Changeset 4552

Timestamp:

12/07/2012 08:01:06 AM (10 years ago)

Author:

johnjamesjacoby

Message:

In bbp_verify_nonce_request(), parse home_url() to remove any strange characters or query-strings that plugins might append to it. Fixes #2070.

File:

• trunk/includes/common/functions.php (modified) (1 diff)

trunk/includes/common/functions.php

@@ -1427 +1427 @@
 function bbp_verify_nonce_request( $action = '', $query_arg = '_wpnonce' ) {
 
-    // Get the home URL
-    $home_url      = strtolower( home_url() );
+    // Parse home_url() into pieces to remove query-strings, strange characters, 
+    // and other funny things that plugins might to do to it.
+    $parsed_home   = parse_url( home_url( '/', ( is_ssl() ? 'https://' : 'http://' ) ) );
+    $home_url      = trim( strtolower( $parsed_home['scheme'] . '://' . $parsed_home['host'] . $parsed_home['path'] ), '/' );
 
     // Build the currently requested URL