Changeset 32318

Timestamp:

04/27/2015 06:34:09 PM (11 years ago)

Author:

mdawaffe

Message:

3.7:

• WPDB: Sanity check that any strings being stored in the DB are not too long to store correctly.
• When upgrading, remove any suspicious comments.

Location:

branches/3.7

Files:

• package.json (modified) (1 diff)
• src/readme.html (modified) (1 diff)
• src/wp-admin/about.php (modified) (1 diff)
• src/wp-admin/includes/upgrade.php (modified) (2 diffs)
• src/wp-includes/version.php (modified) (1 diff)
• src/wp-includes/wp-db.php (modified) (3 diffs)
• tests/phpunit/tests/comment.php (modified) (1 diff)
• tests/phpunit/tests/db.php (modified) (1 diff)

branches/3.7/package.json

@@ -1 +1 @@
 {
   "name": "WordPress",
-  "version": "3.7.7",
+  "version": "3.7.8",
   "description": "WordPress is web software you can use to create a beautiful website or blog.",
   "repository": {

branches/3.7/src/readme.html

@@ -9 +9 @@
 <h1 id="logo">
         <a href="http://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
-        <br /> Version 3.7.7
+        <br /> Version 3.7.8
 </h1>
 <p style="text-align: center">Semantic Personal Publishing Platform</p>

branches/3.7/src/wp-admin/about.php

@@ -37 +37 @@
 
 <div class="changelog point-releases">
-        <h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 7 ); ?></h3>
+        <h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 8 ); ?></h3>
+        <p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 1 ), '3.7.8' ); ?>
+                <?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.7.8' ); ?>
+        </p>
         <p><?php printf( _n( '<strong>Version %1$s</strong> addressed %2$s bug.',
          '<strong>Version %1$s</strong> addressed %2$s bugs.', 1 ), '3.7.7', number_format_i18n( 1 ) ); ?>

branches/3.7/src/wp-admin/includes/upgrade.php

@@ -412 +412 @@
                 upgrade_373();
 
+        if ( $wp_current_db_version < 26150 )
+                upgrade_378();
+
         maybe_disable_link_manager();
 
@@ -1266 +1269 @@
                         $wpdb->update( $wpdb->posts, array( 'post_status' => 'draft' ), array( 'ID' => $post->ID ) );
                         clean_post_cache( $post->ID );
+                }
+        }
+}
+
+/**
+ * Execute changes made in WordPress 3.7.8.
+ *
+ * @since 3.7.8
+ */
+function upgrade_378() {
+        global $wp_current_db_version, $wpdb;
+
+        if ( $wp_current_db_version < 26150 ) {
+                $content_length = $wpdb->get_col_length( $wpdb->comments, 'comment_content' );
+                if ( ! $content_length ) {
+                        $content_length = 65535;
+                }
+
+                $comments = $wpdb->get_results(
+                        "SELECT comment_ID FROM $wpdb->comments
+                        WHERE comment_date_gmt > '2015-04-26'
+                        AND CHAR_LENGTH( comment_content ) >= $content_length
+                        AND ( comment_content LIKE '%<%' OR comment_content LIKE '%>%' )"
+                );
+
+                foreach ( $comments as $comment ) {
+                        wp_delete_comment( $comment->comment_ID, true );
                 }
         }

branches/3.7/src/wp-includes/version.php

@@ -12 +12 @@
  * @global int $wp_db_version
  */
-$wp_db_version = 26149;
+$wp_db_version = 26150;
 
 /**

branches/3.7/src/wp-includes/wp-db.php

@@ -1514 +1514 @@
         protected function process_fields( $table, $data, $format ) {
                 $data = $this->process_field_formats( $data, $format );
+                if ( false === $data ) {
+                        return false;
+                }
+
                 $data = $this->process_field_charsets( $data, $table );
+                if ( false === $data ) {
+                        return false;
+                }
+
+                $data = $this->process_field_lengths( $data, $table );
                 if ( false === $data ) {
                         return false;
@@ -1591 +1600 @@
                                 // This isn't ASCII. Don't have strip_invalid_text() re-check.
                                 $value['ascii'] = false;
+                        }
+
+                        $data[ $field ] = $value;
+                }
+
+                return $data;
+        }
+
+        /**
+         * For string fields, record the maximum string length that field can safely save.
+         *
+         * @since 4.2.1
+         * @access protected
+         *
+         * @param array  $data  As it comes from the wpdb::process_field_charsets() method.
+         * @param string $table Table name.
+         * @return array|False The same array as $data with additional 'length' keys, or false if
+         *                     any of the values were too long for their corresponding field.
+         */
+        protected function process_field_lengths( $data, $table ) {
+                foreach ( $data as $field => $value ) {
+                        if ( '%d' === $value['format'] || '%f' === $value['format'] ) {
+                                // We can skip this field if we know it isn't a string.
+                                // This checks %d/%f versus ! %s because it's sprintf() could take more.
+                                $value['length'] = false;
+                        } else {
+                                $value['length'] = $this->get_col_length( $table, $field );
+                                if ( is_wp_error( $value['length'] ) ) {
+                                        return false;
+                                }
+                        }
+
+                        if ( false !== $value['length'] && strlen( $value['value'] ) > $value['length'] ) {
+                                return false;
                         }
 
