Changeset 63111

Timestamp:

08/06/2026 07:53:19 PM (5 weeks ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.0.3 security fixes to the 5.1 branch.

• Users: Ensure a proper email address is used before sending email confirmations.
• Formatting: Prevent stack overflow in safecss_filter_attr.
• Multisite: Enforce the active signup policy for existing users.
• HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
• Users: Prevent Usernames from mangling HTML
• Canonical: Only redirect for publicly viewable post types.
• Administration: When wp_is_large_user_count(), ensure that the post author is always added to author dropdown.

Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 5.1 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell.

Location:

branches/5.1/src

Files:

• js/_enqueues/admin/inline-edit-post.js (modified) (1 diff)
• wp-admin/includes/user.php (modified) (3 diffs)
• wp-includes/canonical.php (modified) (1 diff)
• wp-includes/http.php (modified) (1 diff)
• wp-includes/kses.php (modified) (1 diff)
• wp-includes/user.php (modified) (7 diffs)
• wp-signup.php (modified) (1 diff)

branches/5.1/src/js/_enqueues/admin/inline-edit-post.js

@@ -274 +274 @@
 
                         // The post author no longer has edit capabilities, so we need to add them to the list of authors.
-                        $(':input[name="post_author"]', editRow).prepend('<option value="' + $('.post_author', rowData).text() + '">' + $('#' + t.type + '-' + id + ' .author').text() + '</option>');
+                        $(':input[name="post_author"]', editRow).prepend(
+                                new Option(
+                                        $('#' + t.type + '-' + id + ' .author').text(),
+                                        $('.post_author', rowData).text()
+                                )
+                        );
                 }
                 if ( $( ':input[name="post_author"] option', editRow ).length === 1 ) {

branches/5.1/src/wp-admin/includes/user.php

@@ -45 +45 @@
         }
 
+        $errors = new WP_Error();
+
         $pass1 = $pass2 = '';
         if ( isset( $_POST['pass1'] ) ) {
@@ -78 +80 @@
 
         if ( isset( $_POST['email'] ) ) {
-                $user->user_email = sanitize_text_field( wp_unslash( $_POST['email'] ) );
+                $maybe_email = wp_unslash( $_POST['email'] );
+                if ( is_string( $maybe_email ) && is_email( $maybe_email ) ) {
+                        $user->user_email = $maybe_email;
+                } else {
+                        $errors->add( 'invalid_email', __( '<strong>ERROR</strong>: The email address isn&#8217;t correct.' ), array( 'form-field' => 'email' ) );
+                }
         }
         if ( isset( $_POST['url'] ) ) {
@@ -139 +146 @@
                 $user->use_ssl = 1;
         }
-
-        $errors = new WP_Error();
 
         /* checking that username has been typed */

branches/5.1/src/wp-includes/canonical.php

@@ -662 +662 @@
 
         if ( get_query_var( 'name' ) ) {
+                $publicly_viewable_post_types = array_filter( get_post_types( array( 'exclude_from_search' => false ) ), 'is_post_type_viewable' );
+
                 $where = $wpdb->prepare( 'post_name LIKE %s', $wpdb->esc_like( get_query_var( 'name' ) ) . '%' );
 
                 // if any of post_type, year, monthnum, or day are set, use them to refine the query
                 if ( get_query_var( 'post_type' ) ) {
-                        $where .= $wpdb->prepare( ' AND post_type = %s', get_query_var( 'post_type' ) );
+                        if ( is_array( get_query_var( 'post_type' ) ) ) {
+                                $post_types = array_intersect( get_query_var( 'post_type' ), $publicly_viewable_post_types );
+                                if ( empty( $post_types ) ) {
+                                        return false;
+                                }
+                                $where .= " AND post_type IN ('" . implode( "', '", esc_sql( $post_types ) ) . "')";
+                        } else {
+                                if ( ! in_array( get_query_var( 'post_type' ), $publicly_viewable_post_types, true ) ) {
+                                        return false;
+                                }
+                                $where .= $wpdb->prepare( ' AND post_type = %s', get_query_var( 'post_type' ) );
+                        }
                 } else {
-                        $where .= " AND post_type IN ('" . implode( "', '", get_post_types( array( 'public' => true ) ) ) . "')";
+                        $where .= " AND post_type IN ('" . implode( "', '", esc_sql( $publicly_viewable_post_types ) ) . "')";
                 }
 

