WordPress.org
Get WordPress

Plugin Directory

Changeset 3462943


Ignore:
Timestamp:
02/16/2026 10:16:20 PM (6 weeks ago)
Author:
rationalwp
Message:

Fix: sanitize $_SERVERREQUEST_URI? in sitemap fallback paths

File:
1 edited

Legend:

Unmodified
Added
Removed

  • rationalseo/trunk/includes/class-sitemap.php

    r3462935 r3462943  
    115115
    116116        // Fallback: check request URI directly in case rewrite rules are not flushed.
    117         $path = trim( wp_parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH ), '/' );
     117        $request_uri = isset( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
     118        $path        = trim( wp_parse_url( $request_uri, PHP_URL_PATH ), '/' );
    118119        if ( preg_match( '/^sitemap(-[a-z0-9_-]+)?\.xml$/', $path ) ) {
    119120            return false;
    … …  
    131132        // Fallback: match request URI directly if rewrite rules did not set query vars.
    132133        if ( empty( $sitemap ) ) {
    133             $path = trim( wp_parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH ), '/' );
     134            $request_uri = isset( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
     135            $path        = trim( wp_parse_url( $request_uri, PHP_URL_PATH ), '/' );
    134136
    135137            if ( 'sitemap.xml' === $path ) {
Note: See TracChangeset for help on using the changeset viewer.