From 84ed6f665faad3e26f555b81b155f435efb9c8b1 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@xwp.co>
Date: Wed, 22 Mar 2017 23:04:42 +0000
Subject: [PATCH] Customize: Prevent links to `customize.php` from being
 generated which have query vars from `wp_removable_query_args()` present.

Props dlh.
See #23367, #32692.
Fixes #31850.

Built from https://develop.svn.wordpress.org/trunk@40313


git-svn-id: http://core.svn.wordpress.org/trunk@40220 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/includes/theme.php | 2 +-
 wp-admin/menu.php           | 2 +-
 wp-admin/nav-menus.php      | 2 +-
 wp-admin/widgets.php        | 2 +-
 wp-includes/version.php     | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/wp-admin/includes/theme.php b/wp-admin/includes/theme.php
index 822fb5b656..c5de5e5c9c 100644
--- a/wp-admin/includes/theme.php
+++ b/wp-admin/includes/theme.php
@@ -578,7 +578,7 @@ function wp_prepare_themes_for_js( $themes = null ) {
 		if ( current_user_can( 'edit_theme_options' ) && current_user_can( 'customize' ) ) {
 			$customize_action = esc_url( add_query_arg(
 				array(
-					'return' => urlencode( esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) ),
+					'return' => urlencode( esc_url_raw( remove_query_arg( wp_removable_query_args(), wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) ),
 				),
 				wp_customize_url( $slug )
 			) );
diff --git a/wp-admin/menu.php b/wp-admin/menu.php
index f258e5639b..42a26ddfcb 100644
--- a/wp-admin/menu.php
+++ b/wp-admin/menu.php
@@ -157,7 +157,7 @@ $appearance_cap = current_user_can( 'switch_themes') ? 'switch_themes' : 'edit_t
 $menu[60] = array( __( 'Appearance' ), $appearance_cap, 'themes.php', '', 'menu-top menu-icon-appearance', 'menu-appearance', 'dashicons-admin-appearance' );
 	$submenu['themes.php'][5] = array( __( 'Themes' ), $appearance_cap, 'themes.php' );
 
-	$customize_url = add_query_arg( 'return', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), 'customize.php' );
+	$customize_url = add_query_arg( 'return', urlencode( remove_query_arg( wp_removable_query_args(), wp_unslash( $_SERVER['REQUEST_URI'] ) ) ), 'customize.php' );
 	$submenu['themes.php'][6] = array( __( 'Customize' ), 'customize', esc_url( $customize_url ), '', 'hide-if-no-customize' );
 
 	if ( current_theme_supports( 'menus' ) || current_theme_supports( 'widgets' ) ) {
diff --git a/wp-admin/nav-menus.php b/wp-admin/nav-menus.php
index 974d910d20..d8fc77f01d 100644
--- a/wp-admin/nav-menus.php
+++ b/wp-admin/nav-menus.php
@@ -584,7 +584,7 @@ require_once( ABSPATH . 'wp-admin/admin-header.php' );
 			' <a class="page-title-action hide-if-no-customize" href="%1$s">%2$s</a>',
 			esc_url( add_query_arg( array(
 				array( 'autofocus' => $focus ),
-				'return' => urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ),
+				'return' => urlencode( remove_query_arg( wp_removable_query_args(), wp_unslash( $_SERVER['REQUEST_URI'] ) ) ),
 			), admin_url( 'customize.php' ) ) ),
 			__( 'Manage with Live Preview' )
 		);
diff --git a/wp-admin/widgets.php b/wp-admin/widgets.php
index 8793cab2d5..db4459b387 100644
--- a/wp-admin/widgets.php
+++ b/wp-admin/widgets.php
@@ -357,7 +357,7 @@ if ( current_user_can( 'customize' ) ) {
 		esc_url( add_query_arg(
 			array(
 				array( 'autofocus' => array( 'panel' => 'widgets' ) ),
-				'return' => urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) )
+				'return' => urlencode( remove_query_arg( wp_removable_query_args(), wp_unslash( $_SERVER['REQUEST_URI'] ) ) )
 			),
 			admin_url( 'customize.php' )
 		) ),
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 18c9b8c71c..625cbee006 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-40312';
+$wp_version = '4.8-alpha-40313';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.