| @@ -256,17 +256,8 @@ | ||
| 256 | 256 | private static function validate_url( $url, &$ips = array() ) { |
| 257 | 257 | $ips = array(); |
| 258 | 258 | $validated_url = wp_http_validate_url( $url ); |
| 259 | 259 | if ( false === $validated_url ) { |
| 260 | - // WordPress 7.1+ rejects non-public IP literals inside wp_http_validate_url() | |
| 261 | - // itself; older cores let them through to our is_global_ip() check below. Keep | |
| 262 | - // the distinct "unsafe destination" error on every core version so callers can | |
| 263 | - // tell a policy block from a malformed URL. | |
| 264 | - $scheme = strtolower( (string) wp_parse_url( $url, PHP_URL_SCHEME ) ); | |
| 265 | - $host = (string) wp_parse_url( $url, PHP_URL_HOST ); | |
| 266 | - if ( in_array( $scheme, array( 'http', 'https' ), true ) && filter_var( $host, FILTER_VALIDATE_IP ) && ! self::is_global_ip( $host ) ) { | |
| 267 | - return new WP_Error( 'visualizer_unsafe_remote_url', 'The remote URL resolves to a non-public address.' ); | |
| 268 | - } | |
| 269 | 260 | return new WP_Error( 'visualizer_invalid_remote_url', 'The remote URL is not allowed.' ); |
| 270 | 261 | } |
| 271 | 262 | |
| 272 | 263 | $host = strtolower( rtrim( (string) wp_parse_url( $validated_url, PHP_URL_HOST ), '.' ) ); |
