Changeset 63715

Timestamp:

09/17/2026 09:15:04 PM (3 hours ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.1.1 security fixes to the 4.7 branch.

• Posts, Post Types: Reject a supplied post ID on the create path in _wp_translate_postdata().
• XML-RPC: Reject writes to internal-only builtin post types.
• Administration: Add authorization check to wp_ajax_sample_permalink().
• Customize: Improve header_image_data theme mod sanitization.
• Plugins: Require network plugin authority to Ajax-activate a network-only plugin.
• Formatting: Prevent wpautop() moving a paragraph into an attribute of a blockquote.

Merges r63657, r63659, r63660, r63665, r63669, r63672 to the 4.7 branch.

Props xknown, westonruter, jorbin, vortfu, batmoo, davidbinda, jeremyfelt, johnbillion, peterwilsoncc, lancewillett, jonsurrell, dmsnell, whyisjake, buffer1024, joehoyle, rafiem.

Location:

branches/4.7

Files:

• . (modified) (1 prop)
• src/wp-admin/custom-header.php (modified) (4 diffs)
• src/wp-admin/includes/ajax-actions.php (modified) (2 diffs)
• src/wp-admin/includes/plugin.php (modified) (1 diff)
• src/wp-admin/includes/post.php (modified) (1 diff)
• src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)
• src/wp-includes/customize/class-wp-customize-header-image-setting.php (modified) (2 diffs)
• src/wp-includes/formatting.php (modified) (1 diff)
• src/wp-includes/theme.php (modified) (2 diffs)

branches/4.7/src/wp-admin/custom-header.php

@@ -502 +502 @@
                         $header_image_style .= 'height:' . $custom_header->height . 'px;';
         ?>
-        <div id="headimg" style="<?php echo $header_image_style; ?>">
+        <div id="headimg" style="<?php echo esc_attr( $header_image_style ); ?>">
                 <?php
                 if ( display_header_text() )
@@ -1025 +1025 @@
                                 'url'           => $choice['url'],
                                 'thumbnail_url' => $choice['url'],
-                                'height'        => $choice['height'],
-                                'width'         => $choice['width'],
+                                'height'        => absint( $choice['height'] ),
+                                'width'         => absint( $choice['width'] ),
                         );
 
@@ -1053 +1053 @@
                 }
 
-                set_theme_mod( 'header_image', esc_url_raw( $header_image_data['url'] ) );
+                $header_image_data['url'] = esc_url_raw( $header_image_data['url'] );
+
+                if ( isset( $header_image_data['thumbnail_url'] ) ) {
+                        $header_image_data['thumbnail_url'] = esc_url_raw( $header_image_data['thumbnail_url'] );
+                }
+
+                set_theme_mod( 'header_image', $header_image_data['url'] );
                 set_theme_mod( 'header_image_data', $header_image_data );
         }
@@ -1370 +1376 @@
 
                 foreach ( $header_images as &$header_image ) {
-                        $header_meta = get_post_meta( $header_image['attachment_id'] );
-                        $header_image['timestamp'] = isset( $header_meta[ $timestamp_key ] ) ? $header_meta[ $timestamp_key ] : '';
-                        $header_image['alt_text'] = isset( $header_meta[ $alt_text_key ] ) ? $header_meta[ $alt_text_key ] : '';
+                        $header_image['timestamp'] = get_post_meta( $header_image['attachment_id'], $timestamp_key, true );
+                        $header_image['alt_text'] = get_post_meta( $header_image['attachment_id'], $alt_text_key, true );
                 }
 

