Skip to content

Commit 0f71682

Browse files
peterwilsonccpeterwilsoncc
committed
Grouped backports for the 6.1 branch.
- XML-RPC: Switch to `wp_safe_remote()` when fetching a pingback URL. - HTML API: Prevent `WP_HTML_Tag_Processor` instances being unserialized and add some extra logic for validating pattern and template file paths. - KSES: Optimize PCRE pattern detecting numeric character references. - Customize: Improve escaping approach used for nav menu attributes. - Media: Ensure the attachment parent is accessible to the user before showing a link to it in the media manager. - Administration: Ensure client-side templates are only detected when they're correctly associated with a script tag. - Filesystem API: Don't attempt to extract invalid files from a zip when using the PclZip library. - Media: Disable XML entity substitution in getID3. Merges [61879-61885,61887,61889-61890,61913] to the 6.1 branch. Props johnbillion, xknown, dmsnell, jorbin, peterwilson, desrosj, westonruter, jonsurrell, aurdasjb. git-svn-id: https://develop.svn.wordpress.org/branches/6.1@61950 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 61c6af4 commit 0f71682

11 files changed

Lines changed: 35 additions & 24 deletions

File tree

‎src/js/_enqueues/wp/util.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,11 @@ window.wp = window.wp || {};
3636
};
3737

3838
return function ( data ) {
39-
if ( ! document.getElementById( 'tmpl-' + id ) ) {
39+
var el = document.querySelector( 'script#tmpl-' + id );
40+
if ( ! el ) {
4041
throw new Error( 'Template not found: ' + '#tmpl-' + id );
4142
}
42-
compiled = compiled || _.template( $( '#tmpl-' + id ).html(), options );
43+
compiled = compiled || _.template( $( el ).html(), options );
4344
return compiled( data );
4445
};
4546
});

‎src/wp-admin/includes/class-walker-nav-menu-checklist.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -116,12 +116,12 @@ public function start_el( &$output, $data_object, $depth = 0, $args = null, $cur
116116
$output .= '<input type="hidden" class="menu-item-object" name="menu-item[' . $possible_object_id . '][menu-item-object]" value="' . esc_attr( $menu_item->object ) . '" />';
117117
$output .= '<input type="hidden" class="menu-item-parent-id" name="menu-item[' . $possible_object_id . '][menu-item-parent-id]" value="' . esc_attr( $menu_item->menu_item_parent ) . '" />';
118118
$output .= '<input type="hidden" class="menu-item-type" name="menu-item[' . $possible_object_id . '][menu-item-type]" value="' . esc_attr( $menu_item->type ) . '" />';
119-
$output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . esc_attr( $menu_item->title ) . '" />';
119+
$output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . htmlspecialchars( $menu_item->title, ENT_QUOTES ) . '" />';
120120
$output .= '<input type="hidden" class="menu-item-url" name="menu-item[' . $possible_object_id . '][menu-item-url]" value="' . esc_attr( $menu_item->url ) . '" />';
121121
$output .= '<input type="hidden" class="menu-item-target" name="menu-item[' . $possible_object_id . '][menu-item-target]" value="' . esc_attr( $menu_item->target ) . '" />';
122-
$output .= '<input type="hidden" class="menu-item-attr-title" name="menu-item[' . $possible_object_id . '][menu-item-attr-title]" value="' . esc_attr( $menu_item->attr_title ) . '" />';
123-
$output .= '<input type="hidden" class="menu-item-classes" name="menu-item[' . $possible_object_id . '][menu-item-classes]" value="' . esc_attr( implode( ' ', $menu_item->classes ) ) . '" />';
124-
$output .= '<input type="hidden" class="menu-item-xfn" name="menu-item[' . $possible_object_id . '][menu-item-xfn]" value="' . esc_attr( $menu_item->xfn ) . '" />';
122+
$output .= '<input type="hidden" class="menu-item-attr-title" name="menu-item[' . $possible_object_id . '][menu-item-attr-title]" value="' . htmlspecialchars( $menu_item->attr_title, ENT_QUOTES ) . '" />';
123+
$output .= '<input type="hidden" class="menu-item-classes" name="menu-item[' . $possible_object_id . '][menu-item-classes]" value="' . htmlspecialchars( implode( ' ', $menu_item->classes ), ENT_QUOTES ) . '" />';
124+
$output .= '<input type="hidden" class="menu-item-xfn" name="menu-item[' . $possible_object_id . '][menu-item-xfn]" value="' . htmlspecialchars( $menu_item->xfn, ENT_QUOTES ) . '" />';
125125
}
126126

