5.1 is unaffected). The
> function wp_http_validate_url (in wp-includes/http.php) is a bit over-
> eager to block internal RFC1918 IPs (or those with DNS names resolving to
> RFC1918 IPs).
> Effectively this blocks communication between blogs hosted in an
> intranet.

New description:

 Scenario:
 * Two WordPress instances in our local intranet using IPs from the
 10.0.0.0/8 range.
 * Blog 1 (B1) is a site on an old WP-MU (the version I cannot tell,
 sorry), Blog 2 (B2) is a site on a fresh WP 3.5.2 with Multisite enabled.
 * B1 is supposed to be migrated to B2
 * The WordPress WXR format is used to export B1
 * The WordPress Import Plugin is used to import the WXR to B2
 * During import the option to fetch attachments is checked
 * The import of attachment fails with the error message "Remote server did
 not respond"

 The bug here comes with [24481] (which means 3.5.1 is unaffected). The
 function wp_http_validate_url (in wp-includes/http.php) is a bit over-
 eager to block internal RFC1918 IPs (or those with DNS names resolving to
 RFC1918 IPs).
 Effectively this blocks communication between blogs hosted in an intranet.

--

Comment:

 Moving for review along with #24646.

--
Ticket URL: <http://core.trac.wordpress.org/ticket/24823#comment:2>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software