Changeset 58022 for trunk/src/wp-admin/includes/class-wp-upgrader.php

Timestamp:

04/18/2024 03:15:50 AM (8 months ago)

Author:

peterwilsoncc

Message:

Upgrade/Install: Validate source & destination values in WP_Ugrader.

Adds a missing string and some additional validation of paths in the upgrader class.

Follow up to [56992].

Props costdev, jipmoors, karlijnbok, swissspidy, afragen, mukesh27.
Fixes #59712.

File:

• trunk/src/wp-admin/includes/class-wp-upgrader.php (modified) (2 diffs)

trunk/src/wp-admin/includes/class-wp-upgrader.php

@@ -197 +197 @@
         $this->strings['fs_no_folder'] = __( 'Unable to locate needed folder (%s).' );
 
+        $this->strings['no_package']           = __( 'Package not available.' );
         $this->strings['download_failed']      = __( 'Download failed.' );
         $this->strings['installing_package']   = __( 'Installing the latest version…' );
@@ -528 +529 @@
         }
 
-        if ( empty( $source ) || empty( $destination ) ) {
+        if (
+            ( ! is_string( $source ) || '' === $source || trim( $source ) !== $source ) ||
+            ( ! is_string( $destination ) || '' === $destination || trim( $destination ) !== $destination )
+        ) {
             return new WP_Error( 'bad_request', $this->strings['bad_request'] );
         }