Changeset 63099

Timestamp:

08/06/2026 07:37:16 PM (5 weeks ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.0.3 security fixes to the 6.1 branch.

• Users: Ensure a proper email address is used before sending email confirmations.
• Formatting: Prevent stack overflow in safecss_filter_attr.
• Multisite: Enforce the active signup policy for existing users.
• HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
• Users: Prevent Usernames from mangling HTML
• Canonical: Only redirect for publicly viewable post types.
• Administration: When wp_is_large_user_count(), ensure that the post author is always added to author dropdown.
• Editor: Fix output for Post Date.

Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 6.1 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell, isabel_brison, bernhard-reiter, tyxla, aduth.

Location:

branches/6.1

Files:

• package-lock.json (modified) (1 diff)
• package.json (modified) (1 diff)
• src/js/_enqueues/admin/inline-edit-post.js (modified) (1 diff)
• src/wp-admin/includes/user.php (modified) (3 diffs)
• src/wp-includes/blocks/post-date.php (modified) (1 diff)
• src/wp-includes/canonical.php (modified) (2 diffs)
• src/wp-includes/http.php (modified) (1 diff)
• src/wp-includes/kses.php (modified) (1 diff)
• src/wp-includes/user.php (modified) (9 diffs)
• src/wp-login.php (modified) (2 diffs)
• src/wp-signup.php (modified) (1 diff)

branches/6.1/package-lock.json

@@ -4313 +4313 @@
                 },
                 "@wordpress/block-library": {
-                        "version": "7.14.15",
-                        "resolved": "https://registry.npmjs.org/@wordpress/block-library/-/block-library-7.14.15.tgz",
-                        "integrity": "sha512-YXPXX3ZwZP5i6/iLZMEjEgAhEsEbc92cWGO/VPmmk1/YEjdAyp2gvOHcstJVAnq8Qz1pcRnctKyKiC5I/uHS+g==",
+                        "version": "7.14.16",
+                        "resolved": "https://registry.npmjs.org/@wordpress/block-library/-/block-library-7.14.16.tgz",
+                        "integrity": "sha512-gi01kh+LEPC4hfKYwdlyWk4gvm9OiuvhfaJbufp1VTXs2dQEjS9XLUb44muQnTIw5eOiFxT2b4H5u39WThpnxQ==",
                         "requires": {
                                 "@babel/runtime": "^7.16.0",

branches/6.1/package.json

@@ -84 +84 @@
                 "@wordpress/block-directory": "3.15.15",
                 "@wordpress/block-editor": "10.0.10",
-                "@wordpress/block-library": "7.14.15",
+                "@wordpress/block-library": "7.14.16",
                 "@wordpress/block-serialization-default-parser": "4.17.1",
                 "@wordpress/blocks": "11.16.4",

branches/6.1/src/js/_enqueues/admin/inline-edit-post.js

@@ -306 +306 @@
 
                         // The post author no longer has edit capabilities, so we need to add them to the list of authors.
-                        $(':input[name="post_author"]', editRow).prepend('<option value="' + $('.post_author', rowData).text() + '">' + $('#' + t.type + '-' + id + ' .author').text() + '</option>');
+                        $(':input[name="post_author"]', editRow).prepend(
+                                new Option(
+                                        $('#' + t.type + '-' + id + ' .author').text(),
+                                        $('.post_author', rowData).text()
+                                )
+                        );
                 }
                 if ( $( ':input[name="post_author"] option', editRow ).length === 1 ) {

branches/6.1/src/wp-admin/includes/user.php

@@ -45 +45 @@
         }
 
+        $errors = new WP_Error();
+
         $pass1 = '';
         $pass2 = '';
@@ -79 +81 @@
 
         if ( isset( $_POST['email'] ) ) {
-                $user->user_email = sanitize_text_field( wp_unslash( $_POST['email'] ) );
+                $maybe_email = wp_unslash( $_POST['email'] );
+                if ( is_string( $maybe_email ) && is_email( $maybe_email ) ) {
+                        $user->user_email = $maybe_email;
+                } else {
+                        $errors->add( 'invalid_email', __( '<strong>Error:</strong> The email address is not correct.' ), array( 'form-field' => 'email' ) );
+                }
         }
         if ( isset( $_POST['url'] ) ) {
@@ -139 +146 @@
                 $user->use_ssl = 1;
         }
-
-        $errors = new WP_Error();
 
