Changeset 49403

Timestamp:

10/29/2020 07:05:53 PM (6 years ago)

Author:

whyisjake

Message:

General: WordPress updates

• XML-RPC: Improve error messages for unprivileged users.
• External Libraries: Disable deserialization in Requests_Utility_FilteredIterator
• Embeds: Disable embeds on deactivated Multisite sites.
• Coding standards: Modify escaping functions to avoid potential false positives.
• XML-RPC: Return error message if attachment ID is incorrect.
• Upgrade/install: Improve logic check when determining installation status.
• Meta: Sanitize meta key before checking protection status.
• Themes: Ensure that only privileged users can set a background image when a theme is using the deprecated custom background page.

Brings the changes from [49380,49382-49388] to the 4.3 branch.

Props xknown, zieladam, peterwilsoncc, whyisjake, desrosj, dd32.

Location:

branches/4.3

Files:

• . (modified) (1 prop)
• src/wp-admin/admin-header.php (modified) (1 diff)
• src/wp-admin/custom-background.php (modified) (1 diff)
• src/wp-admin/custom-header.php (modified) (1 diff)
• src/wp-admin/includes/media.php (modified) (1 diff)
• src/wp-admin/includes/ms.php (modified) (1 diff)
• src/wp-admin/includes/template.php (modified) (1 diff)
• src/wp-admin/js/custom-background.js (modified) (2 diffs)
• src/wp-admin/js/media-gallery.js (modified) (2 diffs)
• src/wp-admin/media-new.php (modified) (1 diff)
• src/wp-admin/network/site-users.php (modified) (1 diff)
• src/wp-includes/class-wp-xmlrpc-server.php (modified) (2 diffs)
• src/wp-includes/formatting.php (modified) (3 diffs)
• src/wp-includes/meta.php (modified) (1 diff)
• tests/phpunit/tests/formatting/Utf8UriEncode.php (modified) (1 diff)
• tests/phpunit/tests/meta/isProtectedMeta.php (added)

branches/4.3/src/wp-admin/admin-header.php

@@ -71 +71 @@
 ?>
 <script type="text/javascript">
-addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
-        pagenow = '<?php echo $current_screen->id; ?>',
-        typenow = '<?php echo $current_screen->post_type; ?>',
-        adminpage = '<?php echo $admin_body_class; ?>',
-        thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
-        decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
+addLoadEvent = function(func){if(typeof jQuery!=='undefined')jQuery(document).ready(func);else if(typeof wpOnload!=='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
+        pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
+        typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
+        adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
+        thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
+        decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
         isRtl = <?php echo (int) is_rtl(); ?>;
 </script>

branches/4.3/src/wp-admin/custom-background.php

@@ -461 +461 @@
          */
         public function wp_set_background_image() {
+                check_ajax_referer( 'custom-background' );
                 if ( ! current_user_can('edit_theme_options') || ! isset( $_POST['attachment_id'] ) ) exit;
                 $attachment_id = absint($_POST['attachment_id']);

branches/4.3/src/wp-admin/custom-header.php

@@ -321 +321 @@
 <script type="text/javascript">
 (function($){
-        var default_color = '<?php echo $default_color; ?>',
+        var default_color = '<?php echo esc_js( $default_color ); ?>',
                 header_text_fields;
 

branches/4.3/src/wp-admin/includes/media.php

@@ -455 +455 @@
 <script type="text/javascript">
 addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
 isRtl = <?php echo (int) is_rtl(); ?>;
 </script>

branches/4.3/src/wp-admin/includes/ms.php

@@ -978 +978 @@
 ?>
 <script type="text/javascript">
-var tb_pathToImage = "<?php echo includes_url( 'js/thickbox/loadingAnimation.gif', 'relative' ); ?>";
+var tb_pathToImage = "<?php echo esc_js( includes_url( 'js/thickbox/loadingAnimation.gif', 'relative' ) ); ?>";
 </script>
 <?php

branches/4.3/src/wp-admin/includes/template.php

@@ -1619 +1619 @@
 addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
 function tb_close(){var win=window.dialogArguments||opener||parent||top;win.tb_remove();}
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
-        pagenow = '<?php echo $current_screen->id; ?>',
-        typenow = '<?php echo $current_screen->post_type; ?>',
-        adminpage = '<?php echo $admin_body_class; ?>',
-        thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
-        decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
+        pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
+        typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
+        adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
+        thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
+        decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
         isRtl = <?php echo (int) is_rtl(); ?>;
 </script>

branches/4.3/src/wp-admin/js/custom-background.js

@@ -57 +57 @@
                                 // Grab the selected attachment.
                                 var attachment = frame.state().get('selection').first();
+                                var nonceValue = $( '#_wpnonce' ).val() || '';
 
