Make WordPress Core

Changeset 55772


Ignore:
Timestamp:
05/16/2023 03:17:59 PM (10 months ago)
Author:
SergeyBiryukov
Message:

Grouped backports to the 4.1 branch.

  • Media: Prevent CSRF setting attachment thumbnails.

Merges [55764] to the 4.1 branch.
Props dd32, isabel_brison, martinkrcho, matveb, ocean90, paulkevan, peterwilsoncc, timothyblynjacobs, xknown, youknowriad.

Location:
branches/4.1
Files:
7 edited

Legend:

Unmodified
Added
Removed
  • branches/4.1/package-lock.json

    r54581 r55772  
    11{
    22    "name": "WordPress",
    3     "version": "4.1.37",
     3    "version": "4.1.38",
    44    "lockfileVersion": 1,
    55    "requires": true,
  • branches/4.1/package.json

    r54581 r55772  
    11{
    22    "name": "WordPress",
    3     "version": "4.1.37",
     3    "version": "4.1.38",
    44    "description": "WordPress is web software you can use to create a beautiful website or blog.",
    55    "repository": {
  • branches/4.1/src/wp-admin/about.php

    r55391 r55772  
    4343
    4444<div class="changelog point-releases">
    45     <h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 37 ); ?></h3>
     45    <h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 38 ); ?></h3>
     46    <p>
     47        <?php
     48        printf(
     49            /* translators: %s: WordPress version number */
     50            __( '<strong>Version %s</strong> addressed one security issue.' ),
     51            '4.1.38'
     52        );
     53        ?>
     54        <?php
     55        printf(
     56            /* translators: %s: HelpHub URL */
     57            __( 'For more information, see <a href="%s">the release notes</a>.' ),
     58            sprintf(
     59                /* translators: %s: WordPress version */
     60                esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
     61                sanitize_title( '4.1.38' )
     62            )
     63        );
     64        ?>
     65    </p>
    4666    <p>
    4767        <?php
  • branches/4.1/src/wp-admin/includes/ajax-actions.php

    r45955 r55772  
    20122012    }
    20132013
     2014    if ( false === check_ajax_referer( 'set-attachment-thumbnail', '_ajax_nonce', false ) ) {
     2015        wp_send_json_error();
     2016    }
     2017
    20142018    $post_ids = array();
    20152019    // For each URL, try to find its corresponding post ID.
  • branches/4.1/src/wp-includes/js/media-audiovideo.js

    r31395 r55772  
    589589                wp.ajax.send( 'set-attachment-thumbnail', {
    590590                    data : {
     591                        _ajax_nonce: wp.media.view.settings.nonce.setAttachmentThumbnail,
    591592                        urls: urls,
    592593                        thumbnail_id: attachment.get( 'id' )
  • branches/4.1/src/wp-includes/media.php

    r40167 r55772  
    28632863        'captions'  => ! apply_filters( 'disable_captions', '' ),
    28642864        'nonce'     => array(
    2865             'sendToEditor' => wp_create_nonce( 'media-send-to-editor' ),
     2865            'sendToEditor'           => wp_create_nonce( 'media-send-to-editor' ),
     2866            'setAttachmentThumbnail' => wp_create_nonce( 'set-attachment-thumbnail' ),
    28662867        ),
    28672868        'post'    => array(
  • branches/4.1/src/wp-includes/version.php

    r54581 r55772  
    55 * @global string $wp_version
    66 */
    7 $wp_version = '4.1.37-src';
     7$wp_version = '4.1.38-src';
    88
    99/**
Note: See TracChangeset for help on using the changeset viewer.