WordPress.org

Make WordPress Core


Ignore:
Timestamp:
10/14/2019 06:38:34 PM (8 weeks ago)
Author:
whyisjake
Message:

Backporting several bug fixes.

  • Query: Remove the static query property.
  • HTTP API: Protect against hex interpretation.
  • Filesystem API: Prevent directory travelersals when creating new folders.
  • Administration: Ensure that admin referer nonce is valid.
  • REST API: Send a Vary: Origin header on GET requests.

Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 5.0 branch.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/4.9/src/wp-includes/rest-api.php

    r42000 r46493  
    545545        header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
    546546        header( 'Access-Control-Allow-Credentials: true' );
    547         header( 'Vary: Origin' );
     547        header( 'Vary: Origin', false );
     548    } elseif ( ! headers_sent() && 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
     549        header( 'Vary: Origin', false );
    548550    }
    549551
Note: See TracChangeset for help on using the changeset viewer.