Changeset 47647 for branches/5.0/src/wp-includes/formatting.php

Timestamp:

04/29/2020 04:13:02 PM (6 years ago)

Author:

whyisjake

Message:

Customize: Add additional filters to Customizer to prevent JSON corruption.
User: Invalidate user_activation_key on password update.
Query: Ensure that only a single post can be returned on date/time based queries.
Cache API: Ensure proper escaping around the stats method in the cache API.
Formatting: Expand sanitize_file_name to have better support for utf8 characters.

Brings the changes in [47633], [47634], [47635], [47636], [47637], and [47638] to the 5.0 branch.

Props: aduth, batmoo, ehti, ellatrix, jorgefilipecosta, nickdaugherty, noisysocks, pento, peterwilsoncc, sergeybiryukov, sstoqnov, talldanwp, westi, westonruter, whyisjake, whyisjake, xknown.

Location:

branches/5.0

Files:

• . (modified) (1 prop)
• src/wp-includes/formatting.php (modified) (2 diffs)

branches/5.0/src/wp-includes/formatting.php

@@ -1777 +1777 @@
         $filename_raw = $filename;
         $special_chars = array("?", "[", "]", "/", "\\", "=", "<", ">", ":", ";", ",", "'", "\"", "&", "$", "#", "*", "(", ")", "|", "~", "`", "!", "{", "}", "%", "+", chr(0));
+
+        // Check for support for utf8 in the installed PCRE library once and store the result in a static.
+        static $utf8_pcre = null;
+        if ( ! isset( $utf8_pcre ) ) {
+                // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                $utf8_pcre = @preg_match( '/^./u', 'a' );
+        }
+
+        if ( ! seems_utf8( $filename ) ) {
+                $_ext     = pathinfo( $filename, PATHINFO_EXTENSION );
+                $_name    = pathinfo( $filename, PATHINFO_FILENAME );
+                $filename = sanitize_title_with_dashes( $_name ) . '.' . $_ext;
+        }
+
+        if ( $utf8_pcre ) {
+                $filename = preg_replace( "#\x{00a0}#siu", ' ', $filename );
+        }
+
         /**
          * Filters the list of characters to remove from a filename.
@@ -1786 +1804 @@
          */
         $special_chars = apply_filters( 'sanitize_file_name_chars', $special_chars, $filename_raw );
-        $filename = preg_replace( "#\x{00a0}#siu", ' ', $filename );
         $filename = str_replace( $special_chars, '', $filename );
         $filename = str_replace( array( '%20', '+' ), '-', $filename );