Make WordPress Core


Ignore:
Timestamp:
05/16/2023 03:40:27 PM (13 months ago)
Author:
audrasjb
Message:

Grouped backports to the 5.6 branch.

  • Media: Prevent CSRF setting attachment thumbnails.
  • Embeds: Add protocol validation for WordPress Embed code.
  • I18N: Introduce sanitization function for locale.
  • Editor: Ensure block comments are of a valid form.

Merges [55760-55764] to the 5.6 branch.
Props dd32, isabel_brison, martinkrcho, matveb, ocean90, paulkevan, peterwilsoncc, timothyblynjacobs, xknown, youknowriad.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/5.6/tests/phpunit/tests/ajax/Attachments.php

    r48937 r55781  
    114114        $this->assertSame( $expected, $response['data'] );
    115115    }
     116
     117    public function test_wp_ajax_set_attachment_thumbnail_success() {
     118        // Become an administrator.
     119        $post    = $_POST;
     120        $user_id = self::factory()->user->create(
     121            array(
     122                'role'       => 'administrator',
     123                'user_login' => 'user_36578_administrator',
     124                'user_email' => 'user_36578_administrator@example.com',
     125            )
     126        );
     127        wp_set_current_user( $user_id );
     128        $_POST = array_merge( $_POST, $post );
     129
     130        // Upload the attachment itself.
     131        $filename = DIR_TESTDATA . '/uploads/small-audio.mp3';
     132        $contents = file_get_contents( $filename );
     133
     134        $upload     = wp_upload_bits( wp_basename( $filename ), null, $contents );
     135        $attachment = $this->_make_attachment( $upload );
     136
     137        // Upload the thumbnail.
     138        $filename = DIR_TESTDATA . '/images/waffles.jpg';
     139        $contents = file_get_contents( $filename );
     140
     141        $upload    = wp_upload_bits( wp_basename( $filename ), null, $contents );
     142        $thumbnail = $this->_make_attachment( $upload );
     143
     144        // Set up a default request.
     145        $_POST['_ajax_nonce']  = wp_create_nonce( 'set-attachment-thumbnail' );
     146        $_POST['thumbnail_id'] = $thumbnail;
     147        $_POST['urls']         = array( wp_get_attachment_url( $attachment ) );
     148
     149        // Make the request.
     150        try {
     151            $this->_handleAjax( 'set-attachment-thumbnail' );
     152        } catch ( WPAjaxDieContinueException $e ) {
     153            unset( $e );
     154        }
     155
     156        // Get the response.
     157        $response = json_decode( $this->_last_response, true );
     158
     159        // Ensure everything is correct.
     160        $this->assertTrue( $response['success'] );
     161    }
     162
     163    public function test_wp_ajax_set_attachment_thumbnail_missing_nonce() {
     164        // Become an administrator.
     165        $post    = $_POST;
     166        $user_id = self::factory()->user->create(
     167            array(
     168                'role'       => 'administrator',
     169                'user_login' => 'user_36578_administrator',
     170                'user_email' => 'user_36578_administrator@example.com',
     171            )
     172        );
     173        wp_set_current_user( $user_id );
     174        $_POST = array_merge( $_POST, $post );
     175
     176        // Upload the attachment itself.
     177        $filename = DIR_TESTDATA . '/uploads/small-audio.mp3';
     178        $contents = file_get_contents( $filename );
     179
     180        $upload     = wp_upload_bits( wp_basename( $filename ), null, $contents );
     181        $attachment = $this->_make_attachment( $upload );
     182
     183        // Upload the thumbnail.
     184        $filename = DIR_TESTDATA . '/images/waffles.jpg';
     185        $contents = file_get_contents( $filename );
     186
     187        $upload    = wp_upload_bits( wp_basename( $filename ), null, $contents );
     188        $thumbnail = $this->_make_attachment( $upload );
     189
     190        // Set up a default request.
     191        $_POST['thumbnail_id'] = $thumbnail;
     192        $_POST['urls']         = array( wp_get_attachment_url( $attachment ) );
     193
     194        // Make the request.
     195        try {
     196            $this->_handleAjax( 'set-attachment-thumbnail' );
     197        } catch ( WPAjaxDieContinueException $e ) {
     198            unset( $e );
     199        }
     200
     201        // Get the response.
     202        $response = json_decode( $this->_last_response, true );
     203
     204        // Check that success is false without sending nonce.
     205        $this->assertFalse( $response['success'] );
     206    }
    116207}
Note: See TracChangeset for help on using the changeset viewer.