Changeset 55790 for branches/5.1

Timestamp:

05/16/2023 04:01:50 PM (3 years ago)

Author:

audrasjb

Message:

Grouped backports to the 5.1 branch.

• Media: Prevent CSRF setting attachment thumbnails.
• Embeds: Add protocol validation for WordPress Embed code.
• I18N: Introduce sanitization function for locale.
• Editor: Ensure block comments are of a valid form.

Merges [55760-55764] to the 5.1 branch.
Props dd32, isabel_brison, martinkrcho, matveb, ocean90, paulkevan, peterwilsoncc, timothyblynjacobs, xknown, youknowriad.

Location:

branches/5.1

Files:

• package-lock.json (modified) (1 diff)
• package.json (modified) (1 diff)
• src/js/_enqueues/wp/embed.js (modified) (2 diffs)
• src/js/media/views/frame/video-details.js (modified) (1 diff)
• src/wp-admin/about.php (modified) (1 diff)
• src/wp-admin/includes/ajax-actions.php (modified) (1 diff)
• src/wp-includes/blocks.php (modified) (2 diffs)
• src/wp-includes/formatting.php (modified) (1 diff)
• src/wp-includes/l10n.php (modified) (1 diff)
• src/wp-includes/media.php (modified) (1 diff)
• src/wp-includes/version.php (modified) (1 diff)
• tests/phpunit/tests/ajax/Attachments.php (modified) (1 diff)
• tests/phpunit/tests/formatting/sanitizeLocaleName.php (added)

branches/5.1/package-lock.json

@@ -1 +1 @@
 {
         "name": "WordPress",
-        "version": "5.1.15",
+        "version": "5.1.16",
         "lockfileVersion": 1,
         "requires": true,

branches/5.1/package.json

@@ -1 +1 @@
 {
         "name": "WordPress",
-        "version": "5.1.15",
+        "version": "5.1.16",
         "description": "WordPress is open source software you can use to create a beautiful website, blog, or app.",
         "repository": {

branches/5.1/src/js/_enqueues/wp/embed.js

@@ -45 +45 @@
                 var iframes = document.querySelectorAll( 'iframe[data-secret="' + data.secret + '"]' ),
                         blockquotes = document.querySelectorAll( 'blockquote[data-secret="' + data.secret + '"]' ),
+                        allowedProtocols = new RegExp( '^https?:$', 'i' ),
                         i, source, height, sourceURL, targetURL;
 
@@ -79 +80 @@
                                 sourceURL.href = source.getAttribute( 'src' );
                                 targetURL.href = data.value;
+
+                                /* Only follow link if the protocol is in the allow list. */
+                                if ( ! allowedProtocols.test( targetURL.protocol ) ) {
+                                        continue;
+                                }
 
                                 /* Only continue if link hostname matches iframe's hostname. */

branches/5.1/src/js/media/views/frame/video-details.js

@@ -107 +107 @@
                         wp.ajax.send( 'set-attachment-thumbnail', {
                                 data : {
+                                        _ajax_nonce: wp.media.view.settings.nonce.setAttachmentThumbnail,
                                         urls: urls,
                                         thumbnail_id: attachment.get( 'id' )

branches/5.1/src/wp-admin/about.php

@@ -37 +37 @@
                 <div class="changelog point-releases">
                         <h3><?php _e( 'Maintenance and Security Releases' ); ?></h3>
+                        <p>
+                                <?php
+                                printf(
+                                        /* translators: %s: WordPress version number */
+                                        __( '<strong>Version %s</strong> addressed some security issues.' ),
+                                        '5.1.16'
+                                );
+                                ?>
+                                <?php
+                                printf(
+                                        /* translators: %s: HelpHub URL */
+                                        __( 'For more information, see <a href="%s">the release notes</a>.' ),
+                                        sprintf(
+                                                /* translators: %s: WordPress version */
+                                                esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+                                                sanitize_title( '5.1.16' )
+                                        )
+                                );
+                                ?>
+                        </p>
                         <p>
                                 <?php

branches/5.1/src/wp-admin/includes/ajax-actions.php

@@ -2508 +2508 @@
         }
 
+        if ( false === check_ajax_referer( 'set-attachment-thumbnail', '_ajax_nonce', false ) ) {
+                wp_send_json_error();
+        }
+
         $post_ids = array();
         // For each URL, try to find its corresponding post ID.

branches/5.1/src/wp-includes/blocks.php

@@ -272 +272 @@
         $result = '';
 
+        if ( false !== strpos( $text, '<!--' ) && false !== strpos( $text, '--->' ) ) {
+                $text = preg_replace_callback( '%<!--(.*?)--->%', '_filter_block_content_callback', $text );
+        }
+
         $blocks = parse_blocks( $text );
         foreach ( $blocks as $block ) {
@@ -279 +283 @@
 
         return $result;
+}
+
+/**
+ * Callback used for regular expression replacement in filter_block_content().
+ *
+ * @private
+ * @since 6.2.1
+ *
+ * @param array $matches Array of preg_replace_callback matches.
+ * @return string Replacement string.
+ */
+function _filter_block_content_callback( $matches ) {
+        return '<!--' . rtrim( $matches[1], '-' ) . '-->';
 }
 

