Changeset 55787 for branches/4.9/src/wp-admin/includes/ajax-actions.php

Timestamp:

05/16/2023 03:53:40 PM (16 months ago)

Author:

SergeyBiryukov

Message:

Grouped backports to the 4.9 branch.

• Media: Prevent CSRF setting attachment thumbnails.
• Embeds: Add protocol validation for WordPress Embed code.

Merges [55763] and [55764] to the 4.9 branch.
Props dd32, isabel_brison, martinkrcho, matveb, ocean90, paulkevan, peterwilsoncc, timothyblynjacobs, xknown, youknowriad.

File:

• branches/4.9/src/wp-admin/includes/ajax-actions.php (modified) (1 diff)

branches/4.9/src/wp-admin/includes/ajax-actions.php

@@ -2260 +2260 @@
     }
 
+    if ( false === check_ajax_referer( 'set-attachment-thumbnail', '_ajax_nonce', false ) ) {
+        wp_send_json_error();
+    }
+
     $post_ids = array();
     // For each URL, try to find its corresponding post ID.