Changeset 53307 for trunk/src/wp-admin/includes/media.php

Timestamp:

04/29/2022 04:48:13 AM (4 years ago)

Author:

peterwilsoncc

Message:

Media: Validate track number ID3 tags before use.

Validate current and total track ID3 tags as numeric before use.

Props mjkhajeh, SergeyBiryukov, costdev.
Fixes #55204.

File:

• trunk/src/wp-admin/includes/media.php (modified) (1 diff)

trunk/src/wp-admin/includes/media.php

@@ -362 +362 @@
                         $track_number = explode( '/', $meta['track_number'] );
 
-                        if ( isset( $track_number[1] ) ) {
-                                /* translators: Audio file track information. 1: Audio track number, 2: Total audio tracks. */
-                                $content .= ' ' . sprintf( __( 'Track %1$s of %2$s.' ), number_format_i18n( $track_number[0] ), number_format_i18n( $track_number[1] ) );
-                        } else {
-                                /* translators: Audio file track information. %s: Audio track number. */
-                                $content .= ' ' . sprintf( __( 'Track %s.' ), number_format_i18n( $track_number[0] ) );
+                        if ( is_numeric( $track_number[0] ) ) {
+                                if ( isset( $track_number[1] ) && is_numeric( $track_number[1] ) ) {
+                                        $content .= ' ' . sprintf(
+                                                /* translators: Audio file track information. 1: Audio track number, 2: Total audio tracks. */
+                                                __( 'Track %1$s of %2$s.' ),
+                                                number_format_i18n( $track_number[0] ),
+                                                number_format_i18n( $track_number[1] )
+                                        );
+                                } else {
+                                        $content .= ' ' . sprintf(
+                                                /* translators: Audio file track information. %s: Audio track number. */
+                                                __( 'Track %s.' ),
+                                                number_format_i18n( $track_number[0] )
+                                        );
+                                }
                         }
                 }