127127
}

‎src/wp-admin/includes/class-walker-nav-menu-edit.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -201,13 +201,13 @@ public function start_el( &$output, $data_object, $depth = 0, $args = null, $cur
201201
<p class="description description-wide">
202202
<label for="edit-menu-item-title-<?php echo $item_id; ?>">
203203
<?php _e( 'Navigation Label' ); ?><br />
204-
<input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->title ); ?>" />
204+
<input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->title, ENT_QUOTES ); ?>" />
205205
</label>
206206
</p>
207207
<p class="field-title-attribute field-attr-title description description-wide">
208208
<label for="edit-menu-item-attr-title-<?php echo $item_id; ?>">
209209
<?php _e( 'Title Attribute' ); ?><br />
210-
<input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->post_excerpt ); ?>" />
210+
<input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->post_excerpt, ENT_QUOTES ); ?>" />
211211
</label>
212212
</p>
213213
<p class="field-link-target description">
@@ -219,13 +219,13 @@ public function start_el( &$output, $data_object, $depth = 0, $args = null, $cur
219219
<p class="field-css-classes description description-thin">
220220
<label for="edit-menu-item-classes-<?php echo $item_id; ?>">
221221
<?php _e( 'CSS Classes (optional)' ); ?><br />
222-
<input type="text" id="edit-menu-item-classes-<?php echo $item_id; ?>" class="widefat code edit-menu-item-classes" name="menu-item-classes[<?php echo $item_id; ?>]" value="<?php echo esc_attr( implode( ' ', $menu_item->classes ) ); ?>" />
222+
<input type="text" id="edit-menu-item-classes-<?php echo $item_id; ?>" class="widefat code edit-menu-item-classes" name="menu-item-classes[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( implode( ' ', $menu_item->classes ), ENT_QUOTES ); ?>" />
223223
</label>
224224
</p>
225225
<p class="field-xfn description description-thin">
226226
<label for="edit-menu-item-xfn-<?php echo $item_id; ?>">
227227
<?php _e( 'Link Relationship (XFN)' ); ?><br />
228-
<input type="text" id="edit-menu-item-xfn-<?php echo $item_id; ?>" class="widefat code edit-menu-item-xfn" name="menu-item-xfn[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->xfn ); ?>" />
228+
<input type="text" id="edit-menu-item-xfn-<?php echo $item_id; ?>" class="widefat code edit-menu-item-xfn" name="menu-item-xfn[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->xfn, ENT_QUOTES ); ?>" />
229229
</label>
230230
</p>
231231
<p class="field-description description description-wide">

‎src/wp-admin/includes/file.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1797,6 +1797,11 @@ function _unzip_file_pclzip( $file, $to, $needed_dirs = array() ) {
17971797
continue;
17981798
}
17991799

1800+
// Don't extract invalid files:
1801+
if ( 0 !== validate_file( $file['filename'] ) ) {
1802+
continue;
1803+
}
1804+
18001805
$uncompressed_size += $file['size'];
18011806

18021807
$needed_dirs[] = $to . untrailingslashit( $file['folder'] ? $file['filename'] : dirname( $file['filename'] ) );

‎src/wp-includes/ID3/getid3.lib.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@
1313

