Make WordPress Core


Ignore:
Timestamp:
05/16/2023 03:35:46 PM (12 months ago)
Author:
audrasjb
Message:

Grouped backports to the 5.7 branch.

  • Media: Prevent CSRF setting attachment thumbnails.
  • Embeds: Add protocol validation for WordPress Embed code.
  • I18N: Introduce sanitization function for locale.
  • Editor: Ensure block comments are of a valid form.

Merges [55760-55764] to the 5.7 branch.
Props dd32, isabel_brison, martinkrcho, matveb, ocean90, paulkevan, peterwilsoncc, timothyblynjacobs, xknown, youknowriad.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/5.7/src/wp-admin/includes/ajax-actions.php

    r54553 r55778  
    27232723    }
    27242724
     2725    if ( false === check_ajax_referer( 'set-attachment-thumbnail', '_ajax_nonce', false ) ) {
     2726        wp_send_json_error();
     2727    }
     2728
    27252729    $post_ids = array();
    27262730    // For each URL, try to find its corresponding post ID.
Note: See TracChangeset for help on using the changeset viewer.