Changeset 56884
- Timestamp:
- 10/12/2023 03:14:45 PM (13 months ago)
- Location:
- branches/5.8
- Files:
-
- 17 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/5.8
- Property svn:mergeinfo changed
/trunk merged: 56833-56838
- Property svn:mergeinfo changed
-
branches/5.8/src/wp-admin/includes/ajax-actions.php
r55777 r56884 3783 3783 $shortcode = wp_unslash( $_POST['shortcode'] ); 3784 3784 3785 // Only process previews for media related shortcodes: 3786 $found_shortcodes = get_shortcode_tags_in_content( $shortcode ); 3787 $media_shortcodes = array( 3788 'audio', 3789 'embed', 3790 'playlist', 3791 'video', 3792 'gallery', 3793 ); 3794 3795 $other_shortcodes = array_diff( $found_shortcodes, $media_shortcodes ); 3796 3797 if ( ! empty( $other_shortcodes ) ) { 3798 wp_send_json_error(); 3799 } 3800 3785 3801 if ( ! empty( $_POST['post_ID'] ) ) { 3786 3802 $post = get_post( (int) $_POST['post_ID'] ); … … 3789 3805 // The embed shortcode requires a post. 3790 3806 if ( ! $post || ! current_user_can( 'edit_post', $post->ID ) ) { 3791 if ( 'embed' === $shortcode) {3807 if ( in_array( 'embed', $found_shortcodes, true ) ) { 3792 3808 wp_send_json_error(); 3793 3809 } -
branches/5.8/src/wp-admin/includes/class-wp-comments-list-table.php
r50805 r56884 640 640 641 641 $this->user_can = current_user_can( 'edit_comment', $comment->comment_ID ); 642 643 $edit_post_cap = $post ? 'edit_post' : 'edit_posts'; 644 if ( 645 current_user_can( $edit_post_cap, $comment->comment_post_ID ) || 646 ( 647 empty( $post->post_password ) && 648 current_user_can( 'read_post', $comment->comment_post_ID ) 649 ) 650 ) { 651 // The user has access to the post 652 } else { 653 return false; 654 } 642 655 643 656 echo "<tr id='comment-$comment->comment_ID' class='$the_comment_class'>"; -
branches/5.8/src/wp-admin/includes/class-wp-list-table.php
r51115 r56884 735 735 $pending_comments_number 736 736 ); 737 738 $post_object = get_post( $post_id ); 739 $edit_post_cap = $post_object ? 'edit_post' : 'edit_posts'; 740 if ( 741 current_user_can( $edit_post_cap, $post_id ) || 742 ( 743 empty( $post_object->post_password ) && 744 current_user_can( 'read_post', $post_id ) 745 ) 746 ) { 747 // The user has access to the post and thus can see comments 748 } else { 749 return false; 750 } 737 751 738 752 if ( ! $approved_comments && ! $pending_comments ) { -
branches/5.8/src/wp-admin/includes/dashboard.php
r51313 r56884 1086 1086 echo '<ul id="the-comment-list" data-wp-lists="list:comment">'; 1087 1087 foreach ( $comments as $comment ) { 1088 _wp_dashboard_recent_comments_row( $comment ); 1088 1089 $comment_post = get_post( $comment->comment_post_ID ); 1090 if ( 1091 current_user_can( 'edit_post', $comment->comment_post_ID ) || 1092 ( 1093 empty( $comment_post->post_password ) && 1094 current_user_can( 'read_post', $comment->comment_post_ID ) 1095 ) 1096 ) { 1097 _wp_dashboard_recent_comments_row( $comment ); 1098 } 1089 1099 } 1090 1100 echo '</ul>'; -
branches/5.8/src/wp-admin/includes/user.php
r50981 r56884 600 600 * 601 601 * @since 5.6.0 602 * @since 6.2.0 Allow insecure HTTP connections for the local environment. 603 * @since 6.3.2 Validates the success and reject URLs to prevent javascript pseudo protocol being executed. 602 604 * 603 605 * @param array $request { … … 615 617 $error = new WP_Error(); 616 618 617 if ( ! empty( $request['success_url'] ) ) { 618 $scheme = wp_parse_url( $request['success_url'], PHP_URL_SCHEME ); 619 620 if ( 'http' === $scheme ) { 619 if ( isset( $request['success_url'] ) ) { 620 $validated_success_url = wp_is_authorize_application_redirect_url_valid( $request['success_url'] ); 621 if ( is_wp_error( $validated_success_url ) ) { 621 622 $error->add( 622 'invalid_redirect_scheme',623 __( 'The success url must be served over a secure connection.')623 $validated_success_url->get_error_code(), 624 $validated_success_url->get_error_message() 624 625 ); 625 626 } 626 627 } 627 628 628 if ( ! empty( $request['reject_url'] ) ) { 629 $scheme = wp_parse_url( $request['reject_url'], PHP_URL_SCHEME ); 630 631 if ( 'http' === $scheme ) { 629 if ( isset( $request['reject_url'] ) ) { 630 $validated_reject_url = wp_is_authorize_application_redirect_url_valid( $request['reject_url'] ); 631 if ( is_wp_error( $validated_reject_url ) ) { 632 632 $error->add( 633 'invalid_redirect_scheme',634 __( 'The rejection url must be served over a secure connection.')633 $validated_reject_url->get_error_code(), 634 $validated_reject_url->get_error_message() 635 635 ); 636 636 } … … 661 661 return true; 662 662 } 663 664 /** 665 * Validates the redirect URL protocol scheme. The protocol can be anything except http and javascript. 666 * 667 * @since 6.3.2 668 * 669 * @param string $url - The redirect URL to be validated. 670 * 671 * @return true|WP_Error True if the redirect URL is valid, a WP_Error object otherwise. 672 */ 673 function wp_is_authorize_application_redirect_url_valid( $url ) { 674 $bad_protocols = array( 'javascript', 'data' ); 675 if ( empty( $url ) ) { 676 return true; 677 } 678 679 // Based on https://www.rfc-editor.org/rfc/rfc2396#section-3.1 680 $valid_scheme_regex = '/^[a-zA-Z][a-zA-Z0-9+.-]*:/'; 681 if ( ! preg_match( $valid_scheme_regex, $url ) ) { 682 return new WP_Error( 683 'invalid_redirect_url_format', 684 __( 'Invalid URL format.' ) 685 ); 686 } 687 688 /** 689 * Filters the list of invalid protocols used in applications redirect URLs. 690 * 691 * @since 6.3.2 692 * 693 * @param string[] $bad_protocols Array of invalid protocols. 694 * @param string $url The redirect URL to be validated. 695 */ 696 $invalid_protocols = array_map( 'strtolower', apply_filters( 'wp_authorize_application_redirect_url_invalid_protocols', $bad_protocols, $url ) ); 697 698 $scheme = wp_parse_url( $url, PHP_URL_SCHEME ); 699 $host = wp_parse_url( $url, PHP_URL_HOST ); 700 $is_local = 'local' === wp_get_environment_type(); 701 702 // validates if the proper URI format is applied to the $url 703 if ( empty( $host ) || empty( $scheme ) || in_array( strtolower( $scheme ), $invalid_protocols, true ) ) { 704 return new WP_Error( 705 'invalid_redirect_url_format', 706 __( 'Invalid URL format.' ) 707 ); 708 } 709 710 if ( 'http' === $scheme && ! $is_local ) { 711 return new WP_Error( 712 'invalid_redirect_scheme', 713 __( 'The URL must be served over a secure connection.' ) 714 ); 715 } 716 717 return true; 718 } -
branches/5.8/src/wp-includes/Requests/Hooks.php
r50842 r56884 66 66 return true; 67 67 } 68 69 public function __wakeup() { 70 throw new \LogicException( __CLASS__ . ' should never be unserialized' ); 71 } 68 72 } -
branches/5.8/src/wp-includes/Requests/IRI.php
r50842 r56884 706 706 } 707 707 708 public function __wakeup() { 709 $class_props = get_class_vars( __CLASS__ ); 710 $string_props = array( 'scheme', 'iuserinfo', 'ihost', 'port', 'ipath', 'iquery', 'ifragment' ); 711 $array_props = array( 'normalization' ); 712 foreach ( $class_props as $prop => $default_value ) { 713 if ( in_array( $prop, $string_props, true ) && ! is_string( $this->$prop ) ) { 714 throw new UnexpectedValueException(); 715 } elseif ( in_array( $prop, $array_props, true ) && ! is_array( $this->$prop ) ) { 716 throw new UnexpectedValueException(); 717 } 718 $this->$prop = null; 719 } 720 } 721 708 722 /** 709 723 * Set the entire IRI. Returns true on success, false on failure (if there -
branches/5.8/src/wp-includes/Requests/Session.php
r50842 r56884 230 230 } 231 231 232 public function __wakeup() { 233 throw new \LogicException( __CLASS__ . ' should never be unserialized' ); 234 } 235 232 236 /** 233 237 * Merge a request's data with the default data -