         /* checking that username has been typed */

branches/6.1/src/wp-includes/blocks/post-date.php

@@ -32 +32 @@
 
         if ( isset( $attributes['isLink'] ) && $attributes['isLink'] ) {
-                $formatted_date = sprintf( '<a href="%1s">%2s</a>', get_the_permalink( $post_ID ), $formatted_date );
+                $formatted_date = sprintf( '<a href="%1$s">%2$s</a>', esc_url( get_the_permalink( $post_ID ) ), esc_html( $formatted_date ) );
+        } else {
+                $formatted_date = esc_html( $formatted_date );
         }
 

branches/6.1/src/wp-includes/canonical.php

@@ -921 +921 @@
 
         if ( get_query_var( 'name' ) ) {
+                $publicly_viewable_post_types = array_filter( get_post_types( array( 'exclude_from_search' => false ) ), 'is_post_type_viewable' );
+
                 /**
                  * Filters whether to perform a strict guess for a 404 redirect.
@@ -941 +943 @@
                 if ( get_query_var( 'post_type' ) ) {
                         if ( is_array( get_query_var( 'post_type' ) ) ) {
-                                // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
-                                $where .= " AND post_type IN ('" . join( "', '", esc_sql( get_query_var( 'post_type' ) ) ) . "')";
+                                $post_types = array_intersect( get_query_var( 'post_type' ), $publicly_viewable_post_types );
+                                if ( empty( $post_types ) ) {
+                                        return false;
+                                }
+                                $where .= " AND post_type IN ('" . implode( "', '", esc_sql( $post_types ) ) . "')";
                         } else {
+                                if ( ! in_array( get_query_var( 'post_type' ), $publicly_viewable_post_types, true ) ) {
+                                        return false;
+                                }
                                 $where .= $wpdb->prepare( ' AND post_type = %s', get_query_var( 'post_type' ) );
                         }
                 } else {
-                        $where .= " AND post_type IN ('" . implode( "', '", get_post_types( array( 'public' => true ) ) ) . "')";
+                        $where .= " AND post_type IN ('" . implode( "', '", esc_sql( $publicly_viewable_post_types ) ) . "')";
                 }
 

branches/6.1/src/wp-includes/http.php

@@ -558 +558 @@
                 if ( $ip ) {
                         $parts = array_map( 'intval', explode( '.', $ip ) );
-                        if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]
-                                || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
-                                || ( 192 === $parts[0] && 168 === $parts[1] )
+
+                        /*
+                         * These IP address ranges are not considered valid external hosts for HTTP requests.
+                         *
+                         * If the host resolves to an IP address in these ranges, the request will be rejected unless the 'http_request_host_is_external' filter allows it.
+                         *
+                         * References:
+                         *
+                         * - IPv4 Special-Purpose Address Space: https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+                         * - IPv4 Multicast Address Assignments: https://www.rfc-editor.org/rfc/rfc5771.html
+                         */
+                        if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]          // 127.0.0.0/8 (loopback), 10.0.0.0/8 (private), 0.0.0.0/8 (this network).
+                                || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )     // 172.16.0.0/12 (private).
+                                || ( 192 === $parts[0] && 168 === $parts[1] )                      // 192.168.0.0/16 (private).
+                                || ( 192 === $parts[0] && 0 === $parts[1] && 0 === $parts[2] )     // 192.0.0.0/24 (IETF protocol assignments).
+                                || ( 192 === $parts[0] && 0 === $parts[1] && 2 === $parts[2] )     // 192.0.2.0/24 (TEST-NET-1).
+                                || ( 192 === $parts[0] && 88 === $parts[1] && 99 === $parts[2] )   // 192.88.99.0/24 (6to4 relay anycast).
+                                || ( 198 === $parts[0] && 51 === $parts[1] && 100 === $parts[2] )  // 198.51.100.0/24 (TEST-NET-2).
+                                || ( 203 === $parts[0] && 0 === $parts[1] && 113 === $parts[2] )   // 203.0.113.0/24 (TEST-NET-3).
+                                || ( 169 === $parts[0] && 254 === $parts[1] )                      // 169.254.0.0/16 (link-local and cloud metadata).
+                                || ( 100 === $parts[0] && 64 <= $parts[1] && 127 >= $parts[1] )    // 100.64.0.0/10 (CGNAT).
+                                || ( 198 === $parts[0] && 18 <= $parts[1] && 19 >= $parts[1] )     // 198.18.0.0/15 (benchmarking).
+                                || ( 224 <= $parts[0] && 239 >= $parts[0] )                        // 224.0.0.0/4 (multicast).
+                                || 240 <= $parts[0]                                                // 240.0.0.0/4 (reserved, includes 255.255.255.255 broadcast).
                         ) {
                                 // If host appears local, reject unless specifically allowed.

branches/6.1/src/wp-includes/kses.php

@@ -2513 +2513 @@
                         );
 
