Changeset 55785 for branches/5.4/src/wp-includes/l10n.php

Timestamp:

05/16/2023 03:50:15 PM (3 years ago)

Author:

audrasjb

Message:

Grouped backports to the 5.4 branch.

• Media: Prevent CSRF setting attachment thumbnails.
• Embeds: Add protocol validation for WordPress Embed code.
• I18N: Introduce sanitization function for locale.
• Editor: Ensure block comments are of a valid form.

Merges [55760-55764] to the 5.4 branch.
Props dd32, isabel_brison, martinkrcho, matveb, ocean90, paulkevan, peterwilsoncc, timothyblynjacobs, xknown, youknowriad.

File:

• branches/5.4/src/wp-includes/l10n.php (modified) (1 diff)

branches/5.4/src/wp-includes/l10n.php

@@ -145 +145 @@
 
     if ( ! empty( $_GET['wp_lang'] ) && ! empty( $GLOBALS['pagenow'] ) && 'wp-login.php' === $GLOBALS['pagenow'] ) {
-        $determined_locale = sanitize_text_field( $_GET['wp_lang'] );
+        $determined_locale = sanitize_locale_name( wp_unslash( $_GET['wp_lang'] ) );
     }