Changeset 37976

Timestamp:

07/05/2016 04:15:04 PM (4 years ago)

Author:

swissspidy

Message:

Update/Install: Reject invalid messages in the Shiny Updates postMessage handler.

This prevents conflicts with third-party messages (e.g. sent by browser extensions). The updates script expects a specific JSON-encoded message and now bails early if it's not valid JSON.

Fixes #37125.

File:

• trunk/src/wp-admin/js/updates.js (modified) (1 diff)

trunk/src/wp-admin/js/updates.js

@@ -2145 +2145 @@
             }
 
-            message = $.parseJSON( originalEvent.data );
+            try {
+                message = $.parseJSON( originalEvent.data );
+            } catch ( e ) {
+                return;
+            }
 
             if ( 'undefined' === typeof message.action ) {