branches/5.1/src/wp-includes/http.php

@@ -561 +561 @@
                 if ( $ip ) {
                         $parts = array_map( 'intval', explode( '.', $ip ) );
-                        if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]
-                                || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
-                                || ( 192 === $parts[0] && 168 === $parts[1] )
+
+                        /*
+                         * These IP address ranges are not considered valid external hosts for HTTP requests.
+                         *
+                         * If the host resolves to an IP address in these ranges, the request will be rejected unless the 'http_request_host_is_external' filter allows it.
+                         *
+                         * References:
+                         *
+                         * - IPv4 Special-Purpose Address Space: https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+                         * - IPv4 Multicast Address Assignments: https://www.rfc-editor.org/rfc/rfc5771.html
+                         */
+                        if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]          // 127.0.0.0/8 (loopback), 10.0.0.0/8 (private), 0.0.0.0/8 (this network).
+                                || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )     // 172.16.0.0/12 (private).
+                                || ( 192 === $parts[0] && 168 === $parts[1] )                      // 192.168.0.0/16 (private).
+                                || ( 192 === $parts[0] && 0 === $parts[1] && 0 === $parts[2] )     // 192.0.0.0/24 (IETF protocol assignments).
+                                || ( 192 === $parts[0] && 0 === $parts[1] && 2 === $parts[2] )     // 192.0.2.0/24 (TEST-NET-1).
+                                || ( 192 === $parts[0] && 88 === $parts[1] && 99 === $parts[2] )   // 192.88.99.0/24 (6to4 relay anycast).
+                                || ( 198 === $parts[0] && 51 === $parts[1] && 100 === $parts[2] )  // 198.51.100.0/24 (TEST-NET-2).
+                                || ( 203 === $parts[0] && 0 === $parts[1] && 113 === $parts[2] )   // 203.0.113.0/24 (TEST-NET-3).
+                                || ( 169 === $parts[0] && 254 === $parts[1] )                      // 169.254.0.0/16 (link-local and cloud metadata).
+                                || ( 100 === $parts[0] && 64 <= $parts[1] && 127 >= $parts[1] )    // 100.64.0.0/10 (CGNAT).
+                                || ( 198 === $parts[0] && 18 <= $parts[1] && 19 >= $parts[1] )     // 198.18.0.0/15 (benchmarking).
+                                || ( 224 <= $parts[0] && 239 >= $parts[0] )                        // 224.0.0.0/4 (multicast).
+                                || 240 <= $parts[0]                                                // 240.0.0.0/4 (reserved, includes 255.255.255.255 broadcast).
                         ) {
                                 // If host appears local, reject unless specifically allowed.

branches/5.1/src/wp-includes/kses.php

@@ -2213 +2213 @@
 
                 // Remove any CSS containing containing \ ( & } = or comments, except for url() useage checked above.
-                if ( $found && ! preg_match( '%[\\\(&=}]|/\*%', $css_test_string ) ) {
+                if ( $found && 0 === preg_match( '%[\\\(&=}]|/\*%', $css_test_string ) ) {
                         if ( $css != '' ) {
                                 $css .= ';';

branches/5.1/src/wp-includes/user.php

@@ -181 +181 @@
                                 /* translators: %s: user name */
                                 __( '<strong>ERROR</strong>: The password you entered for the username %s is incorrect.' ),
-                                '<strong>' . $username . '</strong>'
+                                '<strong>' . esc_html( $username ) . '</strong>'
                         ) .
                         ' <a href="' . wp_lostpassword_url() . '">' .
@@ -255 +255 @@
                                 /* translators: %s: email address */
                                 __( '<strong>ERROR</strong>: The password you entered for the email address %s is incorrect.' ),
-                                '<strong>' . $email . '</strong>'
+                                '<strong>' . esc_html( $email ) . '</strong>'
                         ) .
                         ' <a href="' . wp_lostpassword_url() . '">' .
@@ -2503 +2503 @@
         $user_id   = wp_create_user( $sanitized_user_login, $user_pass, $user_email );
         if ( ! $user_id || is_wp_error( $user_id ) ) {
-                $errors->add( 'registerfail', sprintf( __( '<strong>ERROR</strong>: Couldn&#8217;t register you&hellip; please contact the <a href="mailto:%s">webmaster</a> !' ), get_option( 'admin_email' ) ) );
+                $errors->add( 'registerfail', sprintf( __( '<strong>ERROR</strong>: Couldn&#8217;t register you&hellip; please contact the <a href="mailto:%s">webmaster</a> !' ), esc_attr( get_option( 'admin_email' ) ) ) );
                 return $errors;
         }
@@ -2716 +2716 @@
  * @since 3.0.0
  * @since 4.9.0 This function was moved from wp-admin/includes/ms.php so it's no longer Multisite specific.
+ * @since 7.0.3 Added the `$user_id` parameter, which is sent with the `personal_options_update` action.
+ *
+ * @param int $user_id Optional. The ID of the user whose email is being changed. Defaults to `$_POST['user_id']` if set, otherwise 0.
  *
  * @global WP_Error $errors WP_Error object.
  */
-function send_confirmation_on_profile_email() {
+function send_confirmation_on_profile_email( $user_id = 0 ) {
         global $errors;
+
+        // Maintain backward compatibility for those relying on a check based on $_POST['user_id'].
+        if ( ! $user_id && isset( $_POST['user_id'] ) ) {
+                $user_id = (int) $_POST['user_id'];
+        }
 
         $current_user = wp_get_current_user();
@@ -2727 +2735 @@
         }
 
-        if ( $current_user->ID != $_POST['user_id'] ) {
+        if ( 0 === $current_user->ID || $current_user->ID !== (int) $user_id ) {
                 return false;
         }
@@ -2741 +2749 @@
                         );
 
+                        $_POST['email'] = addslashes( $current_user->user_email );
                         return;
                 }
@@ -2754 +2763 @@
                         delete_user_meta( $current_user->ID, '_new_email' );
 
+                        $_POST['email'] = addslashes( $current_user->user_email );
                         return;
                 }

branches/5.1/src/wp-signup.php

@@ -954 +954 @@
                         break;
                 case 'gimmeanotherblog':
-                        validate_another_blog_signup();
+                        if ( 'all' === $active_signup || 'blog' === $active_signup ) {
+                                validate_another_blog_signup();
+                        } else {
+                                _e( 'Site registration has been disabled.' );
+                        }
                         break;
                 case 'default':