Changeset 56838

Timestamp:

10/12/2023 12:45:49 PM (3 years ago)

Author:

audrasjb

Message:

Shortcodes: Restrict ajax handler for media shortcode.

Props tykoted, xknown, peterwilsoncc, antpb, jorbin.

Location:

trunk

Files:

• src/wp-admin/includes/ajax-actions.php (modified) (2 diffs)
• src/wp-includes/media.php (modified) (4 diffs)
• src/wp-includes/shortcodes.php (modified) (1 diff)
• tests/phpunit/tests/ajax/wpAjaxParseMediaShortcode.php (added)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -3883 +3883 @@
         $shortcode = wp_unslash( $_POST['shortcode'] );
 
+        // Only process previews for media related shortcodes:
+        $found_shortcodes = get_shortcode_tags_in_content( $shortcode );
+        $media_shortcodes = array(
+                'audio',
+                'embed',
+                'playlist',
+                'video',
+                'gallery',
+        );
+
+        $other_shortcodes = array_diff( $found_shortcodes, $media_shortcodes );
+
+        if ( ! empty( $other_shortcodes ) ) {
+                wp_send_json_error();
+        }
+
         if ( ! empty( $_POST['post_ID'] ) ) {
                 $post = get_post( (int) $_POST['post_ID'] );
@@ -3889 +3905 @@
         // The embed shortcode requires a post.
         if ( ! $post || ! current_user_can( 'edit_post', $post->ID ) ) {
-                if ( 'embed' === $shortcode ) {
+                if ( in_array( 'embed', $found_shortcodes, true ) ) {
                         wp_send_json_error();
                 }

trunk/src/wp-includes/media.php

@@ -2608 +2608 @@
                 }
         } elseif ( ! empty( $atts['exclude'] ) ) {
+                $post_parent_id = $id;
                 $attachments = get_children(
                         array(
@@ -2620 +2621 @@
                 );
         } else {
+                $post_parent_id = $id;
                 $attachments = get_children(
                         array(
@@ -2630 +2632 @@
                         )
                 );
+        }
+
+        if ( ! empty( $post_parent_id ) ) {
+                $post_parent = get_post( $post_parent_id );
+
+                // terminate the shortcode execution if user cannot read the post or password-protected
+                if (
+                ( ! is_post_publicly_viewable( $post_parent->ID ) && ! current_user_can( 'read_post', $post_parent->ID ) )
+                || post_password_required( $post_parent ) ) {
+                        return '';
+                }
         }
 
@@ -2964 +2977 @@
         }
 
+        if ( ! empty( $args['post_parent'] ) ) {
+                $post_parent = get_post( $id );
+
+                // terminate the shortcode execution if user cannot read the post or password-protected
+                if ( ! current_user_can( 'read_post', $post_parent->ID ) || post_password_required( $post_parent ) ) {
+                        return '';
+                }
+        }
+
         if ( empty( $attachments ) ) {
                 return '';

trunk/src/wp-includes/shortcodes.php

@@ -167 +167 @@
         }
         return false;
+}
+
+/**
+ * Returns a list of registered shortcode names found in the given content.
+ *
+ * Example usage:
+ *
+ *     get_shortcode_tags_in_content( '[audio src="file.mp3"][/audio] [foo] [gallery ids="1,2,3"]' );
+ *     // array( 'audio', 'gallery' )
+ *
+ * @since 6.3.2
+ *
+ * @param string $content The content to check.
+ * @return string[] An array of registered shortcode names found in the content.
+ */
+function get_shortcode_tags_in_content( $content ) {
+        if ( false === strpos( $content, '[' ) ) {
+                return array();
+        }
+
+        preg_match_all( '/' . get_shortcode_regex() . '/', $content, $matches, PREG_SET_ORDER );
+        if ( empty( $matches ) ) {
+                return array();
+        }
+
+        $tags = array();
+        foreach ( $matches as $shortcode ) {
+                $tags[] = $shortcode[2];
+
+                if ( ! empty( $shortcode[5] ) ) {
+                        $deep_tags = get_shortcode_tags_in_content( $shortcode[5] );
+                        if ( ! empty( $deep_tags ) ) {
+                                $tags = array_merge( $tags, $deep_tags );
+                        }
+                }
+        }
+
+        return $tags;
 }