Changeset 49405 for branches/4.1/src/wp-admin/media-new.php

Timestamp:

10/29/2020 07:09:27 PM (4 years ago)

Author:

whyisjake

Message:

General: WordPress updates

• XML-RPC: Improve error messages for unprivileged users.
• External Libraries: Disable deserialization in Requests_Utility_FilteredIterator
• Embeds: Disable embeds on deactivated Multisite sites.
• Coding standards: Modify escaping functions to avoid potential false positives.
• XML-RPC: Return error message if attachment ID is incorrect.
• Upgrade/install: Improve logic check when determining installation status.
• Meta: Sanitize meta key before checking protection status.
• Themes: Ensure that only privileged users can set a background image when a theme is using the deprecated custom background page.

Brings the changes from [49380,49382-49388] to the 4.1 branch.

Props xknown, zieladam, peterwilsoncc, whyisjake, desrosj, dd32.

Location:

branches/4.1

Files:

• . (modified) (1 prop)
• src/wp-admin/media-new.php (modified) (1 diff)

branches/4.1/src/wp-admin/media-new.php

@@ -73 +73 @@
 
     <script type="text/javascript">
-    var post_id = <?php echo $post_id; ?>, shortform = 3;
+    var post_id = <?php echo absint( $post_id ); ?>, shortform = 3;
     </script>
-    <input type="hidden" name="post_id" id="post_id" value="<?php echo $post_id; ?>" />
+    <input type="hidden" name="post_id" id="post_id" value="<?php echo absint( $post_id ); ?>" />
     <?php wp_nonce_field('media-form'); ?>
     <div id="media-items" class="hide-if-no-js"></div>