Ticket #5427: 5427.2.diff

wp-admin/admin.php

@@ -49 +49 @@
 
                 do_action($page_hook);
         } else {
-                if ( validate_file($plugin_page) ) {
+                if ( validate_file($plugin_page) )
                         wp_die(__('Invalid plugin page'));
-                }
 
+                if( ! validate_plugin_page($plugin_page) )
+                        wp_die(__('Invalid plugin page'));
+                
                 if (! file_exists(ABSPATH . PLUGINDIR . "/$plugin_page"))
                         wp_die(sprintf(__('Cannot load %s.'), htmlentities($plugin_page)));
 

wp-admin/includes/file.php

@@ -78 +78 @@
         }
 }
 
+//Checks to see if the given plugin page is registered as a Menu or Submenu.
+function validate_plugin_page($plugin_page){
+        global $menu, $submenu, $pagenow;
+
+        //Check top-level menu's
+        foreach( $menu as $page)
+                if( $plugin_page == $page[2]) 
+                        return true;
+
+        //Check sub-menu's
+        foreach( $submenu[ $pagenow ] as $page)
+                if( $plugin_page == $page[2]) 
+                        return true;
+
+        //The given file has not been loaded as a plugin page.
+        return false;
+}
+
 // array wp_handle_upload ( array &file [, array overrides] )
 // file: reference to a single element of $_FILES. Call the function once for each uploaded file.
 // overrides: an associative array of names=>values to override default variables with extract( $overrides, EXTR_OVERWRITE ).