Changeset 27311 for trunk/src/wp-includes/media.php

Timestamp:

02/27/2014 03:19:53 PM (11 years ago)

Author:

wonderboymusic

Message:

Add some security hardening to passed playlist attributes.

Props xknown.
See #26631.

File:

• trunk/src/wp-includes/media.php (modified) (4 diffs)

trunk/src/wp-includes/media.php

@@ -1014 +1014 @@
     }
 
+    if ( ! in_array( $style, array( 'light', 'dark' ), true ) ) {
+        $style = 'light';
+    }
+
     $args = array(
         'post_status' => 'inherit',
@@ -1114 +1118 @@
     $data['tracks'] = $tracks;
 
+    $safe_type = esc_attr( $safe_type );
+    $safe_style = esc_attr( $style );
+
     ob_start();
 
@@ -1120 +1127 @@
         wp_enqueue_script( 'wp-playlist' );
 ?>
-<!--[if lt IE 9]><script>document.createElement('<?php echo $type ?>');</script><![endif]-->
+<!--[if lt IE 9]><script>document.createElement('<?php echo esc_js( $type ) ?>');</script><![endif]-->
 <script type="text/html" id="tmpl-wp-playlist-current-item">
     <# if ( data.image ) { #>
@@ -1155 +1162 @@
 </script>
     <?php endif ?>
-<div class="wp-playlist wp-<?php echo $type ?>-playlist wp-playlist-<?php echo $style ?>">
+<div class="wp-playlist wp-<?php echo $safe_type ?>-playlist wp-playlist-<?php echo $safe_style ?>">
     <?php if ( 'audio' === $type ): ?>
     <div class="wp-playlist-current-item"></div>
     <?php endif ?>
-    <<?php echo $type ?> controls="controls" preload="metadata" width="<?php echo $theme_width ?>"></<?php echo $type ?>>
+    <<?php echo $safe_type ?> controls="controls" preload="metadata" width="<?php echo (int) $theme_width ?>"></<?php echo $safe_type ?>>
     <div class="wp-playlist-next"></div>
     <div class="wp-playlist-prev"></div>