Changeset 46484 for branches/5.2

Timestamp:

10/14/2019 04:33:02 PM (6 years ago)

Author:

whyisjake

Message:

Filesystem API: Prevent directory travelersals when creating new folders.

Reject file paths that contain sub-directory paths.

Props iandunn, xknown, sstoqnov, whyisjake.

Location:

branches/5.2

Files:

• . (modified) (1 prop)
• src/wp-includes/rest-api.php (modified) (1 diff)

branches/5.2/src/wp-includes/rest-api.php

@@ -588 +588 @@
         header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
         header( 'Access-Control-Allow-Credentials: true' );
+        header( 'Vary: Origin', false );
+    } elseif ( ! headers_sent() && 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
+        header( 'Vary: Origin', false );
+    } elseif ( ! headers_sent() && 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
         header( 'Vary: Origin' );
     }