← All changes | src/DonationForms/DataTransferObjects/DonateFormRouteData.php +27 -1 4.16.3 → 4.17.0 View file →

		@@ -43,8 +43,9 @@
43	43
44	44	/**
45	45	* Convert data from request into DTO
46	46	*
	47	+ * @since 4.17.0 Validate the client-provided origin URL before it is used in redirects.
47	48	* @since 3.0.0
48	49	*/
49	50	public static function fromRequest(array $requestData): self
50	51	{
		@@ -50,9 +51,9 @@
50	51	{
51	52	$self = new self();
52	53	$self->formId = (int)$requestData['formId'];
53	54	$self->gatewayId = $requestData['gatewayId'];
54		- $self->originUrl = $requestData['originUrl'];
	55	+ $self->originUrl = self::validateOriginUrl($requestData['originUrl'] ?? '');
55	56	$self->isEmbed = filter_var($requestData['isEmbed'], FILTER_VALIDATE_BOOLEAN);
56	57	$self->embedId = $self->isEmbed ? $requestData['embedId'] : null;
57	58	$self->requestData = $requestData;
58	59
		@@ -117,8 +118,33 @@
117	118	*/
118	119	public function getRequestData(): array
119	120	{
120	121	return $this->requestData;
	122	+ }
	123	+
	124	+ /**
	125	+ * The origin URL is client-provided and later used as a redirect target,
	126	+ * so anything that is not a valid http(s) URL falls back to the site URL.
	127	+ * Intentionally not wp_http_validate_url(), which rejects localhost hosts
	128	+ * that are valid embed origins during development.
	129	+ *
	130	+ * @since 4.17.0
	131	+ *
	132	+ * @param mixed $originUrl
	133	+ */
	134	+ private static function validateOriginUrl($originUrl): string
	135	+ {
	136	+ if (!is_string($originUrl) || $originUrl === '') {
	137	+ return '';
	138	+ }
	139	+
	140	+ $scheme = wp_parse_url($originUrl, PHP_URL_SCHEME);
	141	+
	142	+ if (in_array($scheme, ['http', 'https'], true) && filter_var($originUrl, FILTER_VALIDATE_URL)) {
	143	+ return $originUrl;
	144	+ }
	145	+
	146	+ return home_url();
121	147	}
122	148
123	149	/**
124	150	* This loops over an array of errors in the specific FieldAPI format,