Changeset 47648 for branches/4.9/src/wp-includes/class-wp-customize-manager.php

Timestamp:

04/29/2020 04:15:39 PM (6 years ago)

Author:

whyisjake

Message:

Customize: Add additional filters to Customizer to prevent JSON corruption.
User: Invalidate user_activation_key on password update.
Query: Ensure that only a single post can be returned on date/time based queries.
Cache API: Ensure proper escaping around the stats method in the cache API.
Formatting: Expand sanitize_file_name to have better support for utf8 characters.

Brings the changes in [47633], [47634], [47635], [47637], and [47638] to the 4.9 branch.

Props: batmoo, ehti, nickdaugherty, peterwilsoncc, sergeybiryukov, sstoqnov, westi, westonruter, whyisjake, whyisjake, xknown.

Location:

branches/4.9

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp-customize-manager.php (modified) (3 diffs)

branches/4.9/src/wp-includes/class-wp-customize-manager.php

@@ -2860 +2860 @@
                 add_filter( 'wp_save_post_revision_post_has_changed', array( $this, '_filter_revision_post_has_changed' ), 5, 3 );
 
-                // Update the changeset post. The publish_customize_changeset action will cause the settings in the changeset to be saved via WP_Customize_Setting::save().
-                $has_kses = ( false !== has_filter( 'content_save_pre', 'wp_filter_post_kses' ) );
-                if ( $has_kses ) {
-                        kses_remove_filters(); // Prevent KSES from corrupting JSON in post_content.
-                }
-
-                // Note that updating a post with publish status will trigger WP_Customize_Manager::publish_changeset_values().
+                /*
+                 * Update the changeset post. The publish_customize_changeset action will cause the settings in the
+                 * changeset to be saved via WP_Customize_Setting::save(). Updating a post with publish status will
+                 * trigger WP_Customize_Manager::publish_changeset_values().
+                 */
+                add_filter( 'wp_insert_post_data', array( $this, 'preserve_insert_changeset_post_content' ), 5, 3 );
                 if ( $changeset_post_id ) {
                         if ( $args['autosave'] && 'auto-draft' !== get_post_status( $changeset_post_id ) ) {
@@ -2893 +2892 @@
                         }
                 }
-                if ( $has_kses ) {
-                        kses_init_filters();
-                }
+
+                remove_filter( 'wp_insert_post_data', array( $this, 'preserve_insert_changeset_post_content' ), 5 );
+
                 $this->_changeset_data = null; // Reset so WP_Customize_Manager::changeset_data() will re-populate with updated contents.
 
@@ -2910 +2909 @@
 
                 return $response;
+        }
+
+        /**
+         * Preserve the initial JSON post_content passed to save into the post.
+         *
+         * This is needed to prevent KSES and other {@see 'content_save_pre'} filters
+         * from corrupting JSON data.
+         *
+         * Note that WP_Customize_Manager::validate_setting_values() have already
+         * run on the setting values being serialized as JSON into the post content
+         * so it is pre-sanitized.
+         *
+         * Also, the sanitization logic is re-run through the respective
+         * WP_Customize_Setting::sanitize() method when being read out of the
+         * changeset, via WP_Customize_Manager::post_value(), and this sanitized
+         * value will also be sent into WP_Customize_Setting::update() for
+         * persisting to the DB.
+         *
+         * Multiple users can collaborate on a single changeset, where one user may
+         * have the unfiltered_html capability but another may not. A user with
+         * unfiltered_html may add a script tag to some field which needs to be kept
+         * intact even when another user updates the changeset to modify another field
+         * when they do not have unfiltered_html.
+         *
+         * @since 5.4.1
+         *
+         * @param array $data                An array of slashed and processed post data.
+         * @param array $postarr             An array of sanitized (and slashed) but otherwise unmodified post data.
+         * @param array $unsanitized_postarr An array of slashed yet *unsanitized* and unprocessed post data as originally passed to wp_insert_post().
+         * @return array Filtered post data.
+         */
+        public function preserve_insert_changeset_post_content( $data, $postarr, $unsanitized_postarr ) {
+                if (
+                        isset( $data['post_type'] ) &&
+                        isset( $unsanitized_postarr['post_content'] ) &&
+                        'customize_changeset' === $data['post_type'] ||
+                        (
+                                'revision' === $data['post_type'] &&
+                                ! empty( $data['post_parent'] ) &&
+                                'customize_changeset' === get_post_type( $data['post_parent'] )
+                        )
+                ) {
+                        $data['post_content'] = $unsanitized_postarr['post_content'];
+                }
+                return $data;
         }