Ticket #44108: 44108.diff

wp-admin/load-scripts.php

@@ -14 +14 @@
 
 define( 'WPINC', 'wp-includes' );
 
-$load = $_GET['load'];
-if ( is_array( $load ) ) {
-        $load = implode( '', $load );
-}
-
-$load = preg_replace( '/[^a-z0-9,_-]+/i', '', $load );
-$load = array_unique( explode( ',', $load ) );
-
-if ( empty( $load ) ) {
-        exit;
-}
-
 require( ABSPATH . 'wp-admin/includes/noop.php' );
 require( ABSPATH . WPINC . '/script-loader.php' );
 require( ABSPATH . WPINC . '/version.php' );
@@ -47 +35 @@
         exit();
 }
 
+$load =  isset( $_GET['load'] ) ? $_GET['load'] : null;
+if ( $load === null || ! is_array( $load ) || ( is_array( $load ) && count( $load ) === 0 ) ) {
+        header( "HTTP/1.1 400 Bad Request" );
+        exit();
+}
+
+if ( is_array( $load ) ) {
+        $load = implode( '', $load );
+}
+$load = preg_replace( '/[^a-z0-9,_-]+/i', '', $load );
+$load = array_unique( explode( ',', $load ) );
+$load = array_filter( $load );
+
+if ( count( $load ) === 0 ) {
+        header( "HTTP/1.1 400 Bad Request" );
+        exit();
+}
+
 foreach ( $load as $handle ) {
         if ( ! array_key_exists( $handle, $wp_scripts->registered ) ) {
                 continue;

wp-admin/load-styles.php

@@ -18 +18 @@
 require( ABSPATH . WPINC . '/script-loader.php' );
 require( ABSPATH . WPINC . '/version.php' );
 
-$load = $_GET['load'];
-if ( is_array( $load ) ) {
-        $load = implode( '', $load );
-}
-$load = preg_replace( '/[^a-z0-9,_-]+/i', '', $load );
-$load = array_unique( explode( ',', $load ) );
-
-if ( empty( $load ) ) {
-        exit;
-}
-
 $compress       = ( isset( $_GET['c'] ) && $_GET['c'] );
 $force_gzip     = ( $compress && 'gzip' == $_GET['c'] );
 $rtl            = ( isset( $_GET['dir'] ) && 'rtl' == $_GET['dir'] );
@@ -47 +36 @@
         exit();
 }
 
+$load =  isset( $_GET['load'] ) ? $_GET['load'] : null;
+if ( $load === null || ! is_array( $load ) || ( is_array( $load ) && count( $load ) === 0 ) ) {
+        header( "HTTP/1.1 400 Bad Request" );
+        exit();
+}
+
+if ( is_array( $load ) ) {
+        $load = implode( '', $load );
+}
+$load = preg_replace( '/[^a-z0-9,_-]+/i', '', $load );
+$load = array_unique( explode( ',', $load ) );
+$load = array_filter( $load );
+
+if ( count( $load ) === 0 ) {
+        header( "HTTP/1.1 400 Bad Request" );
+        exit();
+}
+
 foreach ( $load as $handle ) {
         if ( ! array_key_exists( $handle, $wp_styles->registered ) ) {
                 continue;