branches/5.8/src/wp-includes/class-wp-block-patterns-registry.php
r51154 r56884 140 140 } 141 141 142 public function __wakeup() { 143 if ( ! $this->registered_patterns ) { 144 return; 145 } 146 if ( ! is_array( $this->registered_patterns ) ) { 147 throw new UnexpectedValueException(); 148 } 149 foreach ( $this->registered_patterns as $value ) { 150 if ( ! is_array( $value ) ) { 151 throw new UnexpectedValueException(); 152 } 153 } 154 $this->registered_patterns_outside_init = array(); 155 } 156 142 157 /** 143 158 * Utility method to retrieve the main instance of the class. -
branches/5.8/src/wp-includes/class-wp-block-type-registry.php
r51154 r56884 168 168 } 169 169 170 public function __wakeup() { 171 if ( ! $this->registered_block_types ) { 172 return; 173 } 174 if ( ! is_array( $this->registered_block_types ) ) { 175 throw new UnexpectedValueException(); 176 } 177 foreach ( $this->registered_block_types as $value ) { 178 if ( ! $value instanceof WP_Block_Type ) { 179 throw new UnexpectedValueException(); 180 } 181 } 182 } 183 170 184 /** 171 185 * Utility method to retrieve the main instance of the class. -
branches/5.8/src/wp-includes/class-wp-theme.php
r51003 r56884 677 677 678 678 /** 679 * Perform reinitialization tasks. 680 * 681 * Prevents a callback from being injected during unserialization of an object. 682 * 683 * @return void 684 */ 685 public function __wakeup() { 686 if ( $this->parent && ! $this->parent instanceof self ) { 687 throw new UnexpectedValueException(); 688 } 689 if ( $this->headers && ! is_array( $this->headers ) ) { 690 throw new UnexpectedValueException(); 691 } 692 foreach ( $this->headers as $value ) { 693 if ( ! is_string( $value ) ) { 694 throw new UnexpectedValueException(); 695 } 696 } 697 $this->headers_sanitized = array(); 698 } 699 700 /** 679 701 * Adds theme data to cache. 680 702 * … … 1676 1698 return strnatcasecmp( $a->name_translated, $b->name_translated ); 1677 1699 } 1700 1701 private static function _check_headers_property_has_correct_type( $headers ) { 1702 if ( ! is_array( $headers ) ) { 1703 return false; 1704 } 1705 foreach ( $headers as $key => $value ) { 1706 if ( ! is_string( $key ) || ! is_string( $value ) ) { 1707 return false; 1708 } 1709 } 1710 return true; 1711 } 1678 1712 } -
branches/5.8/src/wp-includes/media.php
r55777 r56884 2339 2339 } 2340 2340 } elseif ( ! empty( $atts['exclude'] ) ) { 2341 $post_parent_id = $id; 2341 2342 $attachments = get_children( 2342 2343 array( … … 2351 2352 ); 2352 2353 } else { 2354 $post_parent_id = $id; 2353 2355 $attachments = get_children( 2354 2356 array( … … 2361 2363 ) 2362 2364 ); 2365 } 2366 2367 if ( ! empty( $post_parent_id ) ) { 2368 $post_parent = get_post( $post_parent_id ); 2369 2370 // terminate the shortcode execution if user cannot read the post or password-protected 2371 if ( 2372 ( ! is_post_publicly_viewable( $post_parent->ID ) && ! current_user_can( 'read_post', $post_parent->ID ) ) 2373 || post_password_required( $post_parent ) ) { 2374 return ''; 2375 } 2363 2376 } 2364 2377 … … 2689 2702 } 2690 2703 2704 if ( ! empty( $args['post_parent'] ) ) { 2705 $post_parent = get_post( $id ); 2706 2707 // terminate the shortcode execution if user cannot read the post or password-protected 2708 if ( ! current_user_can( 'read_post', $post_parent->ID ) || post_password_required( $post_parent ) ) { 2709 return ''; 2710 } 2711 } 2712 2691 2713 if ( empty( $attachments ) ) { 2692 2714 return ''; -
branches/5.8/src/wp-includes/rest-api.php
r51021 r56884 1029 1029 1030 1030 if ( ! $result ) { 1031 add_filter( 'rest_send_nocache_headers', '__return_true', 20 ); 1031 1032 return new WP_Error( 'rest_cookie_invalid_nonce', __( 'Cookie check failed' ), array( 'status' => 403 ) ); 1032 1033 } -
branches/5.8/src/wp-includes/rest-api/class-wp-rest-server.php
