Make WordPress Core


Ignore:
Timestamp:
05/16/2023 03:54:29 PM (14 months ago)
Author:
audrasjb
Message:

Grouped backports to the 5.3 branch.

  • Media: Prevent CSRF setting attachment thumbnails.
  • Embeds: Add protocol validation for WordPress Embed code.
  • I18N: Introduce sanitization function for locale.
  • Editor: Ensure block comments are of a valid form.

Merges [55760-55764] to the 5.3 branch.
Props dd32, isabel_brison, martinkrcho, matveb, ocean90, paulkevan, peterwilsoncc, timothyblynjacobs, xknown, youknowriad.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/5.3/src/wp-includes/l10n.php

    r46232 r55788  
    145145
    146146    if ( ! empty( $_GET['wp_lang'] ) && ! empty( $GLOBALS['pagenow'] ) && 'wp-login.php' === $GLOBALS['pagenow'] ) {
    147         $determined_locale = sanitize_text_field( $_GET['wp_lang'] );
     147        $determined_locale = sanitize_locale_name( wp_unslash( $_GET['wp_lang'] ) );
    148148    }
    149149
Note: See TracChangeset for help on using the changeset viewer.