Ticket #46800: 46800.diff

src/wp-admin/includes/media.php

@@ -357 +357 @@
                         $track_number = explode( '/', $meta['track_number'] );
                         if ( isset( $track_number[1] ) ) {
                                 /* translators: Audio file track information. 1: Audio track number, 2: Total audio tracks */
-                                $content .= ' ' . sprintf( __( 'Track %1$s of %2$s.' ), number_format_i18n( $track_number[0] ), number_format_i18n( $track_number[1] ) );
+                                $content .= ' ' . sprintf( __( 'Track %1$s of %2$s.' ), number_format_i18n( (int) $track_number[0] ), number_format_i18n( (int) $track_number[1] ) );
                         } else {
                                 /* translators: Audio file track information. %s: Audio track number */
-                                $content .= ' ' . sprintf( __( 'Track %s.' ), number_format_i18n( $track_number[0] ) );
+                                $content .= ' ' . sprintf( __( 'Track %s.' ), number_format_i18n( (int) $track_number[0] ) );
                         }
                 }
 
@@ -3282 +3282 @@
 }
 
 /**
+ * Sanitizes metadata extracted from media files.
+ *
+ * Currently only binary strings are sanitized with focus on preventing propagation of
+ * bad character encodings from causing database calls and API endpoints to fail.
+ *
+ * @param array $metadata An existing array with data
+ *
+ * @return array Returns array of sanitized metadata.
+ */
+function wp_sanitize_media_metadata( $metadata ) {
+        if ( ! is_array( $metadata ) || ! function_exists( 'mb_convert_encoding' ) ) {
+                return $metadata;
+        }
+        foreach ( $metadata as $name => $value ) {
+                if ( ! is_string( $value ) ) {
+                        continue;
+                }
+                if ( is_array( $value ) ) {
+                        $value = wp_sanitize_media_metadata( $value );
+                } elseif ( is_string( $value ) && preg_match('~[^\x20-\x7E\t\r\n]~', $value ) > 0 ) {
+                        $encoding = mb_detect_encoding( $value, 'ISO-8859-1, UCS-2' );
+                        $value = $encoding ? mb_convert_encoding( $value, 'UTF-8', $encoding ) : utf8_encode( $value );
+                }
+                $metadata[$name] = $value;
+        }
+        return $metadata;
+}
+
+/**
  * Retrieve metadata from a video file's ID3 tags
  *
  * @since 3.6.0
@@ -3363 +3392 @@
 
         $file_format = isset( $metadata['fileformat'] ) ? $metadata['fileformat'] : null;
 
+        $metadata = wp_sanitize_media_metadata( $metadata );
+
         /**
          * Filters the array of metadata retrieved from a video.
          *
@@ -3434 +3465 @@
 
         wp_add_id3_tag_data( $metadata, $data );
 
+        $metadata = wp_sanitize_media_metadata( $metadata );
+
         return $metadata;
 }
 

src/wp-includes/post.php

@@ -5631 +5631 @@
         }
 
         $data = get_post_meta( $post->ID, '_wp_attachment_metadata', true );
+        $data = wp_sanitize_media_metadata( $data );
 
         if ( $unfiltered ) {
                 return $data;