+                        // Bail if the recursive function stripping hit a PCRE error (e.g. stack/backtrack limit).
+                        if ( null === $css_test_string ) {
+                                continue;
+                        }
+
                         /*
                          * Disallow CSS containing \ ( & } = or comments, except for within url(), var(), calc(), etc.
                          * which were removed from the test string above.
                          */
-                        $allow_css = ! preg_match( '%[\\\(&=}]|/\*%', $css_test_string );
+                        $allow_css = 0 === preg_match( '%[\\\(&=}]|/\*%', $css_test_string );
 
                         /**

branches/6.1/src/wp-includes/user.php

@@ -153 +153 @@
                                 /* translators: %s: User name. */
                                 __( '<strong>Error:</strong> The username <strong>%s</strong> is not registered on this site. If you are unsure of your username, try your email address instead.' ),
-                                $username
+                                esc_html( $username )
                         )
                 );
@@ -178 +178 @@
                                 /* translators: %s: User name. */
                                 __( '<strong>Error:</strong> The password you entered for the username %s is incorrect.' ),
-                                '<strong>' . $username . '</strong>'
+                                '<strong>' . esc_html( $username ) . '</strong>'
                         ) .
                         ' <a href="' . wp_lostpassword_url() . '">' .
@@ -250 +250 @@
                                 /* translators: %s: Email address. */
                                 __( '<strong>Error:</strong> The password you entered for the email address %s is incorrect.' ),
-                                '<strong>' . $email . '</strong>'
+                                '<strong>' . esc_html( $email ) . '</strong>'
                         ) .
                         ' <a href="' . wp_lostpassword_url() . '">' .
@@ -3347 +3347 @@
                                 /* translators: %s: Link to the login page. */
                                 __( '<strong>Error:</strong> This email address is already registered. <a href="%s">Log in</a> with this address or choose another one.' ),
-                                wp_login_url()
+                                esc_url( wp_login_url() )
                         )
                 );
@@ -3395 +3395 @@
                                 /* translators: %s: Admin email address. */
                                 __( '<strong>Error:</strong> Could not register you&hellip; please contact the <a href="mailto:%s">site admin</a>!' ),
-                                get_option( 'admin_email' )
+                                esc_attr( get_option( 'admin_email' ) )
                         )
                 );
@@ -3618 +3618 @@
  * @since 3.0.0
  * @since 4.9.0 This function was moved from wp-admin/includes/ms.php so it's no longer Multisite specific.
+ * @since 7.0.3 Added the `$user_id` parameter, which is sent with the `personal_options_update` action.
+ *
+ * @param int $user_id Optional. The ID of the user whose email is being changed. Defaults to `$_POST['user_id']` if set, otherwise 0.
  *
  * @global WP_Error $errors WP_Error object.
  */
-function send_confirmation_on_profile_email() {
+function send_confirmation_on_profile_email( $user_id = 0 ) {
         global $errors;
+
+        // Maintain backward compatibility for those relying on a check based on $_POST['user_id'].
+        if ( ! $user_id && isset( $_POST['user_id'] ) ) {
+                $user_id = (int) $_POST['user_id'];
+        }
 
         $current_user = wp_get_current_user();
@@ -3629 +3637 @@
         }
 
-        if ( $current_user->ID != $_POST['user_id'] ) {
+        if ( 0 === $current_user->ID || $current_user->ID !== (int) $user_id ) {
                 return false;
         }
@@ -3643 +3651 @@
                         );
 
+                        $_POST['email'] = addslashes( $current_user->user_email );
                         return;
                 }
@@ -3656 +3665 @@
                         delete_user_meta( $current_user->ID, '_new_email' );
 
+                        $_POST['email'] = addslashes( $current_user->user_email );
                         return;
                 }

branches/6.1/src/wp-login.php

@@ -1130 +1130 @@
                                         /* translators: %s: Link to the login page. */
                                         __( 'Check your email for the confirmation link, then visit the <a href="%s">login page</a>.' ),
-                                        wp_login_url()
+                                        esc_url( wp_login_url() )
                                 ),
                                 'message'
@@ -1140 +1140 @@
                                         /* translators: %s: Link to the login page. */
                                         __( 'Registration complete. Please check your email, then visit the <a href="%s">login page</a>.' ),
-                                        wp_login_url()
+                                        esc_url( wp_login_url() )
                                 ),
                                 'message'

branches/6.1/src/wp-signup.php

@@ -990 +990 @@
                         break;
                 case 'gimmeanotherblog':
-                        validate_another_blog_signup();
+                        if ( 'all' === $active_signup || 'blog' === $active_signup ) {
+                                validate_another_blog_signup();
+                        } else {
+                                _e( 'Site registration has been disabled.' );
+                        }
                         break;
                 case 'default':