branches/4.7/src/wp-admin/includes/ajax-actions.php

@@ -1581 +1581 @@
         check_ajax_referer( 'getpermalink', 'getpermalinknonce' );
         $post_id = isset($_POST['post_id'])? intval($_POST['post_id']) : 0;
+        if ( ! $post_id ) {
+                // Bypass call to get_preview_post_link() for unspecified post ID.
+                wp_die( '' );
+        }
+        if ( ! current_user_can( 'edit_post', $post_id ) ) {
+                wp_die( -1 );
+        }
         wp_die( get_preview_post_link( $post_id ) );
 }
@@ -1592 +1599 @@
         check_ajax_referer( 'samplepermalink', 'samplepermalinknonce' );
         $post_id = isset($_POST['post_id'])? intval($_POST['post_id']) : 0;
+        if ( ! $post_id ) {
+                // Bypass call to get_sample_permalink_html() for unspecified post ID.
+                wp_die( '' );
+        }
+        if ( ! current_user_can( 'edit_post', $post_id ) ) {
+                wp_die( -1 );
+        }
         $title = isset($_POST['new_title'])? $_POST['new_title'] : '';
         $slug = isset($_POST['new_slug'])? $_POST['new_slug'] : null;

branches/4.7/src/wp-admin/includes/plugin.php

@@ -499 +499 @@
  *
  * @since 3.0.0
- *
- * @param string $plugin Plugin to check
+ * @since 7.1.1 The `$plugin` path is normalized with `plugin_basename()` and `trim()`,
+ *              matching how `activate_plugin()` resolves it.
+ *
+ * @param string $plugin Path to the plugin file. Accepts a path relative to the plugins
+ *                       directory, or an absolute path, with or without surrounding whitespace.
  * @return bool True if plugin is network only, false otherwise.
  */
 function is_network_only_plugin( $plugin ) {
+        // Normalize the path the same way activate_plugin() does, so both agree on the file.
+        $plugin = plugin_basename( trim( $plugin ) );
+
         $plugin_data = get_plugin_data( WP_PLUGIN_DIR . '/' . $plugin );
         if ( $plugin_data )

branches/4.7/src/wp-admin/includes/post.php

@@ -23 +23 @@
         if ( empty($post_data) )
                 $post_data = &$_POST;
+
+        /*
+         * A raw `ID` on the create path (no `post_ID`) is an attempt to overwrite an
+         * existing post while bypassing the per-post capability checks below, which only
+         * run on the update path. Reject it outright: legitimate post creation never
+         * carries an `ID`.
+         */
+        if ( ! $update && ! empty( $post_data['ID'] ) ) {
+                if ( 'page' === $post_data['post_type'] ) {
+                        return new WP_Error( 'edit_others_pages', __( 'Sorry, you are not allowed to edit pages as this user.' ) );
+                } else {
+                        return new WP_Error( 'edit_others_posts', __( 'Sorry, you are not allowed to edit posts as this user.' ) );
+                }
+        }
 
         if ( $update )

branches/4.7/src/wp-includes/class-wp-xmlrpc-server.php

@@ -1331 +1331 @@
                         return new IXR_Error( 403, __( 'Invalid post type.' ) );
 
+                // Reject writes to internal-only builtin post types (e.g. customize_changeset)
+                // whose intended write path is a dedicated helper, not a generic post API.
+                $is_internal_only = (
+                        empty( $post_type->public )
+                        && empty( $post_type->show_in_rest )
+                        && ! empty( $post_type->_builtin )
+                );
+
+                /**
+                 * Filters whether a post type accepts writes via XML-RPC.
+                 *
+                 * Defaults to false for internal-only builtin post types (public=false,
+                 * show_in_rest=false, _builtin=true), such as customize_changeset, whose
+                 * writes are meant to flow through dedicated helpers. Return true to opt
+                 * a post type back in.
+                 *
+                 * @since 7.1.1
+                 *
+                 * @param bool         $allowed   Whether the post type accepts XML-RPC writes.
+                 * @param WP_Post_Type $post_type The post type object.
+                 */
+                $allowed = apply_filters( 'xmlrpc_allow_post_type_writes', ! $is_internal_only, $post_type );
+
+                if ( ! $allowed ) {
+                        return new IXR_Error( 403, __( 'Sorry, this post type is not supported over XML-RPC.' ) );
+                }
+
                 $update = ! empty( $post_data['ID'] );
 

branches/4.7/src/wp-includes/customize/class-wp-customize-header-image-setting.php

