Changeset 46504 for branches/3.8/src/wp-includes/functions.php

Timestamp:

10/14/2019 07:29:52 PM (6 years ago)

Author:

whyisjake

Message:

Backporting several bug fixes.

• Query: Remove the static query property.
• HTTP API: Protect against hex interpretation.
• Filesystem API: Prevent directory travelersals when creating new folders.
• Administration: Ensure that admin referer nonce is valid.
• REST API: Send a Vary: Origin header on GET requests.
• Customizer: Properly sanitize background images.

Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 3.8 branch.

Location:

branches/3.8

Files:

• . (modified) (1 prop)
• src/wp-includes/functions.php (modified) (1 diff)

branches/3.8/src/wp-includes/functions.php

@@ -1361 +1361 @@
     if ( file_exists( $target ) )
         return @is_dir( $target );
+
+    // Do not allow path traversals.
+    if ( false !== strpos( $target, '../' ) || false !== strpos( $target, '..' . DIRECTORY_SEPARATOR ) ) {
+        return false;
+    }
 
     // We need to find the permissions of the parent folder that exists and inherit that.