Ticket #54160: 54160.2.diff

wp-includes/theme.php

@@ -3357 +3357 @@
         );
 
         $theme             = null;
         $autosaved         = null;
         $messenger_channel = null;
 
         // Value false indicates UUID should be determined after_setup_theme
         // to either re-use existing saved changeset or else generate a new UUID if none exists.
         $changeset_uuid = false;
 
         // Set initially fo false since defaults to true for back-compat;
         // can be overridden via the customize_changeset_branching filter.
         $branching = false;
 
         if ( $is_customize_admin_page && isset( $input_vars['changeset_uuid'] ) ) {
-                $changeset_uuid = sanitize_key( $input_vars['changeset_uuid'] );
+                $changeset_uuid = $input_vars['changeset_uuid'];
         } elseif ( ! empty( $input_vars['customize_changeset_uuid'] ) ) {
-                $changeset_uuid = sanitize_key( $input_vars['customize_changeset_uuid'] );
+                $changeset_uuid = $input_vars['customize_changeset_uuid'];
+        }
+
+        // Sanitize UUID
+        if ( $changeset_uuid && ! wp_is_uuid( $changeset_uuid ) ) {
+                $changeset_uuid = false;
         }
 
         // Note that theme will be sanitized via WP_Theme.
         if ( $is_customize_admin_page && isset( $input_vars['theme'] ) ) {
                 $theme = $input_vars['theme'];
         } elseif ( isset( $input_vars['customize_theme'] ) ) {
                 $theme = $input_vars['customize_theme'];
         }
 
         if ( ! empty( $input_vars['customize_autosaved'] ) ) {
                 $autosaved = true;
         }
 
-        if ( isset( $input_vars['customize_messenger_channel'] ) ) {
+        if ( isset( $input_vars['customize_messenger_channel'] ) && is_string( $input_vars['customize_messenger_channel'] ) ) {
                 $messenger_channel = sanitize_key( $input_vars['customize_messenger_channel'] );
         }
 
         /*
          * Note that settings must be previewed even outside the customizer preview
          * and also in the customizer pane itself. This is to enable loading an existing
          * changeset into the customizer. Previewing the settings only has to be prevented
          * here in the case of a customize_save action because this will cause WP to think
          * there is nothing changed that needs to be saved.
          */
         $is_customize_save_action = (
                 wp_doing_ajax()
                 &&
                 isset( $_REQUEST['action'] )
                 &&