Changeset 49409 for branches/3.7

Timestamp:

10/29/2020 07:17:08 PM (5 years ago)

Author:

whyisjake

Message:

General: WordPress updates

• XML-RPC: Improve error messages for unprivileged users.
• External Libraries: Disable deserialization in Requests_Utility_FilteredIterator
• Embeds: Disable embeds on deactivated Multisite sites.
• Coding standards: Modify escaping functions to avoid potential false positives.
• XML-RPC: Return error message if attachment ID is incorrect.
• Upgrade/install: Improve logic check when determining installation status.
• Meta: Sanitize meta key before checking protection status.
• Themes: Ensure that only privileged users can set a background image when a theme is using the deprecated custom background page.

Brings the changes from [49380,49382-49388] to the 3.7 branch.

Props xknown, zieladam, peterwilsoncc, whyisjake, desrosj, dd32.

Location:

branches/3.7

Files:

• . (modified) (1 prop)
• src (modified) (1 prop)
• src/wp-admin/admin-header.php (modified) (1 diff)
• src/wp-admin/custom-background.php (modified) (1 diff)
• src/wp-admin/custom-header.php (modified) (1 diff)
• src/wp-admin/includes/media.php (modified) (1 diff)
• src/wp-admin/includes/template.php (modified) (1 diff)
• src/wp-admin/js/custom-background.js (modified) (2 diffs)
• src/wp-admin/js/media-gallery.js (modified) (2 diffs)
• src/wp-admin/media-new.php (modified) (1 diff)
• src/wp-admin/network/site-users.php (modified) (1 diff)
• src/wp-includes/class-wp-xmlrpc-server.php (modified) (2 diffs)
• src/wp-includes/meta.php (modified) (1 diff)
• tests/phpunit/tests/formatting/Utf8UriEncode.php (modified) (1 diff)
• tests/phpunit/tests/meta/isProtectedMeta.php (added)

branches/3.7/src/wp-admin/admin-header.php

@@ -58 +58 @@
 ?>
 <script type="text/javascript">
-addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
-    pagenow = '<?php echo $current_screen->id; ?>',
-    typenow = '<?php echo $current_screen->post_type; ?>',
-    adminpage = '<?php echo $admin_body_class; ?>',
-    thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
-    decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
+addLoadEvent = function(func){if(typeof jQuery!=='undefined')jQuery(document).ready(func);else if(typeof wpOnload!=='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
+    pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
+    typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
+    adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
+    thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
+    decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
     isRtl = <?php echo (int) is_rtl(); ?>;
 </script>

branches/3.7/src/wp-admin/custom-background.php

@@ -411 +411 @@
 
     public function wp_set_background_image() {
+        check_ajax_referer( 'custom-background' );
         if ( ! current_user_can('edit_theme_options') || ! isset( $_POST['attachment_id'] ) ) exit;
         $attachment_id = absint($_POST['attachment_id']);

branches/3.7/src/wp-admin/custom-header.php

@@ -321 +321 @@
 /* <![CDATA[ */
 (function($){
-    var default_color = '#<?php echo get_theme_support( 'custom-header', 'default-text-color' ); ?>',
+    var default_color = '#<?php echo esc_js( get_theme_support( 'custom-header', 'default-text-color' ) ); ?>',
         header_text_fields;
 

branches/3.7/src/wp-admin/includes/media.php

@@ -393 +393 @@
 //<![CDATA[
 addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
 isRtl = <?php echo (int) is_rtl(); ?>;
 //]]>

branches/3.7/src/wp-admin/includes/template.php

@@ -1417 +1417 @@
 addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
 function tb_close(){var win=window.dialogArguments||opener||parent||top;win.tb_remove();}
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
-    pagenow = '<?php echo $current_screen->id; ?>',
-    typenow = '<?php echo $current_screen->post_type; ?>',
-    adminpage = '<?php echo $admin_body_class; ?>',
-    thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
-    decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
+    pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
+    typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
+    adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
+    thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
+    decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
     isRtl = <?php echo (int) is_rtl(); ?>;
 //]]>

branches/3.7/src/wp-admin/js/custom-background.js

@@ -56 +56 @@
                 // Grab the selected attachment.
                 var attachment = frame.state().get('selection').first();
+                var nonceValue = $( '#_wpnonce' ).val() || '';
 
