Changeset 63708

Timestamp:

09/17/2026 09:05:55 PM (3 hours ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.1.1 security fixes to the 5.4 branch.

• Posts, Post Types: Reject a supplied post ID on the create path in _wp_translate_postdata().
• Comments: Enforce target post permissions when updating notes via REST.
• XML-RPC: Reject writes to internal-only builtin post types.
• Administration: Add authorization check to wp_ajax_sample_permalink().
• Customize: Improve header_image_data theme mod sanitization.
• Themes: Escape the theme installer preview route value.
• Plugins: Require network plugin authority to Ajax-activate a network-only plugin.
• Formatting: Prevent wpautop() moving a paragraph into an attribute of a blockquote.

Merges r63657, r63658, r63659, r63660, r63665, r63669, r63672, r63675 to the 5.4 branch.

Props xknown, westonruter, jorbin, vortfu, batmoo, davidbinda, jeremyfelt, adamsilverstein, ramonopoly, villanovachile, johnbillion, peterwilsoncc, lancewillett, jonsurrell, dmsnell, whyisjake, buffer1024, joehoyle, rafiem.

Location:

branches/5.4

Files:

• . (modified) (1 prop)
• src/js/_enqueues/wp/theme.js (modified) (2 diffs)
• src/wp-admin/includes/ajax-actions.php (modified) (2 diffs)
• src/wp-admin/includes/class-custom-image-header.php (modified) (4 diffs)
• src/wp-admin/includes/plugin.php (modified) (1 diff)
• src/wp-admin/includes/post.php (modified) (1 diff)
• src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)
• src/wp-includes/customize/class-wp-customize-header-image-setting.php (modified) (2 diffs)
• src/wp-includes/formatting.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (3 diffs)
• src/wp-includes/theme.php (modified) (2 diffs)

branches/5.4/src/js/_enqueues/wp/theme.js

@@ -1932 +1932 @@
 
 
+/*
+ * jQuery.escapeSelector() (added in jQuery 3.0) is not available on this
+ * branch's vendored jQuery. Fall back to the native CSS.escape(), which is
+ * what jQuery.escapeSelector() delegates to and which jQuery UI polyfills
+ * it with. A browser with neither skips the preview route below rather
+ * than building a selector from an unescaped slug.
+ */
+var escapeSelector = $.escapeSelector || ( window.CSS && window.CSS.escape && function( sel ) {
+        return window.CSS.escape( sel + '' );
+} );
+
 themes.RunInstaller = {
 
@@ -1994 +2005 @@
                                 self.view.collection.trigger( 'update' );
 
-                                // Open the theme preview.
+                                // Open the theme preview. The slug comes from the URL, so escape it.
                                 self.view.collection.once( 'query:success', function() {
-                                        $( 'div[data-slug="' + slug + '"]' ).trigger( 'click' );
+                                        if ( ! escapeSelector ) {
+                                                return;
+                                        }
+
+                                        $( 'div.theme[data-slug="' + escapeSelector( slug ) + '"]' ).trigger( 'click' );
                                 });
 

branches/5.4/src/wp-admin/includes/ajax-actions.php

@@ -1952 +1952 @@
         check_ajax_referer( 'getpermalink', 'getpermalinknonce' );
         $post_id = isset( $_POST['post_id'] ) ? intval( $_POST['post_id'] ) : 0;
+        if ( ! $post_id ) {
+                // Bypass call to get_preview_post_link() for unspecified post ID.
+                wp_die( '' );
+        }
+        if ( ! current_user_can( 'edit_post', $post_id ) ) {
+                wp_die( -1 );
+        }
         wp_die( get_preview_post_link( $post_id ) );
 }
@@ -1963 +1970 @@
         check_ajax_referer( 'samplepermalink', 'samplepermalinknonce' );
         $post_id = isset( $_POST['post_id'] ) ? intval( $_POST['post_id'] ) : 0;
-        $title   = isset( $_POST['new_title'] ) ? $_POST['new_title'] : '';
-        $slug    = isset( $_POST['new_slug'] ) ? $_POST['new_slug'] : null;
+        if ( ! $post_id ) {
+                // Bypass call to get_sample_permalink_html() for unspecified post ID.
+                wp_die( '' );
+        }
+        if ( ! current_user_can( 'edit_post', $post_id ) ) {
+                wp_die( -1 );
+        }
+        $title = isset( $_POST['new_title'] ) ? $_POST['new_title'] : '';
+        $slug  = isset( $_POST['new_slug'] ) ? $_POST['new_slug'] : null;
         wp_die( get_sample_permalink_html( $post_id, $title, $slug ) );
 }

