From 37832b72da09feaa26960b1b767342b199e22f6d Mon Sep 17 00:00:00 2001 From: Keith Solomon Date: Tue, 11 Aug 2026 19:09:04 -0500 Subject: [PATCH] Fix download redirect: use wp_redirect() for external URLs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit wp_safe_redirect() rejects external hosts not in WP's allowed list and silently falls back to admin_url() — which is why /download/{id}/ was redirecting to /wp-admin/ on a clean install. Switch to wp_redirect() since the URL is explicitly user-configured. --- projects-portfolio.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/projects-portfolio.php b/projects-portfolio.php index eb43cbe..026e537 100644 --- a/projects-portfolio.php +++ b/projects-portfolio.php @@ -112,7 +112,10 @@ function projects_portfolio_handle_download_redirect() { update_post_meta( $project_id, '_projects_portfolio_download_count', $download_count ); // Redirect to the release ZIP on the project's host. - wp_safe_redirect( esc_url_raw( $download_url ) ); + // Use wp_redirect() (not wp_safe_redirect()) because the destination + // is an external host the user has explicitly configured — wp_safe_redirect + // would reject it and fall back to admin_url(). + wp_redirect( esc_url_raw( $download_url ), 302 ); exit; } else { wp_die(