                 // Run an AJAX request to set the background image.
@@ -61 +62 @@
                     action: 'set-background-image',
                     attachment_id: attachment.id,
+                    _ajax_nonce: nonceValue,
                     size: 'full'
                 }).done( function() {

branches/3.7/src/wp-admin/js/media-gallery.js

@@ -1 +1 @@
 jQuery(function($){
     $( 'body' ).bind( 'click.wp-gallery', function(e){
-        var target = $( e.target ), id, img_size;
+        var target = $( e.target ), id, img_size, nonceValue;
 
         if ( target.hasClass( 'wp-set-header' ) ) {
@@ -9 +9 @@
             id = target.data( 'attachment-id' );
             img_size = $( 'input[name="attachments[' + id + '][image-size]"]:checked').val();
+            nonceValue = $( '#_wpnonce' ).val() && '';
 
             jQuery.post(ajaxurl, {
                 action: 'set-background-image',
                 attachment_id: id,
+                _ajax_nonce: nonceValue,
                 size: img_size
             }, function(){

branches/3.7/src/wp-admin/media-new.php

@@ -74 +74 @@
 
     <script type="text/javascript">
-    var post_id = <?php echo $post_id; ?>, shortform = 3;
+    var post_id = <?php echo absint( $post_id ); ?>, shortform = 3;
     </script>
-    <input type="hidden" name="post_id" id="post_id" value="<?php echo $post_id; ?>" />
+    <input type="hidden" name="post_id" id="post_id" value="<?php echo absint( $post_id ); ?>" />
     <?php wp_nonce_field('media-form'); ?>
     <div id="media-items" class="hide-if-no-js"></div>

branches/3.7/src/wp-admin/network/site-users.php

@@ -172 +172 @@
 <script type='text/javascript'>
 /* <![CDATA[ */
-var current_site_id = <?php echo $id; ?>;
+var current_site_id = <?php echo absint( $id ); ?>;
 /* ]]> */
 </script>

branches/3.7/src/wp-includes/class-wp-xmlrpc-server.php

@@ -3042 +3042 @@
             return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
+        if (
+            'publish' === get_post_status( $post_id ) &&
+            ! current_user_can( 'edit_post', $post_id ) &&
+            post_password_required( $post_id )
+        ) {
+            return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
+        }
+
+        if (
+            'private' === get_post_status( $post_id ) &&
+            ! current_user_can( 'read_post', $post_id )
+        ) {
+            return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
+        }
+
+        $comment = array();
         $comment['comment_post_ID'] = $post_id;
 
@@ -3350 +3366 @@
         do_action('xmlrpc_call', 'wp.getMediaItem');
 
-        if ( ! $attachment = get_post($attachment_id) )
+        $attachment = get_post( $attachment_id );
+        if ( ! $attachment || 'attachment' !== $attachment->post_type ) {
             return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
+        }
 
         return $this->_prepare_media_item( $attachment );

branches/3.7/src/wp-includes/meta.php

@@ -892 +892 @@
  * @return bool True if the key is protected, false otherwise.
  */
-function is_protected_meta( $meta_key, $meta_type = null ) {
-    $protected = ( '_' == $meta_key[0] );
+function is_protected_meta( $meta_key, $meta_type = '' ) {
+    $sanitized_key = preg_replace( "/[^\x20-\x7E\p{L}]/", '', $meta_key );
+    $protected     = strlen( $sanitized_key ) > 0 && ( '_' === $sanitized_key[0] );
 
     return apply_filters( 'is_protected_meta', $protected, $meta_key, $meta_type );

branches/3.7/tests/phpunit/tests/formatting/Utf8UriEncode.php

@@ -13 +13 @@
      */
     function test_percent_encodes_non_reserved_characters( $utf8, $urlencoded ) {
-        $this->assertEquals($urlencoded, utf8_uri_encode( $utf8 ) );
+        $this->assertEquals( $urlencoded, utf8_uri_encode( $utf8 ) );
     }