branches/5.4/src/wp-admin/includes/class-custom-image-header.php

@@ -529 +529 @@
                                 }
                                 ?>
-        <div id="headimg" style="<?php echo $header_image_style; ?>">
+        <div id="headimg" style="<?php echo esc_attr( $header_image_style ); ?>">
                                 <?php
                                 if ( display_header_text() ) {
@@ -1088 +1088 @@
                                 'url'           => $choice['url'],
                                 'thumbnail_url' => $choice['url'],
-                                'height'        => $choice['height'],
-                                'width'         => $choice['width'],
+                                'height'        => absint( $choice['height'] ),
+                                'width'         => absint( $choice['width'] ),
                         );
 
@@ -1117 +1117 @@
                 }
 
-                set_theme_mod( 'header_image', esc_url_raw( $header_image_data['url'] ) );
+                $header_image_data['url'] = esc_url_raw( $header_image_data['url'] );
+
+                if ( isset( $header_image_data['thumbnail_url'] ) ) {
+                        $header_image_data['thumbnail_url'] = esc_url_raw( $header_image_data['thumbnail_url'] );
+                }
+
+                set_theme_mod( 'header_image', $header_image_data['url'] );
                 set_theme_mod( 'header_image_data', $header_image_data );
         }
@@ -1478 +1484 @@
 
                 foreach ( $header_images as &$header_image ) {
-                        $header_meta               = get_post_meta( $header_image['attachment_id'] );
-                        $header_image['timestamp'] = isset( $header_meta[ $timestamp_key ] ) ? $header_meta[ $timestamp_key ] : '';
-                        $header_image['alt_text']  = isset( $header_meta[ $alt_text_key ] ) ? $header_meta[ $alt_text_key ] : '';
+                        $header_image['timestamp'] = get_post_meta( $header_image['attachment_id'], $timestamp_key, true );
+                        $header_image['alt_text']  = get_post_meta( $header_image['attachment_id'], $alt_text_key, true );
                 }
 

branches/5.4/src/wp-admin/includes/plugin.php

@@ -584 +584 @@
  *
  * @since 3.0.0
- *
- * @param string $plugin Path to the plugin file relative to the plugins directory.
+ * @since 7.1.1 The `$plugin` path is normalized with `plugin_basename()` and `trim()`,
+ *              matching how `activate_plugin()` resolves it.
+ *
+ * @param string $plugin Path to the plugin file. Accepts a path relative to the plugins
+ *                       directory, or an absolute path, with or without surrounding whitespace.
  * @return bool True if plugin is network only, false otherwise.
  */
 function is_network_only_plugin( $plugin ) {
+        // Normalize the path the same way activate_plugin() does, so both agree on the file.
+        $plugin = plugin_basename( trim( $plugin ) );
+
         $plugin_data = get_plugin_data( WP_PLUGIN_DIR . '/' . $plugin );
         if ( $plugin_data ) {

branches/5.4/src/wp-admin/includes/post.php

@@ -22 +22 @@
         if ( empty( $post_data ) ) {
                 $post_data = &$_POST;
+        }
+
+        /*
+         * A raw `ID` on the create path (no `post_ID`) is an attempt to overwrite an
+         * existing post while bypassing the per-post capability checks below, which only
+         * run on the update path. Reject it outright: legitimate post creation never
+         * carries an `ID`.
+         */
+        if ( ! $update && ! empty( $post_data['ID'] ) ) {
+                if ( 'page' === $post_data['post_type'] ) {
+                        return new WP_Error( 'edit_others_pages', __( 'Sorry, you are not allowed to edit pages as this user.' ) );
+                } else {
+                        return new WP_Error( 'edit_others_posts', __( 'Sorry, you are not allowed to edit posts as this user.' ) );
+                }
         }
 

