Ticket #63137: 63137.2.patch

src/wp-admin/includes/class-custom-background.php

@@ -536 +536 @@
 
                 $overrides = array( 'test_form' => false );
 
-                $uploaded_file = $_FILES['import'];
+                $uploaded_file = isset( $_FILES['import'] ) ? sanitize_text_field( wp_unslash( $_FILES['import'] ) ) : '';
                 $wp_filetype   = wp_check_filetype_and_ext( $uploaded_file['tmp_name'], $uploaded_file['name'] );
                 if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) ) {
                         wp_die( __( 'The uploaded file is not a valid image. Please try again.' ) );

src/wp-admin/includes/class-custom-image-header.php

@@ -973 +973 @@
         public function step_2_manage_upload() {
                 $overrides = array( 'test_form' => false );
 
-                $uploaded_file = $_FILES['import'];
+                $uploaded_file = isset( $_FILES['import'] ) ? sanitize_text_field( wp_unslash( $_FILES['import'] ) ) : '';
                 $wp_filetype   = wp_check_filetype_and_ext( $uploaded_file['tmp_name'], $uploaded_file['name'] );
 
                 if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) ) {

src/wp-admin/includes/class-wp-ms-themes-list-table.php

@@ -267 +267 @@
         public function _search_callback( $theme ) {
                 static $term = null;
                 if ( is_null( $term ) ) {
-                        $term = wp_unslash( $_REQUEST['s'] );
+                        $term = isset( $_REQUEST['s'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['s'] ) ) : '';
                 }
 
                 foreach ( array( 'Name', 'Description', 'Author', 'Author', 'AuthorURI' ) as $field ) {

src/wp-admin/includes/media.php

@@ -887 +887 @@
         }
 
         if ( ! empty( $_POST['insertonlybutton'] ) ) {
-                $src = $_POST['src'];
+                $src = isset( $_POST['src'] ) ? $_POST['src'] : '';
 
                 if ( ! empty( $src ) && ! strpos( $src, '://' ) ) {
                         $src = "http://$src";
                 }
 
                 if ( isset( $_POST['media_type'] ) && 'image' !== $_POST['media_type'] ) {
-                        $title = esc_html( wp_unslash( $_POST['title'] ) );
+                        $title = isset( $_POST['title'] ) ? esc_html( wp_unslash( $_POST['title'] ) ) : '';
                         if ( empty( $title ) ) {
                                 $title = esc_html( wp_basename( $src ) );
                         }
@@ -934 +934 @@
                         $html = apply_filters( "{$type}_send_to_editor_url", $html, sanitize_url( $src ), $title );
                 } else {
                         $align = '';
-                        $alt   = esc_attr( wp_unslash( $_POST['alt'] ) );
+                        $alt   = isset( $_POST['alt'] ) ? esc_attr( wp_unslash( $_POST['alt'] ) ) : '';
 
                         if ( isset( $_POST['align'] ) ) {
                                 $align = esc_attr( wp_unslash( $_POST['align'] ) );
@@ -2557 +2557 @@
         $redir_tab = 'gallery';
         media_upload_header();
 
-        $post_id         = (int) $_REQUEST['post_id'];
+        $post_id         = isset( $_REQUEST['post_id'] ) ? (int) $_REQUEST['post_id'] : '';
         $form_action_url = admin_url( "media-upload.php?type=$type&tab=gallery&post_id=$post_id" );
         /** This filter is documented in wp-admin/includes/media.php */
         $form_action_url = apply_filters( 'media_upload_form_url', $form_action_url, $type );