@@ -1915 +1958 @@
 
         /**
+         * Retrieve the maximum string length allowed in a given column.
+         *
+         * @since 4.2.1
+         * @access public
+         *
+         * @param string $table  Table name.
+         * @param string $column Column name.
+         * @return mixed Max column length as an int. False if the column has no
+         *               length. WP_Error object if there was an error.
+         */
+        public function get_col_length( $table, $column ) {
+                $tablekey = strtolower( $table );
+                $columnkey = strtolower( $column );
+
+                // Skip this entirely if this isn't a MySQL database.
+                if ( false === $this->is_mysql ) {
+                        return false;
+                }
+
+                if ( empty( $this->col_meta[ $tablekey ] ) ) {
+                        // This primes column information for us.
+                        $table_charset = $this->get_table_charset( $table );
+                        if ( is_wp_error( $table_charset ) ) {
+                                return $table_charset;
+                        }
+                }
+
+                if ( empty( $this->col_meta[ $tablekey ][ $columnkey ] ) ) {
+                        return false;
+                }
+
+                $typeinfo = explode( '(', $this->col_meta[ $tablekey ][ $columnkey ]->Type );
+
+                $type = strtolower( $typeinfo[0] );
+                if ( ! empty( $typeinfo[1] ) ) {
+                        $length = trim( $typeinfo[1], ')' );
+                } else {
+                        $length = false;
+                }
+
+                switch( $type ) {
+                        case 'binary':
+                        case 'char':
+                        case 'varbinary':
+                        case 'varchar':
+                                return $length;
+                                break;
+                        case 'tinyblob':
+                        case 'tinytext':
+                                return 255; // 2^8 - 1
+                                break;
+                        case 'blob':
+                        case 'text':
+                                return 65535; // 2^16 - 1
+                                break;
+                        case 'mediumblob':
+                        case 'mediumtext':
+                                return 16777215; // 2^24 - 1
+                                break;
+                        case 'longblob':
+                        case 'longtext':
+                                return 4294967295; // 2^32 - 1
+                                break;
+                        default:
+                                return false;
+                }
+
+                return false;
+        }
+
+        /**
          * Check if a string is ASCII.
          *

branches/3.7/tests/phpunit/tests/comment.php

@@ -15 +15 @@
                 $this->assertEquals( 0, $result );
         }
+
+        public function test_comment_content_length() {
+                // `wp_new_comment()` checks REMOTE_ADDR, so we fake it to avoid PHP notices.
+                if ( isset( $_SERVER['REMOTE_ADDR'] ) ) {
+                        $remote_addr = $_SERVER['REMOTE_ADDR'];
+                } else {
+                        $_SERVER['REMOTE_ADDR'] = '';
+                }
+
+                $post_id = $this->factory->post->create();
+
+                $data = array(
+                        'comment_post_ID' => $post_id,
+                        'comment_author' => rand_str(),
+                        'comment_author_url' => '',
+                        'comment_author_email' => '',
+                        'comment_type' => '',
+                        'comment_content' => str_repeat( 'A', 65536 ),
+                        'comment_date' => '2011-01-01 10:00:00',
+                        'comment_date_gmt' => '2011-01-01 10:00:00',
+                );
+
+                $id = wp_new_comment( $data );
+
+                $this->assertFalse( $id );
+
+                // Cleanup.
+                if ( isset( $remote_addr ) ) {
+                        $_SERVER['REMOTE_ADDR'] = $remote_addr;
+                } else {
+                        unset( $_SERVER['REMOTE_ADDR'] );
+                }
+        }
 }

branches/3.7/tests/phpunit/tests/db.php

@@ -512 +512 @@
                                 'charset' => $expected_charset,
                                 'ascii' => false,
+                                'length' => $wpdb->get_col_length( $wpdb->posts, 'post_content' ),
                         )
                 );