                                 // Run an AJAX request to set the background image.
@@ -62 +63 @@
                                         action: 'set-background-image',
                                         attachment_id: attachment.id,
+                                        _ajax_nonce: nonceValue,
                                         size: 'full'
                                 }).done( function() {

branches/4.3/src/wp-admin/js/media-gallery.js

@@ -2 +2 @@
 jQuery(function($){
         $( 'body' ).bind( 'click.wp-gallery', function(e){
-                var target = $( e.target ), id, img_size;
+                var target = $( e.target ), id, img_size, nonceValue;
 
                 if ( target.hasClass( 'wp-set-header' ) ) {
@@ -10 +10 @@
                         id = target.data( 'attachment-id' );
                         img_size = $( 'input[name="attachments[' + id + '][image-size]"]:checked').val();
+                        nonceValue = $( '#_wpnonce' ).val() && '';
 
                         jQuery.post(ajaxurl, {
                                 action: 'set-background-image',
                                 attachment_id: id,
+                                _ajax_nonce: nonceValue,
                                 size: img_size
                         }, function(){

branches/4.3/src/wp-admin/media-new.php

@@ -73 +73 @@
 
         <script type="text/javascript">
-        var post_id = <?php echo $post_id; ?>, shortform = 3;
+        var post_id = <?php echo absint( $post_id ); ?>, shortform = 3;
         </script>
-        <input type="hidden" name="post_id" id="post_id" value="<?php echo $post_id; ?>" />
+        <input type="hidden" name="post_id" id="post_id" value="<?php echo absint( $post_id ); ?>" />
         <?php wp_nonce_field('media-form'); ?>
         <div id="media-items" class="hide-if-no-js"></div>

branches/4.3/src/wp-admin/network/site-users.php

@@ -180 +180 @@
 
 <script type="text/javascript">
-var current_site_id = <?php echo $id; ?>;
+var current_site_id = <?php echo absint( $id ); ?>;
 </script>
 

branches/4.3/src/wp-includes/class-wp-xmlrpc-server.php

@@ -3484 +3484 @@
                         return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
+                if (
+                        'publish' === get_post_status( $post_id ) &&
+                        ! current_user_can( 'edit_post', $post_id ) &&
+                        post_password_required( $post_id )
+                ) {
+                        return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
+                }
+
+                if (
+                        'private' === get_post_status( $post_id ) &&
+                        ! current_user_can( 'read_post', $post_id )
+                ) {
+                        return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
+                }
+
                 $comment = array();
                 $comment['comment_post_ID'] = $post_id;
@@ -3848 +3863 @@
                 do_action( 'xmlrpc_call', 'wp.getMediaItem' );
 
-                if ( ! $attachment = get_post($attachment_id) )
+                $attachment = get_post( $attachment_id );
+                if ( ! $attachment || 'attachment' !== $attachment->post_type ) {
                         return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
+                }
 
                 return $this->_prepare_media_item( $attachment );

branches/4.3/src/wp-includes/formatting.php

@@ -1005 +1005 @@
  */
 function utf8_uri_encode( $utf8_string, $length = 0 ) {
-        $unicode = '';
-        $values = array();
-        $num_octets = 1;
+        $unicode        = '';
+        $values         = array();
+        $num_octets     = 1;
         $unicode_length = 0;
 
@@ -1019 +1019 @@
 
                 if ( $value < 128 ) {
-                        if ( $length && ( $unicode_length >= $length ) )
+                        if ( $length && ( $unicode_length >= $length ) ) {
                                 break;
-                        $unicode .= chr($value);
+                        }
+                        $unicode .= chr( $value );
                         $unicode_length++;
                 } else {
@@ -1541 +1542 @@
                         $title = mb_strtolower($title, 'UTF-8');
                 }
-                $title = utf8_uri_encode($title, 200);
+                $title = utf8_uri_encode( $title, 200 );
         }
 

branches/4.3/src/wp-includes/meta.php

@@ -1636 +1636 @@
  * @return bool True if the key is protected, false otherwise.
  */
-function is_protected_meta( $meta_key, $meta_type = null ) {
-        $protected = ( '_' == $meta_key[0] );
+function is_protected_meta( $meta_key, $meta_type = '' ) {
+        $sanitized_key = preg_replace( "/[^\x20-\x7E\p{L}]/", '', $meta_key );
+        $protected     = strlen( $sanitized_key ) > 0 && ( '_' === $sanitized_key[0] );
 
         /**

branches/4.3/tests/phpunit/tests/formatting/Utf8UriEncode.php

@@ -13 +13 @@
          */
         function test_percent_encodes_non_reserved_characters( $utf8, $urlencoded ) {
-                $this->assertEquals($urlencoded, utf8_uri_encode( $utf8 ) );
+                $this->assertEquals( $urlencoded, utf8_uri_encode( $utf8 ) );
         }