@@ -16 +16 @@
  *
  * @see WP_Customize_Setting
+ *
+ * @phpstan-type Header_Image_Data array{
+ *     attachment_id?: int,
+ *     url?: string,
+ *     thumbnail_url?: string,
+ *     timestamp?: int,
+ *     width?: int,
+ *     height?: int,
+ *     alt_text?: string,
+ *     attachment_parent?: int,
+ * }
  */
 final class WP_Customize_Header_Image_Setting extends WP_Customize_Setting {
@@ -49 +60 @@
                         $custom_image_header->set_header_image( $value );
         }
+
+        /**
+         * Sanitizes a header value.
+         *
+         * The value is expected to be one of the following:
+         *
+         * - An array of header image data, with the keys `attachment_id`, `url`, `thumbnail_url`, `timestamp`, `width`,
+         *   `height`, `alt_text`, and `attachment_parent`, as supplied by {@see get_uploaded_header_images()}. Any other
+         *   key is discarded.
+         * - An array with a `choice` key, being the legacy format in which any of the other accepted values is nested.
+         * - The string `remove-header`, `random-default-image`, or `random-uploaded-image`.
+         * - A string corresponding to one of the keys for the array returned by {@see get_uploaded_header_images()}, or
+         *   one of the keys for the array passed into {@see register_default_headers()}.
+         *
+         * @since 7.1.1
+         *
+         * @see WP_Customize_Header_Image_Setting::update()
+         * @see Custom_Image_Header::set_header_image()
+         *
+         * @param mixed $value Value to sanitize.
+         * @return array|string|WP_Error|null Sanitized value, or `null`/`WP_Error` if invalid. The array holds
+         *                                    the header image data, or that data nested under a `choice` key,
+         *                                    before the `customize_sanitize_header_image_data` filter, which
+         *                                    may return anything, is applied to it.
+         *
+         * @phpstan-return array<mixed, mixed>|string|WP_Error|null
+         */
+        public function sanitize( $value ) {
+                /*
+                 * The update() method unwraps the legacy `choice` format before handing the value off to
+                 * Custom_Image_Header::set_header_image(), so the nested value is what must be sanitized.
+                 */
+                if ( is_array( $value ) && isset( $value['choice'] ) ) {
+                        $choice = $this->sanitize_choice( $value['choice'] );
+                        if ( is_null( $choice ) || is_wp_error( $choice ) ) {
+                                return $choice;
+                        }
+                        $value = array( 'choice' => $choice );
+                } else {
+                        $value = $this->sanitize_choice( $value );
+                        if ( is_null( $value ) || is_wp_error( $value ) ) {
+                                return $value;
+                        }
+                }
+
+                return parent::sanitize( $value );
+        }
+
+        /**
+         * Sanitizes a header image choice.
+         *
+         * This is the value which is ultimately passed to {@see Custom_Image_Header::set_header_image()}, whether
+         * supplied at the top level of the setting value or nested under its legacy `choice` key.
+         *
+         * @since 7.1.1
+         *
+         * @param mixed $value Value to sanitize.
+         * @return array|string|WP_Error|null Sanitized value, or `null`/`WP_Error` if invalid.
+         *
+         * @phpstan-return Header_Image_Data|string|WP_Error|null
+         */
+        private function sanitize_choice( $value ) {
+                // Custom_Image_Header::set_header_image() accepts an object in place of an array.
+                if ( is_object( $value ) ) {
+                        $value = (array) $value;
+                }
+
+                if ( is_string( $value ) ) {
+                        return sanitize_text_field( $value );
+                }
+
+                if ( ! is_array( $value ) ) {
+                        return null;
+                }
+
+                /*
+                 * The sanitized value is assembled member by member rather than filtered down from the
+                 * supplied one, so that nothing but the members below can end up in it.
+                 */
+                $sanitized = array();
+
+                if ( isset( $value['attachment_id'] ) ) {
+                        if ( ! is_scalar( $value['attachment_id'] ) ) {
+                                return null;