1414
if(!defined('GETID3_LIBXML_OPTIONS') && defined('LIBXML_VERSION')) {
1515
if(LIBXML_VERSION >= 20621) {
16-
define('GETID3_LIBXML_OPTIONS', LIBXML_NOENT | LIBXML_NONET | LIBXML_NOWARNING | LIBXML_COMPACT);
16+
define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOWARNING | LIBXML_COMPACT);
1717
} else {
18-
define('GETID3_LIBXML_OPTIONS', LIBXML_NOENT | LIBXML_NONET | LIBXML_NOWARNING);
18+
define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOWARNING);
1919
}
2020
}
2121

‎src/wp-includes/class-wp-http-ixr-client.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ public function query( ...$args ) {
8989
echo '<pre class="ixr_request">' . htmlspecialchars( $xml ) . "\n</pre>\n\n";
9090
}
9191

92-
$response = wp_remote_post( $url, $args );
92+
$response = wp_safe_remote_post( $url, $args );
9393

9494
if ( is_wp_error( $response ) ) {
9595
$errno = $response->get_error_code();

‎src/wp-includes/kses.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1842,8 +1842,8 @@ function wp_kses_normalize_entities( $string, $context = 'html' ) {
18421842
} else {
18431843
$string = preg_replace_callback( '/&amp;([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string );
18441844
}
1845-
$string = preg_replace_callback( '/&amp;#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $string );
1846-
$string = preg_replace_callback( '/&amp;#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $string );
1845+
$string = preg_replace_callback( '/&amp;#(0*[1-9][0-9]{0,6});/', 'wp_kses_normalize_entities2', $string );
1846+
$string = preg_replace_callback( '/&amp;#[Xx](0*[1-9A-Fa-f][0-9A-Fa-f]{0,5});/', 'wp_kses_normalize_entities3', $string );
18471847

18481848
return $string;
18491849
}

‎src/wp-includes/media.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4186,7 +4186,7 @@ function wp_prepare_attachment_for_js( $attachment ) {
41864186

41874187
if ( $attachment->post_parent ) {
41884188
$post_parent = get_post( $attachment->post_parent );
4189-
if ( $post_parent ) {
4189+
if ( $post_parent && current_user_can( 'read_post', $attachment->post_parent ) ) {
41904190
$response['uploadedToTitle'] = $post_parent->post_title ? $post_parent->post_title : __( '(no title)' );
41914191
$response['uploadedToLink'] = get_edit_post_link( $attachment->post_parent, 'raw' );
41924192
}

‎src/wp-includes/nav-menu.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -496,7 +496,7 @@ function wp_update_nav_menu_item( $menu_id = 0, $menu_item_db_id = 0, $menu_item
496496
}
497497
}
498498

499-
if ( wp_unslash( $args['menu-item-title'] ) === wp_specialchars_decode( $original_title ) ) {
499+
if ( wp_unslash( $args['menu-item-title'] ) === $original_title ) {
500500
$args['menu-item-title'] = '';
501501
}
502502

‎src/wp-includes/template-loader.php‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,8 +101,15 @@
101101
*
102102
* @param string $template The path of the template to include.
103103
*/
104-
$template = apply_filters( 'template_include', $template );
105-
if ( $template ) {
104+
$template = apply_filters( 'template_include', $template );
105+
$is_stringy = is_string( $template ) || ( is_object( $template ) && method_exists( $template, '__toString' ) );
106+
$template = $is_stringy ? realpath( (string) $template ) : null;
107+
if (
108+
is_string( $template ) &&
109+
( str_ends_with( $template, '.php' ) || str_ends_with( $template, '.html' ) ) &&
110+
is_file( $template ) &&
111+
is_readable( $template )
112+
) {
106113
include $template;
107114
} elseif ( current_user_can( 'switch_themes' ) ) {
108115
$theme = wp_get_theme();

0 commit comments

Comments
 (0)