Changeset 55786 for branches/4.8/src/wp-includes/media.php

Timestamp:

05/16/2023 03:50:47 PM (22 months ago)

Author:

SergeyBiryukov

Message:

Grouped backports to the 4.8 branch.

• Media: Prevent CSRF setting attachment thumbnails.
• Embeds: Add protocol validation for WordPress Embed code.

Merges [55763] and [55764] to the 4.8 branch.
Props dd32, isabel_brison, martinkrcho, matveb, ocean90, paulkevan, peterwilsoncc, timothyblynjacobs, xknown, youknowriad.

File:

• branches/4.8/src/wp-includes/media.php (modified) (1 diff)

branches/4.8/src/wp-includes/media.php

@@ -3436 +3436 @@
         'captions'  => ! apply_filters( 'disable_captions', '' ),
         'nonce'     => array(
-            'sendToEditor' => wp_create_nonce( 'media-send-to-editor' ),
-            'wpRestApi'    => wp_create_nonce( 'wp_rest' ),
+            'sendToEditor'           => wp_create_nonce( 'media-send-to-editor' ),
+            'wpRestApi'              => wp_create_nonce( 'wp_rest' ),
+            'setAttachmentThumbnail' => wp_create_nonce( 'set-attachment-thumbnail' ),
         ),
         'post'    => array(