branches/5.4/src/wp-includes/class-wp-xmlrpc-server.php

@@ -1393 +1393 @@
                 }
 
+                // Reject writes to internal-only builtin post types (e.g. customize_changeset)
+                // whose intended write path is a dedicated helper, not a generic post API.
+                $is_internal_only = (
+                        empty( $post_type->public )
+                        && empty( $post_type->show_in_rest )
+                        && ! empty( $post_type->_builtin )
+                );
+
+                /**
+                 * Filters whether a post type accepts writes via XML-RPC.
+                 *
+                 * Defaults to false for internal-only builtin post types (public=false,
+                 * show_in_rest=false, _builtin=true), such as customize_changeset, whose
+                 * writes are meant to flow through dedicated helpers. Return true to opt
+                 * a post type back in.
+                 *
+                 * @since 7.1.1
+                 *
+                 * @param bool         $allowed   Whether the post type accepts XML-RPC writes.
+                 * @param WP_Post_Type $post_type The post type object.
+                 */
+                $allowed = apply_filters( 'xmlrpc_allow_post_type_writes', ! $is_internal_only, $post_type );
+
+                if ( ! $allowed ) {
+                        return new IXR_Error( 403, __( 'Sorry, this post type is not supported over XML-RPC.' ) );
+                }
+
                 $update = ! empty( $post_data['ID'] );
 

branches/5.4/src/wp-includes/customize/class-wp-customize-header-image-setting.php

