Changeset 47959

Timestamp:

06/10/2020 05:58:07 PM (6 years ago)

Author:

desrosj

Message:

General: Backport several commits for release.

• Embeds: Ensure that the title attribute is set correctly on embeds.
• Editor: Prevent HTML decoding on by setting the proper editor context.
• Formatting: Ensure that wp_validate_redirect() sanitizes a wider variety of characters.
• Themes: Ensure a broken theme name is returned properly.
• Administration: Add a new filter to extend set-screen-option.

Merges [47948-47951] to the 5.3 branch.
Props xknown, sstoqnov, vortfu, SergeyBiryukov, whyisjake.

Location:

branches/5.3

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/media.php (modified) (1 diff)
• src/wp-admin/includes/misc.php (modified) (1 diff)
• src/wp-admin/themes.php (modified) (1 diff)
• src/wp-includes/comment-template.php (modified) (1 diff)
• src/wp-includes/default-filters.php (modified) (1 diff)
• src/wp-includes/embed.php (modified) (2 diffs)
• src/wp-includes/pluggable.php (modified) (1 diff)
• tests/phpunit/tests/blocks/render.php (modified) (1 diff)
• tests/phpunit/tests/oembed/filterResult.php (modified) (1 diff)

branches/5.3/src/wp-admin/includes/media.php

@@ -3213 +3213 @@
         ?>
         </label>
-        <?php wp_editor( $post->post_content, 'attachment_content', $editor_args ); ?>
+        <?php wp_editor( format_to_edit( $post->post_content ), 'attachment_content', $editor_args ); ?>
 
         </div>

branches/5.3/src/wp-admin/includes/misc.php

@@ -680 +680 @@
                                 break;
                         default:
+                                if ( '_page' === substr( $option, -5 ) || 'layout_columns' === $option ) {
+                                        /**
+                                         * Filters a screen option value before it is set.
+                                         *
+                                         * The filter can also be used to modify non-standard [items]_per_page
+                                         * settings. See the parent function for a full list of standard options.
+                                         *
+                                         * Returning false to the filter will skip saving the current option.
+                                         *
+                                         * @since 2.8.0
+                                         * @since 5.4.2 Only applied to options ending with '_page',
+                                         *              or the 'layout_columns' option.
+                                         *
+                                         * @see set_screen_options()
+                                         *
+                                         * @param bool   $keep   Whether to save or skip saving the screen option value.
+                                         *                       Default false.
+                                         * @param string $option The option name.
+                                         * @param int    $value  The number of rows to use.
+                                         */
+                                        $value = apply_filters( 'set-screen-option', false, $option, $value ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+                                }
+
                                 /**
                                  * Filters a screen option value before it is set.
                                  *
-                                 * The filter can also be used to modify non-standard [items]_per_page
-                                 * settings. See the parent function for a full list of standard options.
+                                 * The dynamic portion of the hook, `$option`, refers to the option name.
                                  *
                                  * Returning false to the filter will skip saving the current option.
                                  *
-                                 * @since 2.8.0
+                                 * @since 5.4.2
                                  *
                                  * @see set_screen_options()
                                  *
-                                 * @param bool     $keep   Whether to save or skip saving the screen option value. Default false.
-                                 * @param string   $option The option name.
-                                 * @param int      $value  The number of rows to use.
+                                 * @param bool   $keep   Whether to save or skip saving the screen option value.
+                                 *                       Default false.
+                                 * @param string $option The option name.
+                                 * @param int    $value  The number of rows to use.
                                  */
-                                $value = apply_filters( 'set-screen-option', false, $option, $value );  // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+                                $value = apply_filters( "set_screen_option_{$option}", false, $option, $value );
 
                                 if ( false === $value ) {

branches/5.3/src/wp-admin/themes.php

@@ -409 +409 @@
         <?php foreach ( $broken_themes as $broken_theme ) : ?>
                 <tr>
-                        <td><?php echo $broken_theme->get( 'Name' ) ? $broken_theme->display( 'Name' ) : $broken_theme->get_stylesheet(); ?></td>
+                        <td><?php echo $broken_theme->get( 'Name' ) ? $broken_theme->display( 'Name' ) : esc_html( $broken_theme->get_stylesheet() ); ?></td>
                         <td><?php echo $broken_theme->errors()->get_error_message(); ?></td>
                         <?php

branches/5.3/src/wp-includes/comment-template.php

@@ -594 +594 @@
  */
 function get_comment_excerpt( $comment_ID = 0 ) {
-        $comment      = get_comment( $comment_ID );
-        $comment_text = strip_tags( str_replace( array( "\n", "\r" ), ' ', $comment->comment_content ) );
+        $comment = get_comment( $comment_ID );
+
+        if ( ! post_password_required( $comment->comment_post_ID ) ) {
+                $comment_text = strip_tags( str_replace( array( "\n", "\r" ), ' ', $comment->comment_content ) );
+        } else {
+                $comment_text = __( 'Password protected' );
+        }
 
         /* translators: Maximum number of words used in a comment excerpt. */

branches/5.3/src/wp-includes/default-filters.php

@@ -575 +575 @@
 add_filter( 'the_excerpt_embed', 'wp_embed_excerpt_attachment' );
 