+                        }
+                        $attachment_id = absint( $value['attachment_id'] );
+
+                        /*
+                         * A supplied attachment must be an existing image, since its ID is written to postmeta and its
+                         * data displayed. Note that an ID of zero must be skipped rather than looked up, as
+                         * get_post_mime_type() falls back to the global post when passed an empty value.
+                         */
+                        if ( $attachment_id > 0 ) {
+                                $mime_type = get_post_mime_type( $attachment_id );
+                                if ( ! is_string( $mime_type ) || ! str_starts_with( $mime_type, 'image/' ) ) {
+                                        return null;
+                                }
+                        }
+
+                        $sanitized['attachment_id'] = $attachment_id;
+                }
+
+                if ( isset( $value['url'] ) ) {
+                        if ( ! is_string( $value['url'] ) ) {
+                                return null;
+                        }
+                        $sanitized['url'] = esc_url_raw( $value['url'] );
+                        if ( '' === $sanitized['url'] ) {
+                                return new WP_Error( 'invalid_url', __( 'Invalid URL.' ) );
+                        }
+                }
+
+                if ( isset( $value['thumbnail_url'] ) ) {
+                        if ( ! is_string( $value['thumbnail_url'] ) ) {
+                                return null;
+                        }
+                        $sanitized['thumbnail_url'] = esc_url_raw( $value['thumbnail_url'] );
+                        if ( '' === $sanitized['thumbnail_url'] ) {
+                                return new WP_Error( 'invalid_url', __( 'Invalid URL.' ) );
+                        }
+                }
+
+                if ( isset( $value['timestamp'] ) ) {
+                        if ( ! is_scalar( $value['timestamp'] ) ) {
+                                return null;
+                        }
+                        $sanitized['timestamp'] = absint( $value['timestamp'] );
+                }
+
+                if ( isset( $value['width'] ) ) {
+                        if ( ! is_scalar( $value['width'] ) ) {
+                                return null;
+                        }
+                        $sanitized['width'] = absint( $value['width'] );
+                }
+
+                if ( isset( $value['height'] ) ) {
+                        if ( ! is_scalar( $value['height'] ) ) {
+                                return null;
+                        }
+                        $sanitized['height'] = absint( $value['height'] );
+                }
+
+                if ( isset( $value['alt_text'] ) ) {
+                        if ( ! is_string( $value['alt_text'] ) ) {
+                                return null;
+                        }
+                        $sanitized['alt_text'] = sanitize_text_field( $value['alt_text'] );
+                }
+
+                if ( isset( $value['attachment_parent'] ) ) {
+                        if ( ! is_scalar( $value['attachment_parent'] ) ) {
+                                return null;
+                        }
+                        $sanitized['attachment_parent'] = absint( $value['attachment_parent'] );
+                }
+
+                return $sanitized;
+        }
 }

branches/4.7/src/wp-includes/formatting.php

@@ -540 +540 @@
 
         // If a <blockquote> is wrapped with a <p>, move it inside the <blockquote>.
-        $pee = preg_replace('|<p><blockquote([^>]*)>|i', "<blockquote$1><p>", $pee);
+        $pee = preg_replace('!<p><blockquote((?:[^>"\']|"[^"]*"|\'[^\']*\')*)>!i', "<blockquote$1><p>", $pee);
         $pee = str_replace('</blockquote></p>', '</p></blockquote>', $pee);
 

branches/4.7/src/wp-includes/theme.php

@@ -1231 +1231 @@
  *
  * @since 3.4.0
+ * @since 7.1.1 The `width` and `height` are cast to non-negative integers.
  *
  * @global array $_wp_default_headers
@@ -1268 +1269 @@
                 'video'         => get_theme_support( 'custom-header', 'video' ),
         );
-        return (object) wp_parse_args( $data, $default );
+
+        if ( ! is_array( $data ) && ! is_object( $data ) ) {
+                $data = array();
+        }
+        $header         = (object) wp_parse_args( $data, $default );
+        $header->width  = absint( $header->width );
+        $header->height = absint( $header->height );
+        return $header;
 }