branches/5.1/src/wp-includes/formatting.php

@@ -2367 +2367 @@
 
 /**
+ * Strips out all characters not allowed in a locale name.
+ *
+ * @since 6.2.1
+ *
+ * @param string $locale_name The locale name to be sanitized.
+ * @return string The sanitized value.
+ */
+function sanitize_locale_name( $locale_name ) {
+        // Limit to A-Z, a-z, 0-9, '_', '-'.
+        $sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $locale_name );
+
+        /**
+         * Filters a sanitized locale name string.
+         *
+         * @since 6.2.1
+         *
+         * @param string $sanitized   The sanitized locale name.
+         * @param string $locale_name The locale name before sanitization.
+         */
+        return apply_filters( 'sanitize_locale_name', $sanitized, $locale_name );
+}
+
+/**
  * Converts lone & characters into `&` (a.k.a. `&`)
  *

branches/5.1/src/wp-includes/l10n.php

@@ -140 +140 @@
 
         if ( ! empty( $_GET['wp_lang'] ) && ! empty( $GLOBALS['pagenow'] ) && 'wp-login.php' === $GLOBALS['pagenow'] ) {
-                $determined_locale = sanitize_text_field( $_GET['wp_lang'] );
+                $determined_locale = sanitize_locale_name( wp_unslash( $_GET['wp_lang'] ) );
         }
 

branches/5.1/src/wp-includes/media.php

@@ -3584 +3584 @@
                 'captions'         => ! apply_filters( 'disable_captions', '' ),
                 'nonce'            => array(
-                        'sendToEditor' => wp_create_nonce( 'media-send-to-editor' ),
+                        'sendToEditor'           => wp_create_nonce( 'media-send-to-editor' ),
+                        'setAttachmentThumbnail' => wp_create_nonce( 'set-attachment-thumbnail' ),
                 ),
                 'post'             => array(

branches/5.1/src/wp-includes/version.php

@@ -14 +14 @@
  * @global string $wp_version
  */
-$wp_version = '5.1.15-src';
+$wp_version = '5.1.16-src';
 
 /**

branches/5.1/tests/phpunit/tests/ajax/Attachments.php

@@ -114 +114 @@
                 $this->assertEquals( $expected, $response['data'] );
         }
+
+        public function test_wp_ajax_set_attachment_thumbnail_success() {
+                // Become an administrator.
+                $post    = $_POST;
+                $user_id = self::factory()->user->create(
+                        array(
+                                'role'       => 'administrator',
+                                'user_login' => 'user_36578_administrator',
+                                'user_email' => 'user_36578_administrator@example.com',
+                        )
+                );
+                wp_set_current_user( $user_id );
+                $_POST = array_merge( $_POST, $post );
+
+                // Upload the attachment itself.
+                $filename = DIR_TESTDATA . '/uploads/small-audio.mp3';
+                $contents = file_get_contents( $filename );
+
+                $upload     = wp_upload_bits( wp_basename( $filename ), null, $contents );
+                $attachment = $this->_make_attachment( $upload );
+
+                // Upload the thumbnail.
+                $filename = DIR_TESTDATA . '/images/waffles.jpg';
+                $contents = file_get_contents( $filename );
+
+                $upload    = wp_upload_bits( wp_basename( $filename ), null, $contents );
+                $thumbnail = $this->_make_attachment( $upload );
+
+                // Set up a default request.
+                $_POST['_ajax_nonce']  = wp_create_nonce( 'set-attachment-thumbnail' );
+                $_POST['thumbnail_id'] = $thumbnail;
+                $_POST['urls']         = array( wp_get_attachment_url( $attachment ) );
+
+                // Make the request.
+                try {
+                        $this->_handleAjax( 'set-attachment-thumbnail' );
+                } catch ( WPAjaxDieContinueException $e ) {
+                        unset( $e );
+                }
+
+                // Get the response.
+                $response = json_decode( $this->_last_response, true );
+
+                // Ensure everything is correct.
+                $this->assertTrue( $response['success'] );
+        }
+
+        public function test_wp_ajax_set_attachment_thumbnail_missing_nonce() {
+                // Become an administrator.
+                $post    = $_POST;
+                $user_id = self::factory()->user->create(
+                        array(
+                                'role'       => 'administrator',
+                                'user_login' => 'user_36578_administrator',
+                                'user_email' => 'user_36578_administrator@example.com',
+                        )
+                );
+                wp_set_current_user( $user_id );
+                $_POST = array_merge( $_POST, $post );
+
+                // Upload the attachment itself.
+                $filename = DIR_TESTDATA . '/uploads/small-audio.mp3';
+                $contents = file_get_contents( $filename );
+
+                $upload     = wp_upload_bits( wp_basename( $filename ), null, $contents );
+                $attachment = $this->_make_attachment( $upload );
+
+                // Upload the thumbnail.
+                $filename = DIR_TESTDATA . '/images/waffles.jpg';
+                $contents = file_get_contents( $filename );
+
+                $upload    = wp_upload_bits( wp_basename( $filename ), null, $contents );
+                $thumbnail = $this->_make_attachment( $upload );
+
+                // Set up a default request.
+                $_POST['thumbnail_id'] = $thumbnail;
+                $_POST['urls']         = array( wp_get_attachment_url( $attachment ) );
+
+                // Make the request.
+                try {
+                        $this->_handleAjax( 'set-attachment-thumbnail' );
+                } catch ( WPAjaxDieContinueException $e ) {
+                        unset( $e );
+                }
+
+                // Get the response.
+                $response = json_decode( $this->_last_response, true );
+
+                // Check that success is false without sending nonce.
+                $this->assertFalse( $response['success'] );
+        }
 }