← All changes | classes/Visualizer/Remote/Fetch.php +9 -0 4.0.6 → 4.0.8 View file →

		@@ -256,8 +256,17 @@
256	256	private static function validate_url( $url, &$ips = array() ) {
257	257	$ips = array();
258	258	$validated_url = wp_http_validate_url( $url );
259	259	if ( false === $validated_url ) {
	260	+ // WordPress 7.1+ rejects non-public IP literals inside wp_http_validate_url()
	261	+ // itself; older cores let them through to our is_global_ip() check below. Keep
	262	+ // the distinct "unsafe destination" error on every core version so callers can
	263	+ // tell a policy block from a malformed URL.
	264	+ $scheme = strtolower( (string) wp_parse_url( $url, PHP_URL_SCHEME ) );
	265	+ $host = (string) wp_parse_url( $url, PHP_URL_HOST );
	266	+ if ( in_array( $scheme, array( 'http', 'https' ), true ) && filter_var( $host, FILTER_VALIDATE_IP ) && ! self::is_global_ip( $host ) ) {
	267	+ return new WP_Error( 'visualizer_unsafe_remote_url', 'The remote URL resolves to a non-public address.' );
	268	+ }
260	269	return new WP_Error( 'visualizer_invalid_remote_url', 'The remote URL is not allowed.' );
261	270	}
262	271
263	272	$host = strtolower( rtrim( (string) wp_parse_url( $validated_url, PHP_URL_HOST ), '.' ) );