r51317 r56884 332 332 333 333 /** 334 * Filters whether to send nocache headers on a REST API request.335 *336 * @since 4.4.0337 *338 * @param bool $rest_send_nocache_headers Whether to send no-cache headers.339 */340 $send_no_cache_headers = apply_filters( 'rest_send_nocache_headers', is_user_logged_in() );341 if ( $send_no_cache_headers ) {342 foreach ( wp_get_nocache_headers() as $header => $header_value ) {343 if ( empty( $header_value ) ) {344 $this->remove_header( $header );345 } else {346 $this->send_header( $header, $header_value );347 }348 }349 }350 351 /**352 334 * Filters whether the REST API is enabled. 353 335 * … … 403 385 * header. 404 386 */ 387 $method_overridden = false; 405 388 if ( isset( $_GET['_method'] ) ) { 406 389 $request->set_method( $_GET['_method'] ); 407 390 } elseif ( isset( $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'] ) ) { 408 391 $request->set_method( $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'] ); 392 $method_overridden = true; 409 393 } 410 394 … … 464 448 */ 465 449 $served = apply_filters( 'rest_pre_serve_request', false, $result, $request, $this ); 450 451 /** 452 * Filters whether to send nocache headers on a REST API request. 453 * 454 * @since 4.4.0 455 * @since 6.x.x Moved the block to catch the filter added on rest_cookie_check_errors() from rest-api.php 456 * 457 * @param bool $rest_send_nocache_headers Whether to send no-cache headers. 458 */ 459 $send_no_cache_headers = apply_filters( 'rest_send_nocache_headers', is_user_logged_in() ); 460 461 // send no cache headers if the $send_no_cache_headers is true 462 // OR if the HTTP_X_HTTP_METHOD_OVERRIDE is used but resulted a 4xx response code. 463 if ( $send_no_cache_headers || ( true === $method_overridden && strpos( $code, '4' ) === 0 ) ) { 464 foreach ( wp_get_nocache_headers() as $header => $header_value ) { 465 if ( empty( $header_value ) ) { 466 $this->remove_header( $header ); 467 } else { 468 $this->send_header( $header, $header_value ); 469 } 470 } 471 } 466 472 467 473 if ( ! $served ) { -
branches/5.8/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php
r51000 r56884 303 303 304 304 if ( ! empty( $prepared_args['search'] ) ) { 305 if ( ! current_user_can( 'list_users' ) ) { 306 $prepared_args['search_columns'] = array( 'ID', 'user_login', 'user_nicename', 'display_name' ); 307 } 305 308 $prepared_args['search'] = '*' . $prepared_args['search'] . '*'; 306 309 } -
branches/5.8/src/wp-includes/shortcodes.php
r51154 r56884 171 171 172 172 /** 173 * Search content for shortcodes and filter shortcodes through their hooks. 173 * Returns a list of registered shortcode names found in the given content. 174 * 175 * Example usage: 176 * 177 * get_shortcode_tags_in_content( '[audio src="file.mp3"][/audio] [foo] [gallery ids="1,2,3"]' ); 178 * // array( 'audio', 'gallery' ) 179 * 180 * @since 6.3.2 181 * 182 * @param string $content The content to check. 183 * @return string[] An array of registered shortcode names found in the content. 184 */ 185 function get_shortcode_tags_in_content( $content ) { 186 if ( false === strpos( $content, '[' ) ) { 187 return array(); 188 } 189 190 preg_match_all( '/' . get_shortcode_regex() . '/', $content, $matches, PREG_SET_ORDER ); 191 if ( empty( $matches ) ) { 192 return array(); 193 } 194 195 $tags = array(); 196 foreach ( $matches as $shortcode ) { 197 $tags[] = $shortcode[2]; 198 199 if ( ! empty( $shortcode[5] ) ) { 200 $deep_tags = get_shortcode_tags_in_content( $shortcode[5] ); 201 if ( ! empty( $deep_tags ) ) { 202 $tags = array_merge( $tags, $deep_tags ); 203 } 204 } 205 } 206 207 return $tags; 208 } 209 210 /** 211 * Searches content for shortcodes and filter shortcodes through their hooks. 174 212 * 175 213 * This function is an alias for do_shortcode().
Note: See TracChangeset
for help on using the changeset viewer.