+add_filter( 'oembed_dataparse', 'wp_filter_oembed_iframe_title_attribute', 5, 3 );
 add_filter( 'oembed_dataparse', 'wp_filter_oembed_result', 10, 3 );
-add_filter( 'oembed_dataparse', 'wp_filter_oembed_iframe_title_attribute', 20, 3 );
 add_filter( 'oembed_response_data', 'get_oembed_response_data_rich', 10, 4 );
 add_filter( 'pre_oembed_result', 'wp_filter_pre_oembed_result', 10, 3 );

branches/5.3/src/wp-includes/embed.php

@@ -798 +798 @@
         $title = ! empty( $data->title ) ? $data->title : '';
 
-        $pattern        = '`<iframe[^>]*?title=(\\\\\'|\\\\"|[\'"])([^>]*?)\1`i';
-        $has_title_attr = preg_match( $pattern, $result, $matches );
-
-        if ( $has_title_attr && ! empty( $matches[2] ) ) {
-                $title = $matches[2];
+        $pattern = '`<iframe([^>]*)>`i';
+        if ( preg_match( $pattern, $result, $matches ) ) {
+                $attrs = wp_kses_hair( $matches[1], wp_allowed_protocols() );
+
+                foreach ( $attrs as $attr => $item ) {
+                        $lower_attr = strtolower( $attr );
+                        if ( $lower_attr === $attr ) {
+                                continue;
+                        }
+                        if ( ! isset( $attrs[ $lower_attr ] ) ) {
+                                $attrs[ $lower_attr ] = $item;
+                                unset( $attrs[ $attr ] );
+                        }
+                }
+        }
+
+        if ( ! empty( $attrs['title']['value'] ) ) {
+                $title = $attrs['title']['value'];
         }
 
@@ -821 +834 @@
         }
 
-        if ( $has_title_attr ) {
-                // Remove the old title, $matches[1]: quote, $matches[2]: title attribute value.
-                $result = str_replace( ' title=' . $matches[1] . $matches[2] . $matches[1], '', $result );
-        }
-
+        if ( isset( $attrs['title'] ) ) {
+                unset( $attrs['title'] );
+                $attr_string = join( ' ', wp_list_pluck( $attrs, 'whole' ) );
+                $result      = str_replace( $matches[0], '<iframe ' . trim( $attr_string ) . '>', $result );
+        }
         return str_ireplace( '<iframe ', sprintf( '<iframe title="%s" ', esc_attr( $title ) ), $result );
 }

branches/5.3/src/wp-includes/pluggable.php

@@ -1392 +1392 @@
          */
         function wp_validate_redirect( $location, $default = '' ) {
-                $location = trim( $location, " \t\n\r\0\x08\x0B" );
-                // browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
-                if ( substr( $location, 0, 2 ) == '//' ) {
+                $location = wp_sanitize_redirect( trim( $location, " \t\n\r\0\x08\x0B" ) );
+                // Browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'.
+                if ( '//' === substr( $location, 0, 2 ) ) {
                         $location = 'http:' . $location;
                 }

branches/5.3/tests/phpunit/tests/blocks/render.php

@@ -290 +290 @@
         }
 
+        public function test_render_latest_comments_on_password_protected_post() {
+                $post_id      = self::factory()->post->create(
+                        array(
+                                'post_password' => 'password',
+                        )
+                );
+                $comment_text = wp_generate_password( 10, false );
+                self::factory()->comment->create(
+                        array(
+                                'comment_post_ID' => $post_id,
+                                'comment_content' => $comment_text,
+                        )
+                );
+                $comments = do_blocks( '<!-- wp:latest-comments {"commentsToShow":1,"displayExcerpt":true} /-->' );
+
+                $this->assertNotContains( $comment_text, $comments );
+        }
+
         /**
          * @ticket 45109

branches/5.3/tests/phpunit/tests/oembed/filterResult.php

@@ -103 +103 @@
                 $this->assertEquals( '<blockquote class="wp-embedded-content"></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted"></iframe>', $actual );
         }
+
+        public function _data_oembed_test_strings() {
+                return array(
+                        array(
+                                '<blockquote></blockquote><iframe title=""></iframe>',
+                                '<blockquote class="wp-embedded-content"></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title="Hola"></iframe>',
+                        ),
+                        array(
+                                '<blockquote class="foo" id="bar"><strong><a href="" target=""></a></strong></blockquote><iframe width=123></iframe>',
+                                '<blockquote class="wp-embedded-content"><a href=""></a></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title="Hola" width="123"></iframe>',
+                        ),
+                        array(
+                                '<blockquote><iframe width="100"></iframe></blockquote><iframe stitle="aaaa"></iframe>',
+                                '<blockquote class="wp-embedded-content"><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title="Hola" width="100"></iframe></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title="Hola"></iframe>',
+                        ),
+                        array(
+                                "<blockquote><iframe title=' width=\"'></iframe></blockquote><iframe title='' height=' title=' width=\"'' heigt='123'\"></iframe>",
+                                '<blockquote class="wp-embedded-content"><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title=" width=&quot;"></iframe></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title=" width=&quot;" height=\' title=\' width="\'\' heigt=\'123\'"></iframe>',
+                        ),
+                );
+        }
+
+        /**
+         * @dataProvider _data_oembed_test_strings
+         */
+        public function test_wp_filter_pre_oembed_custom_result( $html, $expected ) {
+                $data   = (object) [
+                        'type'  => 'rich',
+                        'title' => 'Hola',
+                        'html'  => $html,
+                ];
+                $actual = _wp_oembed_get_object()->data2html( $data, 'https://untrusted.localhost' );
+                $this->assertEquals( $expected, $actual );
+        }
 }