Changeset 55787

Timestamp:

05/16/2023 03:53:40 PM (17 months ago)

Author:

SergeyBiryukov

Message:

Grouped backports to the 4.9 branch.

• Media: Prevent CSRF setting attachment thumbnails.
• Embeds: Add protocol validation for WordPress Embed code.

Merges [55763] and [55764] to the 4.9 branch.
Props dd32, isabel_brison, martinkrcho, matveb, ocean90, paulkevan, peterwilsoncc, timothyblynjacobs, xknown, youknowriad.

Location:

branches/4.9

Files:

• package-lock.json (modified) (1 diff)
• package.json (modified) (1 diff)
• src/wp-admin/about.php (modified) (1 diff)
• src/wp-admin/includes/ajax-actions.php (modified) (1 diff)
• src/wp-includes/js/media/views/frame/video-details.js (modified) (1 diff)
• src/wp-includes/js/wp-embed.js (modified) (2 diffs)
• src/wp-includes/media.php (modified) (1 diff)
• src/wp-includes/version.php (modified) (1 diff)
• tests/phpunit/tests/ajax/Attachments.php (modified) (1 diff)

branches/4.9/package-lock.json

@@ -1 +1 @@
 {
     "name": "WordPress",
-    "version": "4.9.22",
+    "version": "4.9.23",
     "lockfileVersion": 1,
     "requires": true,

branches/4.9/package.json

@@ -1 +1 @@
 {
     "name": "WordPress",
-    "version": "4.9.22",
+    "version": "4.9.23",
     "description": "WordPress is web software you can use to create a beautiful website or blog.",
     "repository": {

branches/4.9/src/wp-admin/about.php

@@ -34 +34 @@
         <div class="changelog point-releases">
             <h3><?php _e( 'Maintenance and Security Releases' ); ?></h3>
+            <p>
+                <?php
+                printf(
+                    /* translators: %s: WordPress version number */
+                    __( '<strong>Version %s</strong> addressed some security issues.' ),
+                    '4.9.23'
+                );
+                ?>
+                <?php
+                printf(
+                    /* translators: %s: HelpHub URL */
+                    __( 'For more information, see <a href="%s">the release notes</a>.' ),
+                    sprintf(
+                        /* translators: %s: WordPress version */
+                        esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+                        sanitize_title( '4.9.23' )
+                    )
+                );
+                ?>
+            </p>
             <p>
                 <?php

branches/4.9/src/wp-admin/includes/ajax-actions.php

@@ -2260 +2260 @@
     }
 
+    if ( false === check_ajax_referer( 'set-attachment-thumbnail', '_ajax_nonce', false ) ) {
+        wp_send_json_error();
+    }
+
     $post_ids = array();
     // For each URL, try to find its corresponding post ID.

branches/4.9/src/wp-includes/js/media/views/frame/video-details.js

@@ -107 +107 @@
             wp.ajax.send( 'set-attachment-thumbnail', {
                 data : {
+                    _ajax_nonce: wp.media.view.settings.nonce.setAttachmentThumbnail,
                     urls: urls,
                     thumbnail_id: attachment.get( 'id' )

branches/4.9/src/wp-includes/js/wp-embed.js

@@ -44 +44 @@
         var iframes = document.querySelectorAll( 'iframe[data-secret="' + data.secret + '"]' ),
             blockquotes = document.querySelectorAll( 'blockquote[data-secret="' + data.secret + '"]' ),
+            allowedProtocols = new RegExp( '^https?:$', 'i' ),
             i, source, height, sourceURL, targetURL;
 
@@ -78 +79 @@
                 sourceURL.href = source.getAttribute( 'src' );
                 targetURL.href = data.value;
+
+                /* Only follow link if the protocol is in the allow list. */
+                if ( ! allowedProtocols.test( targetURL.protocol ) ) {
+                    continue;
+                }
 
