Changeset 63715 for branches/4.7/src/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

09/17/2026 09:15:04 PM (6 hours ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.1.1 security fixes to the 4.7 branch.

• Posts, Post Types: Reject a supplied post ID on the create path in _wp_translate_postdata().
• XML-RPC: Reject writes to internal-only builtin post types.
• Administration: Add authorization check to wp_ajax_sample_permalink().
• Customize: Improve header_image_data theme mod sanitization.
• Plugins: Require network plugin authority to Ajax-activate a network-only plugin.
• Formatting: Prevent wpautop() moving a paragraph into an attribute of a blockquote.

Merges r63657, r63659, r63660, r63665, r63669, r63672 to the 4.7 branch.

Props xknown, westonruter, jorbin, vortfu, batmoo, davidbinda, jeremyfelt, johnbillion, peterwilsoncc, lancewillett, jonsurrell, dmsnell, whyisjake, buffer1024, joehoyle, rafiem.

Location:

branches/4.7

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)

branches/4.7/src/wp-includes/class-wp-xmlrpc-server.php

@@ -1331 +1331 @@
                         return new IXR_Error( 403, __( 'Invalid post type.' ) );
 
+                // Reject writes to internal-only builtin post types (e.g. customize_changeset)
+                // whose intended write path is a dedicated helper, not a generic post API.
+                $is_internal_only = (
+                        empty( $post_type->public )
+                        && empty( $post_type->show_in_rest )
+                        && ! empty( $post_type->_builtin )
+                );
+
+                /**
+                 * Filters whether a post type accepts writes via XML-RPC.
+                 *
+                 * Defaults to false for internal-only builtin post types (public=false,
+                 * show_in_rest=false, _builtin=true), such as customize_changeset, whose
+                 * writes are meant to flow through dedicated helpers. Return true to opt
+                 * a post type back in.
+                 *
+                 * @since 7.1.1
+                 *
+                 * @param bool         $allowed   Whether the post type accepts XML-RPC writes.
+                 * @param WP_Post_Type $post_type The post type object.
+                 */
+                $allowed = apply_filters( 'xmlrpc_allow_post_type_writes', ! $is_internal_only, $post_type );
+
+                if ( ! $allowed ) {
+                        return new IXR_Error( 403, __( 'Sorry, this post type is not supported over XML-RPC.' ) );
+                }
+
                 $update = ! empty( $post_data['ID'] );