From 07e1f9a6ca64d3fa370d95e787556c5fa53aecee Mon Sep 17 00:00:00 2001
From: Dominik Schilling <dominikschilling+git@gmail.com>
Date: Tue, 19 Sep 2017 11:11:33 +0000
Subject: [PATCH] Taxonomy/Users: Provide a fallback for incorrect HTTP
 referrers.

Merge of [41398] to the 4.8 branch.

Built from https://develop.svn.wordpress.org/branches/4.8@41417


git-svn-id: http://core.svn.wordpress.org/branches/4.8@41250 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/edit-tag-form.php | 2 +-
 wp-admin/user-edit.php     | 2 +-
 wp-includes/version.php    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/wp-admin/edit-tag-form.php b/wp-admin/edit-tag-form.php
index e3fb222bc9..f2876fb4d1 100644
--- a/wp-admin/edit-tag-form.php
+++ b/wp-admin/edit-tag-form.php
@@ -74,7 +74,7 @@ do_action( "{$taxonomy}_pre_edit_form", $tag, $taxonomy ); ?>
 <div id="message" class="updated">
 	<p><strong><?php echo $message; ?></strong></p>
 	<?php if ( $wp_http_referer ) { ?>
-	<p><a href="<?php echo esc_url( $wp_http_referer ); ?>"><?php
+	<p><a href="<?php echo esc_url( wp_validate_redirect( wp_sanitize_redirect( $wp_http_referer ), admin_url( 'term.php?taxonomy=' . $taxonomy ) ) ); ?>"><?php
 		/* translators: %s: taxonomy name */
 		printf( _x( '&larr; Back to %s', 'admin screen' ), $tax->labels->name );
 	?></a></p>
diff --git a/wp-admin/user-edit.php b/wp-admin/user-edit.php
index 80cef618e5..e7fa0fe4e9 100644
--- a/wp-admin/user-edit.php
+++ b/wp-admin/user-edit.php
@@ -189,7 +189,7 @@ include(ABSPATH . 'wp-admin/admin-header.php');
 	<p><strong><?php _e('User updated.') ?></strong></p>
 	<?php endif; ?>
 	<?php if ( $wp_http_referer && false === strpos( $wp_http_referer, 'user-new.php' ) && ! IS_PROFILE_PAGE ) : ?>
-	<p><a href="<?php echo esc_url( $wp_http_referer ); ?>"><?php _e('&larr; Back to Users'); ?></a></p>
+	<p><a href="<?php echo esc_url( wp_validate_redirect( wp_sanitize_redirect( $wp_http_referer ), self_admin_url( 'users.php' ) ) ); ?>"><?php _e('&larr; Back to Users'); ?></a></p>
 	<?php endif; ?>
 </div>
 <?php endif; ?>
diff --git a/wp-includes/version.php b/wp-includes/version.php
index df1feee170..9f96beb99c 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.8.2-alpha-41412';
+$wp_version = '4.8.2-alpha-41417';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.