Ticket #36766: 36766.diff

src/wp-includes/class-wp-xmlrpc-server.php

@@ -6303 +6303 @@
                         ),
                 );
 
+                // Make sure the resource is a valid one before retrieving it
+                $request = wp_safe_remote_head( $pagelinkedfrom, $http_api_args );
+                $content_type = wp_remote_retrieve_header( $request, 'content-type' );
+                if ( is_wp_error( $request ) ) {
+                        return $this->pingback_error( 16, __( 'The source URL does not exist.' ) );
+                }
+                // Protect Against Someone Trying to Make Us Download Media Files
+                if ( preg_match( '#(image|audio|video|model)/#is', $content_type ) ) {
+                        return $this->pingback_error( 17, __( 'The source URL does not contain a link to the target URL, and so cannot be used as a source.' ) );
+                }
+
                 $request = wp_safe_remote_get( $pagelinkedfrom, $http_api_args );
                 $remote_source = $remote_source_original = wp_remote_retrieve_body( $request );
 
@@ -6320 +6331 @@
                  */
                 $remote_source = apply_filters( 'pre_remote_source', $remote_source, $pagelinkedto );
 
+                // A straight text search of the source
+                $verified = strpos( $remote_source, str_replace( array( 'http://www.', 'http://', 'https://www.', 'https://' ), '', untrailingslashit( preg_replace( '/#.*/', '', $pagelinkedto ) ) ) );
+                /**
+                 * Filter the verification to allow for stricter controls.
+                 *
+                 * @since 4.6.0
+                 *
+                 * @param boolean $verified Is the provided URL in the retrieved source?
+                 * @param string $remote_source Response source for the page linked from.
+                 * @param string $pagelinkedto  URL of the page linked to.
+                 * @param string $content_type  The content type of the remote source.
+                 */
+                $verified = apply_filters( 'ping_source_verified', $verified, $remote_source, $pagelinkedto, $content_type );
+                if ( ! $verified ) { // Link to target not found
+                        return $this->pingback_error( 17, __( 'The source URL does not contain a link to the target URL, and so cannot be used as a source.' ) );
+                }
+
                 // Work around bug in strip_tags():
                 $remote_source = str_replace( '<!DOC', '<DOC', $remote_source );
                 $remote_source = preg_replace( '/[\r\n\t ]+/', ' ', $remote_source ); // normalize spaces
@@ -6382 +6410 @@
 
                 $commentdata = compact(
                         'comment_post_ID', 'comment_author', 'comment_author_url', 'comment_author_email',
-                        'comment_content', 'comment_type', 'remote_source', 'remote_source_original'
+                        'comment_content', 'comment_type', 'remote_source', 'remote_source_original', 'content-type'
                 );
 
                 $comment_ID = wp_new_comment($commentdata);