Changeset 63708 for branches/5.4/src/wp-admin/includes/ajax-actions.php

Timestamp:

09/17/2026 09:05:55 PM (6 hours ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.1.1 security fixes to the 5.4 branch.

• Posts, Post Types: Reject a supplied post ID on the create path in _wp_translate_postdata().
• Comments: Enforce target post permissions when updating notes via REST.
• XML-RPC: Reject writes to internal-only builtin post types.
• Administration: Add authorization check to wp_ajax_sample_permalink().
• Customize: Improve header_image_data theme mod sanitization.
• Themes: Escape the theme installer preview route value.
• Plugins: Require network plugin authority to Ajax-activate a network-only plugin.
• Formatting: Prevent wpautop() moving a paragraph into an attribute of a blockquote.

Merges r63657, r63658, r63659, r63660, r63665, r63669, r63672, r63675 to the 5.4 branch.

Props xknown, westonruter, jorbin, vortfu, batmoo, davidbinda, jeremyfelt, adamsilverstein, ramonopoly, villanovachile, johnbillion, peterwilsoncc, lancewillett, jonsurrell, dmsnell, whyisjake, buffer1024, joehoyle, rafiem.

Location:

branches/5.4

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/ajax-actions.php (modified) (2 diffs)

branches/5.4/src/wp-admin/includes/ajax-actions.php

@@ -1952 +1952 @@
         check_ajax_referer( 'getpermalink', 'getpermalinknonce' );
         $post_id = isset( $_POST['post_id'] ) ? intval( $_POST['post_id'] ) : 0;
+        if ( ! $post_id ) {
+                // Bypass call to get_preview_post_link() for unspecified post ID.
+                wp_die( '' );
+        }
+        if ( ! current_user_can( 'edit_post', $post_id ) ) {
+                wp_die( -1 );
+        }
         wp_die( get_preview_post_link( $post_id ) );
 }
@@ -1963 +1970 @@
         check_ajax_referer( 'samplepermalink', 'samplepermalinknonce' );
         $post_id = isset( $_POST['post_id'] ) ? intval( $_POST['post_id'] ) : 0;
-        $title   = isset( $_POST['new_title'] ) ? $_POST['new_title'] : '';
-        $slug    = isset( $_POST['new_slug'] ) ? $_POST['new_slug'] : null;
+        if ( ! $post_id ) {
+                // Bypass call to get_sample_permalink_html() for unspecified post ID.
+                wp_die( '' );
+        }
+        if ( ! current_user_can( 'edit_post', $post_id ) ) {
+                wp_die( -1 );
+        }
+        $title = isset( $_POST['new_title'] ) ? $_POST['new_title'] : '';
+        $slug  = isset( $_POST['new_slug'] ) ? $_POST['new_slug'] : null;
         wp_die( get_sample_permalink_html( $post_id, $title, $slug ) );
 }