Ticket #37924: 37924.patch

wp-admin/includes/ajax-actions.php

@@ -3399 +3399 @@
                 ) );
         }
 
-        $stylesheet = sanitize_key( wp_unslash( $_POST['slug'] ) );
+        $stylesheet = sanitize_text_field( wp_unslash( $_POST['slug'] ) );
         $status     = array(
                 'update'     => 'theme',
                 'slug'       => $stylesheet,
@@ -3484 +3484 @@
                 ) );
         }
 
-        $stylesheet = sanitize_key( wp_unslash( $_POST['slug'] ) );
+        $stylesheet = sanitize_text_field( wp_unslash( $_POST['slug'] ) );
         $status     = array(
                 'delete' => 'theme',
                 'slug'   => $stylesheet,