@@ -16 +16 @@
  *
  * @see WP_Customize_Setting
+ *
+ * @phpstan-type Header_Image_Data array{
+ *     attachment_id?: int,
+ *     url?: string,
+ *     thumbnail_url?: string,
+ *     timestamp?: int,
+ *     width?: int,
+ *     height?: int,
+ *     alt_text?: string,
+ *     attachment_parent?: int,
+ * }
  */
 final class WP_Customize_Header_Image_Setting extends WP_Customize_Setting {
@@ -51 +62 @@
                 }
         }
+
+        /**
+         * Sanitizes a header value.
+         *
+         * The value is expected to be one of the following:
+         *
+         * - An array of header image data, with the keys `attachment_id`, `url`, `thumbnail_url`, `timestamp`, `width`,
+         *   `height`, `alt_text`, and `attachment_parent`, as supplied by {@see get_uploaded_header_images()}. Any other
+         *   key is discarded.
+         * - An array with a `choice` key, being the legacy format in which any of the other accepted values is nested.
+         * - The string `remove-header`, `random-default-image`, or `random-uploaded-image`.
+         * - A string corresponding to one of the keys for the array returned by {@see get_uploaded_header_images()}, or
+         *   one of the keys for the array passed into {@see register_default_headers()}.
+         *
+         * @since 7.1.1
+         *
+         * @see WP_Customize_Header_Image_Setting::update()
+         * @see Custom_Image_Header::set_header_image()
+         *
+         * @param mixed $value Value to sanitize.
+         * @return array|string|WP_Error|null Sanitized value, or `null`/`WP_Error` if invalid. The array holds
+         *                                    the header image data, or that data nested under a `choice` key,
+         *                                    before the `customize_sanitize_header_image_data` filter, which
+         *                                    may return anything, is applied to it.
+         *
+         * @phpstan-return array<mixed, mixed>|string|WP_Error|null
+         */
+        public function sanitize( $value ) {
+                /*
+                 * The update() method unwraps the legacy `choice` format before handing the value off to
+                 * Custom_Image_Header::set_header_image(), so the nested value is what must be sanitized.
+                 */
+                if ( is_array( $value ) && isset( $value['choice'] ) ) {
+                        $choice = $this->sanitize_choice( $value['choice'] );
+                        if ( is_null( $choice ) || is_wp_error( $choice ) ) {
+                                return $choice;
+                        }
+                        $value = array( 'choice' => $choice );
+                } else {
+                        $value = $this->sanitize_choice( $value );
+                        if ( is_null( $value ) || is_wp_error( $value ) ) {
+                                return $value;
+                        }
+                }
+
+                return parent::sanitize( $value );
+        }
+
+        /**
+         * Sanitizes a header image choice.
+         *
+         * This is the value which is ultimately passed to {@see Custom_Image_Header::set_header_image()}, whether
+         * supplied at the top level of the setting value or nested under its legacy `choice` key.
+         *
+         * @since 7.1.1
+         *
+         * @param mixed $value Value to sanitize.
+         * @return array|string|WP_Error|null Sanitized value, or `null`/`WP_Error` if invalid.
+         *
+         * @phpstan-return Header_Image_Data|string|WP_Error|null
+         */
+        private function sanitize_choice( $value ) {
+                // Custom_Image_Header::set_header_image() accepts an object in place of an array.
+                if ( is_object( $value ) ) {
+                        $value = (array) $value;
+                }
+
+                if ( is_string( $value ) ) {
+                        return sanitize_text_field( $value );
+                }
+
+                if ( ! is_array( $value ) ) {
+                        return null;
+                }
+
+                /*
+                 * The sanitized value is assembled member by member rather than filtered down from the
+                 * supplied one, so that nothing but the members below can end up in it.
+                 */
+                $sanitized = array();
+
+                if ( isset( $value['attachment_id'] ) ) {
+                        if ( ! is_scalar( $value['attachment_id'] ) ) {
+                                return null;
+                        }
+                        $attachment_id = absint( $value['attachment_id'] );
+
+                        /*
+                         * A supplied attachment must be an existing image, since its ID is written to postmeta and its
+                         * data displayed. Note that an ID of zero must be skipped rather than looked up, as
+                         * get_post_mime_type() falls back to the global post when passed an empty value.
+                         */
+                        if ( $attachment_id > 0 ) {
+                                $mime_type = get_post_mime_type( $attachment_id );
+                                if ( ! is_string( $mime_type ) || ! str_starts_with( $mime_type, 'image/' ) ) {
+                                        return null;
+                                }
+                        }
+
+                        $sanitized['attachment_id'] = $attachment_id;
+                }
+
+                if ( isset( $value['url'] ) ) {
+                        if ( ! is_string( $value['url'] ) ) {
+                                return null;
+                        }
+                        $sanitized['url'] = esc_url_raw( $value['url'] );
+                        if ( '' === $sanitized['url'] ) {
+                                return new WP_Error( 'invalid_url', __( 'Invalid URL.' ) );
+                        }
+                }
+
+                if ( isset( $value['thumbnail_url'] ) ) {
+                        if ( ! is_string( $value['thumbnail_url'] ) ) {
+                                return null;
+                        }
+                        $sanitized['thumbnail_url'] = esc_url_raw( $value['thumbnail_url'] );
+                        if ( '' === $sanitized['thumbnail_url'] ) {
+                                return new WP_Error( 'invalid_url', __( 'Invalid URL.' ) );
+                        }
+                }
+
+                if ( isset( $value['timestamp'] ) ) {
+                        if ( ! is_scalar( $value['timestamp'] ) ) {
+                                return null;
+                        }
+                        $sanitized['timestamp'] = absint( $value['timestamp'] );
+                }
+
+                if ( isset( $value['width'] ) ) {
+                        if ( ! is_scalar( $value['width'] ) ) {
+                                return null;
+                        }
+                        $sanitized['width'] = absint( $value['width'] );
+                }
+
+                if ( isset( $value['height'] ) ) {
+                        if ( ! is_scalar( $value['height'] ) ) {
+                                return null;
+                        }
+                        $sanitized['height'] = absint( $value['height'] );
+                }
+
+                if ( isset( $value['alt_text'] ) ) {
+                        if ( ! is_string( $value['alt_text'] ) ) {
+                                return null;
+                        }
+                        $sanitized['alt_text'] = sanitize_text_field( $value['alt_text'] );
+                }
+
+                if ( isset( $value['attachment_parent'] ) ) {
+                        if ( ! is_scalar( $value['attachment_parent'] ) ) {
+                                return null;
+                        }
+                        $sanitized['attachment_parent'] = absint( $value['attachment_parent'] );
+                }
+
+                return $sanitized;
+        }
 }

