Customize: Make sure that preview and return URLs are URLs.

Merge of [37527] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@37768


git-svn-id: http://core.svn.wordpress.org/branches/4.5@37733 1a063a9b-81f0-0310-95a4-ce76da25c4cd

wp-includes/class-wp-customize-manager.php

@@ -1542,6 +1542,7 @@ public function get_document_title_template() {
 	 * @param string $preview_url URL to be previewed.
 	 */
 	public function set_preview_url( $preview_url ) {
+		$preview_url = esc_url_raw( $preview_url );
 		$this->preview_url = wp_validate_redirect( $preview_url, home_url( '/' ) );
 	}
 
@@ -1573,6 +1574,7 @@ public function get_preview_url() {
 	 * @param string $return_url URL for return link.
 	 */
 	public function set_return_url( $return_url ) {
+		$return_url = esc_url_raw( $return_url );
 		$return_url = remove_query_arg( wp_removable_query_args(), $return_url );
 		$return_url = wp_validate_redirect( $return_url );
 		$this->return_url = $return_url;

wp-includes/version.php

@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.5.3-alpha-37759';
+$wp_version = '4.5.3-alpha-37768';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.