Changeset 47656

Timestamp:

04/29/2020 04:48:42 PM (6 years ago)

Author:

whyisjake

Message:

User: Invalidate user_activation_key on password update.
Query: Ensure that only a single post can be returned on date/time based queries.
Cache API: Ensure proper escaping around the stats method in the cache API.
Formatting: Expand sanitize_file_name to have better support for utf8 characters.

Brings the changes in [47634], [47635], [47637], and [47638] to the 4.3 branch.

Props: batmoo, ehti, nickdaugherty, peterwilsoncc, sergeybiryukov, sstoqnov, westi, whyisjake, whyisjake, xknown.

Location:

branches/4.3

Files:

• . (modified) (1 prop)
• src/wp-includes/cache.php (modified) (1 diff)
• src/wp-includes/formatting.php (modified) (2 diffs)
• src/wp-includes/query.php (modified) (1 diff)
• src/wp-includes/user.php (modified) (1 diff)
• tests/phpunit/tests/formatting/SanitizeFileName.php (modified) (1 diff)
• tests/phpunit/tests/user.php (modified) (2 diffs)

branches/4.3/src/wp-includes/cache.php

@@ -654 +654 @@
                 echo '<ul>';
                 foreach ($this->cache as $group => $cache) {
-                        echo "<li><strong>Group:</strong> $group - ( " . number_format( strlen( serialize( $cache ) ) / 1024, 2 ) . 'k )</li>';
+                        echo '<li><strong>Group:</strong> ' . esc_html( $group ) . ' - ( ' . number_format( strlen( serialize( $cache ) ) / KB_IN_BYTES, 2 ) . 'k )</li>';
                 }
                 echo '</ul>';

branches/4.3/src/wp-includes/formatting.php

@@ -1310 +1310 @@
         $filename_raw = $filename;
         $special_chars = array("?", "[", "]", "/", "\\", "=", "<", ">", ":", ";", ",", "'", "\"", "&", "$", "#", "*", "(", ")", "|", "~", "`", "!", "{", "}", chr(0));
+
+        // Check for support for utf8 in the installed PCRE library once and store the result in a static.
+        static $utf8_pcre = null;
+        if ( ! isset( $utf8_pcre ) ) {
+                // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                $utf8_pcre = @preg_match( '/^./u', 'a' );
+        }
+
+        if ( ! seems_utf8( $filename ) ) {
+                $_ext     = pathinfo( $filename, PATHINFO_EXTENSION );
+                $_name    = pathinfo( $filename, PATHINFO_FILENAME );
+                $filename = sanitize_title_with_dashes( $_name ) . '.' . $_ext;
+        }
+
+        if ( $utf8_pcre ) {
+                $filename = preg_replace( "#\x{00a0}#siu", ' ', $filename );
+        }
+
         /**
          * Filter the list of characters to remove from a filename.
@@ -1319 +1337 @@
          */
         $special_chars = apply_filters( 'sanitize_file_name_chars', $special_chars, $filename_raw );
-        $filename = preg_replace( "#\x{00a0}#siu", ' ', $filename );
         $filename = str_replace( $special_chars, '', $filename );
         $filename = str_replace( array( '%20', '+' ), '-', $filename );

branches/4.3/src/wp-includes/query.php

@@ -1600 +1600 @@
                 } elseif ( $qv['p'] ) {
                         $this->is_single = true;
-                } elseif ( ('' !== $qv['hour']) && ('' !== $qv['minute']) &&('' !== $qv['second']) && ('' != $qv['year']) && ('' != $qv['monthnum']) && ('' != $qv['day']) ) {
-                        // If year, month, day, hour, minute, and second are set, a single
-                        // post is being queried.
-                        $this->is_single = true;
                 } elseif ( '' != $qv['pagename'] || !empty($qv['page_id']) ) {
                         $this->is_page = true;

branches/4.3/src/wp-includes/user.php

@@ -2052 +2052 @@
 
         if ( $update ) {
-                if ( $user_email !== $old_user_data->user_email ) {
+                if ( $user_email !== $old_user_data->user_email || $user_pass !== $old_user_data->user_pass ) {
                         $data['user_activation_key'] = '';
                 }

branches/4.3/tests/phpunit/tests/formatting/SanitizeFileName.php

@@ -61 +61 @@
                 $this->assertEquals( 'no-extension', sanitize_file_name( '_.no-extension' ) );
         }
+
+        /**
+         * @dataProvider data_wp_filenames
+         */
+        function test_replaces_invalid_utf8_characters( $input, $expected ) {
+                $this->assertEquals( $expected, sanitize_file_name( $input ) );
+        }
+
+        function data_wp_filenames() {
+                return array(
+                        array( urldecode( '%B1myfile.png' ), 'myfile.png' ),
+                        array( urldecode( '%B1myfile' ), 'myfile' ),
+                        array( 'demo bar.png', 'demo-bar.png' ),
+                        array( 'demo' . json_decode( '"\u00a0"' ) . 'bar.png', 'demo-bar.png' ),
+                );
+        }
 }

branches/4.3/tests/phpunit/tests/user.php

@@ -565 +565 @@
         }
 
-        function test_changing_email_invalidates_password_reset_key() {
+        public function test_changing_email_invalidates_password_reset_key() {
                 global $wpdb;
 
@@ -590 +590 @@
                         'user_nicename' => 'cat',
                         'user_email'    => 'foo@bar.dev',
+                );
+                wp_update_user( $userdata );
+
+                $user = get_userdata( $user->ID );
+                $this->assertEmpty( $user->user_activation_key );
+        }
+
+        public function test_changing_password_invalidates_password_reset_key() {
+                global $wpdb;
+
+                $user = $this->factory->user->create_and_get();
+                $wpdb->update( $wpdb->users, array( 'user_activation_key' => 'key' ), array( 'ID' => $user->ID ) );
+                clean_user_cache( $user );
+
+                $user = get_userdata( $user->ID );
+                $this->assertEquals( 'key', $user->user_activation_key );
+
+                $userdata = array(
+                        'ID'        => $user->ID,
+                        'user_pass' => 'password',
                 );
                 wp_update_user( $userdata );