branches/5.4/src/wp-includes/formatting.php

@@ -573 +573 @@
 
         // If a <blockquote> is wrapped with a <p>, move it inside the <blockquote>.
-        $pee = preg_replace( '|<p><blockquote([^>]*)>|i', '<blockquote$1><p>', $pee );
+        $pee = preg_replace( '!<p><blockquote((?:[^>"\']|"[^"]*"|\'[^\']*\')*)>!i', '<blockquote$1><p>', $pee );
         $pee = str_replace( '</blockquote></p>', '</p></blockquote>', $pee );
 

branches/5.4/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -769 +769 @@
          *
          * @since 4.7.0
+         * @since 7.1.0 Target post permissions are checked when a comment's parent post is changed.
          *
          * @param WP_REST_Request $request Full details about the request.
@@ -785 +786 @@
                                 array( 'status' => rest_authorization_required_code() )
                         );
+                }
+
+                /*
+                 * check_edit_permission() above only establishes that the comment may be
+                 * edited where it currently sits, because 'edit_comment' maps to 'edit_post'
+                 * on the comment's current parent. When the parent is being changed, the new
+                 * parent has to be authorized as well. Without this, a user holding
+                 * edit_comment on their own comment could reparent it onto any post,
+                 * including posts they can neither read nor edit.
+                 */
+                if ( isset( $request['post'] ) && (int) $request['post'] !== (int) $comment->comment_post_ID ) {
+                        $target_check = $this->check_target_post_permission( (int) $request['post'] );
+
+                        if ( is_wp_error( $target_check ) ) {
+                                return $target_check;
+                        }
                 }
 
@@ -1869 +1886 @@
                 return $email;
         }
+
+        /**
+         * Checks that a post can receive a comment from the current user.
+         *
+         * Used when changing the parent post of an existing comment, so that
+         * attaching a comment to a post is authorized the same way whichever
+         * path it arrives by.
+         *
+         * @since 7.1.0
+         *
+         * @param int $post_id Target post ID.
+         * @return true|WP_Error True if the post can receive the comment, error object otherwise.
+         */
+        protected function check_target_post_permission( $post_id ) {
+                if ( ! $post_id ) {
+                        return new WP_Error(
+                                'rest_comment_invalid_post_id',
+                                __( 'Sorry, you are not allowed to create this comment without a post.' ),
+                                array( 'status' => 403 )
+                        );
+                }
+
+                /*
+                 * A comment needs either comment moderation rights or edit access to the
+                 * post, which is what check_edit_permission() grants on the post a comment
+                 * is moving away from. Requiring the same at the destination means both
+                 * ends of a move are authorized alike.
+                 */
+                if ( ! current_user_can( 'moderate_comments' ) && ! current_user_can( 'edit_post', $post_id ) ) {
+                        return new WP_Error(
+                                'rest_cannot_edit',
+                                __( 'Sorry, you are not allowed to edit this comment.' ),
+                                array( 'status' => rest_authorization_required_code() )
+                        );
+                }
+
+                $post = get_post( $post_id );
+
+                if ( ! $post ) {
+                        return new WP_Error(
+                                'rest_comment_invalid_post_id',
+                                __( 'Sorry, you are not allowed to create this comment without a post.' ),
+                                array( 'status' => 403 )
+                        );
+                }
+
+                /*
+                 * The create-time draft and comments-open rules are deliberately not applied
+                 * here, because moderators move comments onto posts whose discussion has
+                 * closed and onto drafts today. Enforcing them would break that without
+                 * blocking anything the capability check above already permits.
+                 */
+                return true;
+        }
 }

branches/5.4/src/wp-includes/theme.php

@@ -1322 +1322 @@
  *
  * @since 3.4.0
+ * @since 7.1.1 The `width` and `height` are cast to non-negative integers.
  *
  * @global array $_wp_default_headers
@@ -1360 +1361 @@
                 'video'         => get_theme_support( 'custom-header', 'video' ),
         );
-        return (object) wp_parse_args( $data, $default );
+
+        if ( ! is_array( $data ) && ! is_object( $data ) ) {
+                $data = array();
+        }
+        $header         = (object) wp_parse_args( $data, $default );
+        $header->width  = absint( $header->width );
+        $header->height = absint( $header->height );
+        return $header;
 }