Make WordPress Core


Ignore:
Timestamp:
01/30/2024 02:54:50 PM (5 months ago)
Author:
jorbin
Message:

Grouped Backports to the 5.3 branch

  • Install: When populating options, maybe_serialize instead of always serialize.
  • Uploads: Check for and verify ZIP archives.

Merges [57388] and [57389] to the 5.3 branch.

Props costdev, peterwilsoncc, azaozz, tykoted, johnbillion, desrosj, afragen, jorbin, xknown.

Location:
branches/5.3
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/5.3

  • branches/5.3/src/wp-admin/update.php

    r45932 r57402  
    147147
    148148        check_admin_referer( 'plugin-upload' );
     149
     150        if ( isset( $_FILES['pluginzip']['name'] ) && ! str_ends_with( strtolower( $_FILES['pluginzip']['name'] ), '.zip' ) ) {
     151            wp_die( __( 'Only .zip archives may be uploaded.' ) );
     152        }
    149153
    150154        $file_upload = new File_Upload_Upgrader( 'pluginzip', 'package' );
     
    266270
    267271        check_admin_referer( 'theme-upload' );
     272
     273        if ( isset( $_FILES['themezip']['name'] ) && ! str_ends_with( strtolower( $_FILES['themezip']['name'] ), '.zip' ) ) {
     274            wp_die( __( 'Only .zip archives may be uploaded.' ) );
     275        }
    268276
    269277        $file_upload = new File_Upload_Upgrader( 'themezip', 'package' );
Note: See TracChangeset for help on using the changeset viewer.