Ticket #28926: 28926.patch

src/wp-includes/theme.php

@@ -1040 +1040 @@
         if ( 'remove-header' == $url )
                 return false;
 
+        if ( ! is_file( str_replace( get_site_url(), ABSPATH, $url ) ) )
+                return false;
+
         if ( is_random_header_image() )
                 $url = get_random_header_image();
 
@@ -1149 +1152 @@
         $header_images = array();
 
         // @todo caching
-        $headers = get_posts( array( 'post_type' => 'attachment', 'meta_key' => '_wp_attachment_is_custom_header', 'meta_value' => get_option('stylesheet'), 'orderby' => 'none', 'nopaging' => true ) );
+        $headers = get_posts( array(
+                'post_type'  => 'attachment',
+                'meta_key'   => '_wp_attachment_is_custom_header',
+                'meta_value' => get_option('stylesheet'),
+                'orderby'    => 'none',
+                'nopaging'   => true,
+        ) );
 
         if ( empty( $headers ) )
                 return array();
@@ -1156 +1165 @@
 
         foreach ( (array) $headers as $header ) {
                 $url = esc_url_raw( wp_get_attachment_url( $header->ID ) );
+                if ( ! is_file( str_replace( get_site_url(), ABSPATH, $url ) ) )
+                        continue;
+
                 $header_data = wp_get_attachment_metadata( $header->ID );
                 $header_index = basename($url);
                 $header_images[$header_index] = array();