Changeset 40470

Timestamp:

04/17/2017 01:47:40 PM (9 years ago)

Author:

swissspidy

Message:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 3.7 branch.

Location:

branches/3.7

Files:

• . (modified) (1 prop)
• src (modified) (1 prop)
• src/wp-admin/includes/media.php (modified) (3 diffs)

branches/3.7/src/wp-admin/includes/media.php

@@ -2582 +2582 @@
                         foreach ( $data[$version]['comments'] as $key => $list ) {
                                 if ( ! empty( $list ) ) {
-                                        $metadata[$key] = reset( $list );
+                                        $metadata[$key] = wp_kses_post( reset( $list ) );
                                         // fix bug in byte stream analysis
                                         if ( 'terms_of_use' === $key && 0 === strpos( $metadata[$key], 'yright notice.' ) )
@@ -2666 +2666 @@
         wp_add_id3_tag_data( $metadata, $data );
 
-        $metadata = wp_kses_post_deep( $metadata );
-
         return $metadata;
 }
@@ -2707 +2705 @@
         wp_add_id3_tag_data( $metadata, $data );
 
-        $metadata = wp_kses_post_deep( $metadata );
-
         return $metadata;
 }