                 /* Only continue if link hostname matches iframe's hostname. */

branches/4.9/src/wp-includes/media.php

@@ -3443 +3443 @@
         'captions'  => ! apply_filters( 'disable_captions', '' ),
         'nonce'     => array(
-            'sendToEditor' => wp_create_nonce( 'media-send-to-editor' ),
+            'sendToEditor'           => wp_create_nonce( 'media-send-to-editor' ),
+            'setAttachmentThumbnail' => wp_create_nonce( 'set-attachment-thumbnail' ),
         ),
         'post'    => array(

branches/4.9/src/wp-includes/version.php

@@ -5 +5 @@
  * @global string $wp_version
  */
-$wp_version = '4.9.22-src';
+$wp_version = '4.9.23-src';
 
 /**

branches/4.9/tests/phpunit/tests/ajax/Attachments.php

@@ -110 +110 @@
         $this->assertEquals( $expected, $response['data'] );
     }
+
+    public function test_wp_ajax_set_attachment_thumbnail_success() {
+        // Become an administrator.
+        $post    = $_POST;
+        $user_id = self::factory()->user->create(
+            array(
+                'role'       => 'administrator',
+                'user_login' => 'user_36578_administrator',
+                'user_email' => 'user_36578_administrator@example.com',
+            )
+        );
+        wp_set_current_user( $user_id );
+        $_POST = array_merge( $_POST, $post );
+
+        // Upload the attachment itself.
+        $filename = DIR_TESTDATA . '/uploads/small-audio.mp3';
+        $contents = file_get_contents( $filename );
+
+        $upload     = wp_upload_bits( wp_basename( $filename ), null, $contents );
+        $attachment = $this->_make_attachment( $upload );
+
+        // Upload the thumbnail.
+        $filename = DIR_TESTDATA . '/images/waffles.jpg';
+        $contents = file_get_contents( $filename );
+
+        $upload    = wp_upload_bits( wp_basename( $filename ), null, $contents );
+        $thumbnail = $this->_make_attachment( $upload );
+
+        // Set up a default request.
+        $_POST['_ajax_nonce']  = wp_create_nonce( 'set-attachment-thumbnail' );
+        $_POST['thumbnail_id'] = $thumbnail;
+        $_POST['urls']         = array( wp_get_attachment_url( $attachment ) );
+
+        // Make the request.
+        try {
+            $this->_handleAjax( 'set-attachment-thumbnail' );
+        } catch ( WPAjaxDieContinueException $e ) {
+            unset( $e );
+        }
+
+        // Get the response.
+        $response = json_decode( $this->_last_response, true );
+
+        // Ensure everything is correct.
+        $this->assertTrue( $response['success'] );
+    }
+
+    public function test_wp_ajax_set_attachment_thumbnail_missing_nonce() {
+        // Become an administrator.
+        $post    = $_POST;
+        $user_id = self::factory()->user->create(
+            array(
+                'role'       => 'administrator',
+                'user_login' => 'user_36578_administrator',
+                'user_email' => 'user_36578_administrator@example.com',
+            )
+        );
+        wp_set_current_user( $user_id );
+        $_POST = array_merge( $_POST, $post );
+
+        // Upload the attachment itself.
+        $filename = DIR_TESTDATA . '/uploads/small-audio.mp3';
+        $contents = file_get_contents( $filename );
+
+        $upload     = wp_upload_bits( wp_basename( $filename ), null, $contents );
+        $attachment = $this->_make_attachment( $upload );
+
+        // Upload the thumbnail.
+        $filename = DIR_TESTDATA . '/images/waffles.jpg';
+        $contents = file_get_contents( $filename );
+
+        $upload    = wp_upload_bits( wp_basename( $filename ), null, $contents );
+        $thumbnail = $this->_make_attachment( $upload );
+
+        // Set up a default request.
+        $_POST['thumbnail_id'] = $thumbnail;
+        $_POST['urls']         = array( wp_get_attachment_url( $attachment ) );
+
+        // Make the request.
+        try {
+            $this->_handleAjax( 'set-attachment-thumbnail' );
+        } catch ( WPAjaxDieContinueException $e ) {
+            unset( $e );
+        }
+
+        // Get the response.
+        $response = json_decode( $this->_last_response, true );
+
+        // Check that success is false without sending nonce.
+        $this->assertFalse( $response['success'] );
+    }
 }