[wp-trac] [WordPress Trac] #22612: Filterable default for wp_safe_redirect/wp_validate_redirect

[WordPress Trac]

#22612: Filterable default for wp_safe_redirect/wp_validate_redirect
-------------------------------------+-----------------------------
 Reporter:  batmoo                   |       Owner:
     Type:  enhancement              |      Status:  new
 Priority:  normal                   |   Milestone:  Future Release
Component:  HTTP API                 |     Version:
 Severity:  normal                   |  Resolution:
 Keywords:  has-patch needs-testing  |     Focuses:
-------------------------------------+-----------------------------

Comment (by anubisthejackle):

 After further testing, I realized that the initial patch allowed you to
 hijack the website with some simple malicious code in a plugin. Edge case,
 sure, but it's now fixed in the new patch. In this patch I expanded on to
 also run wp_validate_redirect on the default value passed to
 wp_validate_redirect from the filter. If this is invalid, it again
 defaults to admin_url().

 I also ran into issues with infinite loops due to this, so I expanded
 wp_redirect so that it checks for the current web page, and if $location
 is the same, it doesn't run the redirect.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/22612#comment:5>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform