Changeset 49403

Timestamp:

10/29/2020 07:05:53 PM (5 years ago)

Author:

whyisjake

Message:

General: WordPress updates

• XML-RPC: Improve error messages for unprivileged users.
• External Libraries: Disable deserialization in Requests_Utility_FilteredIterator
• Embeds: Disable embeds on deactivated Multisite sites.
• Coding standards: Modify escaping functions to avoid potential false positives.
• XML-RPC: Return error message if attachment ID is incorrect.
• Upgrade/install: Improve logic check when determining installation status.
• Meta: Sanitize meta key before checking protection status.
• Themes: Ensure that only privileged users can set a background image when a theme is using the deprecated custom background page.

Brings the changes from [49380,49382-49388] to the 4.3 branch.

Props xknown, zieladam, peterwilsoncc, whyisjake, desrosj, dd32.

Location:

branches/4.3

Files:

• . (modified) (1 prop)
• src/wp-admin/admin-header.php (modified) (1 diff)
• src/wp-admin/custom-background.php (modified) (1 diff)
• src/wp-admin/custom-header.php (modified) (1 diff)
• src/wp-admin/includes/media.php (modified) (1 diff)
• src/wp-admin/includes/ms.php (modified) (1 diff)
• src/wp-admin/includes/template.php (modified) (1 diff)
• src/wp-admin/js/custom-background.js (modified) (2 diffs)
• src/wp-admin/js/media-gallery.js (modified) (2 diffs)
• src/wp-admin/media-new.php (modified) (1 diff)
• src/wp-admin/network/site-users.php (modified) (1 diff)
• src/wp-includes/class-wp-xmlrpc-server.php (modified) (2 diffs)
• src/wp-includes/formatting.php (modified) (3 diffs)
• src/wp-includes/meta.php (modified) (1 diff)
• tests/phpunit/tests/formatting/Utf8UriEncode.php (modified) (1 diff)
• tests/phpunit/tests/meta/isProtectedMeta.php (added)

branches/4.3/src/wp-admin/admin-header.php

@@ -71 +71 @@
 ?>
 <script type="text/javascript">
-addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
-    pagenow = '<?php echo $current_screen->id; ?>',
-    typenow = '<?php echo $current_screen->post_type; ?>',
-    adminpage = '<?php echo $admin_body_class; ?>',
-    thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
-    decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
+addLoadEvent = function(func){if(typeof jQuery!=='undefined')jQuery(document).ready(func);else if(typeof wpOnload!=='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
+    pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
+    typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
+    adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
+    thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
+    decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
     isRtl = <?php echo (int) is_rtl(); ?>;
 </script>

branches/4.3/src/wp-admin/custom-background.php

@@ -461 +461 @@
      */
     public function wp_set_background_image() {
+        check_ajax_referer( 'custom-background' );
         if ( ! current_user_can('edit_theme_options') || ! isset( $_POST['attachment_id'] ) ) exit;
         $attachment_id = absint($_POST['attachment_id']);

branches/4.3/src/wp-admin/custom-header.php

@@ -321 +321 @@
 <script type="text/javascript">
 (function($){
-    var default_color = '<?php echo $default_color; ?>',
+    var default_color = '<?php echo esc_js( $default_color ); ?>',
         header_text_fields;
 

branches/4.3/src/wp-admin/includes/media.php

@@ -455 +455 @@
 <script type="text/javascript">
 addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
 isRtl = <?php echo (int) is_rtl(); ?>;
 </script>

branches/4.3/src/wp-admin/includes/ms.php

@@ -978 +978 @@
 ?>
 <script type="text/javascript">
-var tb_pathToImage = "<?php echo includes_url( 'js/thickbox/loadingAnimation.gif', 'relative' ); ?>";
+var tb_pathToImage = "<?php echo esc_js( includes_url( 'js/thickbox/loadingAnimation.gif', 'relative' ) ); ?>";
 </script>
 <?php

branches/4.3/src/wp-admin/includes/template.php

@@ -1619 +1619 @@
 addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
 function tb_close(){var win=window.dialogArguments||opener||parent||top;win.tb_remove();}
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
-    pagenow = '<?php echo $current_screen->id; ?>',
-    typenow = '<?php echo $current_screen->post_type; ?>',
-    adminpage = '<?php echo $admin_body_class; ?>',
-    thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
-    decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
+    pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
+    typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
+    adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
+    thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
+    decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
     isRtl = <?php echo (int) is_rtl(); ?>;
 </script>

branches/4.3/src/wp-admin/js/custom-background.js

@@ -57 +57 @@
                 // Grab the selected attachment.
                 var attachment = frame.state().get('selection').first();
+                var nonceValue = $( '#_wpnonce' ).val() || '';
 
                 // Run an AJAX request to set the background image.
@@ -62 +63 @@
                     action: 'set-background-image',
                     attachment_id: attachment.id,
+                    _ajax_nonce: nonceValue,
                     size: 'full'
                 }).done( function() {

branches/4.3/src/wp-admin/js/media-gallery.js

@@ -2 +2 @@
 jQuery(function($){
     $( 'body' ).bind( 'click.wp-gallery', function(e){
-        var target = $( e.target ), id, img_size;
+        var target = $( e.target ), id, img_size, nonceValue;
 
         if ( target.hasClass( 'wp-set-header' ) ) {
@@ -10 +10 @@
             id = target.data( 'attachment-id' );
             img_size = $( 'input[name="attachments[' + id + '][image-size]"]:checked').val();
+            nonceValue = $( '#_wpnonce' ).val() && '';
 
             jQuery.post(ajaxurl, {
                 action: 'set-background-image',
                 attachment_id: id,
+                _ajax_nonce: nonceValue,
                 size: img_size
             }, function(){

branches/4.3/src/wp-admin/media-new.php

@@ -73 +73 @@
 
     <script type="text/javascript">
-    var post_id = <?php echo $post_id; ?>, shortform = 3;
+    var post_id = <?php echo absint( $post_id ); ?>, shortform = 3;
     </script>
-    <input type="hidden" name="post_id" id="post_id" value="<?php echo $post_id; ?>" />
+    <input type="hidden" name="post_id" id="post_id" value="<?php echo absint( $post_id ); ?>" />
     <?php wp_nonce_field('media-form'); ?>
     <div id="media-items" class="hide-if-no-js"></div>

branches/4.3/src/wp-admin/network/site-users.php

@@ -180 +180 @@
 
 <script type="text/javascript">
-var current_site_id = <?php echo $id; ?>;
+var current_site_id = <?php echo absint( $id ); ?>;
 </script>
 

branches/4.3/src/wp-includes/class-wp-xmlrpc-server.php

@@ -3484 +3484 @@
             return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
+        if (
+            'publish' === get_post_status( $post_id ) &&
+            ! current_user_can( 'edit_post', $post_id ) &&
+            post_password_required( $post_id )
+        ) {
+            return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
+        }
+
+        if (
+            'private' === get_post_status( $post_id ) &&
+            ! current_user_can( 'read_post', $post_id )
+        ) {
+            return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
+        }
+
         $comment = array();
         $comment['comment_post_ID'] = $post_id;
@@ -3848 +3863 @@
         do_action( 'xmlrpc_call', 'wp.getMediaItem' );
 
-        if ( ! $attachment = get_post($attachment_id) )
+        $attachment = get_post( $attachment_id );
+        if ( ! $attachment || 'attachment' !== $attachment->post_type ) {
             return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
+        }
 
         return $this->_prepare_media_item( $attachment );

branches/4.3/src/wp-includes/formatting.php

@@ -1005 +1005 @@
  */
 function utf8_uri_encode( $utf8_string, $length = 0 ) {
-    $unicode = '';
-    $values = array();
-    $num_octets = 1;
+    $unicode        = '';
+    $values         = array();
+    $num_octets     = 1;
     $unicode_length = 0;
 
@@ -1019 +1019 @@
 
         if ( $value < 128 ) {
-            if ( $length && ( $unicode_length >= $length ) )
+            if ( $length && ( $unicode_length >= $length ) ) {
                 break;
-            $unicode .= chr($value);
+            }
+            $unicode .= chr( $value );
             $unicode_length++;
         } else {
@@ -1541 +1542 @@
             $title = mb_strtolower($title, 'UTF-8');
         }
-        $title = utf8_uri_encode($title, 200);
+        $title = utf8_uri_encode( $title, 200 );
     }
 

branches/4.3/src/wp-includes/meta.php

@@ -1636 +1636 @@
  * @return bool True if the key is protected, false otherwise.
  */
-function is_protected_meta( $meta_key, $meta_type = null ) {
-    $protected = ( '_' == $meta_key[0] );
+function is_protected_meta( $meta_key, $meta_type = '' ) {
+    $sanitized_key = preg_replace( "/[^\x20-\x7E\p{L}]/", '', $meta_key );
+    $protected     = strlen( $sanitized_key ) > 0 && ( '_' === $sanitized_key[0] );
 
     /**

branches/4.3/tests/phpunit/tests/formatting/Utf8UriEncode.php

@@ -13 +13 @@
      */
     function test_percent_encodes_non_reserved_characters( $utf8, $urlencoded ) {
-        $this->assertEquals($urlencoded, utf8_uri_encode( $utf8 ) );
+        $this->assertEquals( $urlencoded, utf8_uri_encode( $utf8 ) );
     }