Changeset 63715 for branches/4.7/src/wp-includes/customize/class-wp-customize-header-image-setting.php

Timestamp:

09/17/2026 09:15:04 PM (10 hours ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.1.1 security fixes to the 4.7 branch.

• Posts, Post Types: Reject a supplied post ID on the create path in _wp_translate_postdata().
• XML-RPC: Reject writes to internal-only builtin post types.
• Administration: Add authorization check to wp_ajax_sample_permalink().
• Customize: Improve header_image_data theme mod sanitization.
• Plugins: Require network plugin authority to Ajax-activate a network-only plugin.
• Formatting: Prevent wpautop() moving a paragraph into an attribute of a blockquote.

Merges r63657, r63659, r63660, r63665, r63669, r63672 to the 4.7 branch.

Props xknown, westonruter, jorbin, vortfu, batmoo, davidbinda, jeremyfelt, johnbillion, peterwilsoncc, lancewillett, jonsurrell, dmsnell, whyisjake, buffer1024, joehoyle, rafiem.

Location:

branches/4.7

Files:

• . (modified) (1 prop)
• src/wp-includes/customize/class-wp-customize-header-image-setting.php (modified) (2 diffs)

branches/4.7/src/wp-includes/customize/class-wp-customize-header-image-setting.php

@@ -16 +16 @@
  *
  * @see WP_Customize_Setting
+ *
+ * @phpstan-type Header_Image_Data array{
+ *     attachment_id?: int,
+ *     url?: string,
+ *     thumbnail_url?: string,
+ *     timestamp?: int,
+ *     width?: int,
+ *     height?: int,
+ *     alt_text?: string,
+ *     attachment_parent?: int,
+ * }
  */
 final class WP_Customize_Header_Image_Setting extends WP_Customize_Setting {
@@ -49 +60 @@
                         $custom_image_header->set_header_image( $value );
         }
+
+        /**
+         * Sanitizes a header value.
+         *
+         * The value is expected to be one of the following:
+         *
+         * - An array of header image data, with the keys `attachment_id`, `url`, `thumbnail_url`, `timestamp`, `width`,
+         *   `height`, `alt_text`, and `attachment_parent`, as supplied by {@see get_uploaded_header_images()}. Any other
+         *   key is discarded.
+         * - An array with a `choice` key, being the legacy format in which any of the other accepted values is nested.
+         * - The string `remove-header`, `random-default-image`, or `random-uploaded-image`.
+         * - A string corresponding to one of the keys for the array returned by {@see get_uploaded_header_images()}, or
+         *   one of the keys for the array passed into {@see register_default_headers()}.
+         *
+         * @since 7.1.1
+         *
+         * @see WP_Customize_Header_Image_Setting::update()
+         * @see Custom_Image_Header::set_header_image()
+         *
+         * @param mixed $value Value to sanitize.
+         * @return array|string|WP_Error|null Sanitized value, or `null`/`WP_Error` if invalid. The array holds
+         *                                    the header image data, or that data nested under a `choice` key,
+         *                                    before the `customize_sanitize_header_image_data` filter, which
+         *                                    may return anything, is applied to it.
+         *
+         * @phpstan-return array<mixed, mixed>|string|WP_Error|null
+         */
+        public function sanitize( $value ) {
+                /*
+                 * The update() method unwraps the legacy `choice` format before handing the value off to
+                 * Custom_Image_Header::set_header_image(), so the nested value is what must be sanitized.
+                 */
+                if ( is_array( $value ) && isset( $value['choice'] ) ) {
+                        $choice = $this->sanitize_choice( $value['choice'] );
+                        if ( is_null( $choice ) || is_wp_error( $choice ) ) {
+                                return $choice;
+                        }
+                        $value = array( 'choice' => $choice );
+                } else {
+                        $value = $this->sanitize_choice( $value );
+                        if ( is_null( $value ) || is_wp_error( $value ) ) {
+                                return $value;
+                        }
+                }
+
+                return parent::sanitize( $value );
+        }
+
+        /**
+         * Sanitizes a header image choice.
+         *
+         * This is the value which is ultimately passed to {@see Custom_Image_Header::set_header_image()}, whether
+         * supplied at the top level of the setting value or nested under its legacy `choice` key.
+         *
+         * @since 7.1.1
+         *
+         * @param mixed $value Value to sanitize.
+         * @return array|string|WP_Error|null Sanitized value, or `null`/`WP_Error` if invalid.
+         *
+         * @phpstan-return Header_Image_Data|string|WP_Error|null
+         */
+        private function sanitize_choice( $value ) {
+                // Custom_Image_Header::set_header_image() accepts an object in place of an array.
+                if ( is_object( $value ) ) {
+                        $value = (array) $value;
+                }
+
+                if ( is_string( $value ) ) {
+                        return sanitize_text_field( $value );
+                }
+
+                if ( ! is_array( $value ) ) {
+                        return null;
+                }
+
+                /*
+                 * The sanitized value is assembled member by member rather than filtered down from the
+                 * supplied one, so that nothing but the members below can end up in it.
+                 */
+                $sanitized = array();
+
+                if ( isset( $value['attachment_id'] ) ) {
+                        if ( ! is_scalar( $value['attachment_id'] ) ) {
+                                return null;
+                        }
+                        $attachment_id = absint( $value['attachment_id'] );
+
+                        /*
+                         * A supplied attachment must be an existing image, since its ID is written to postmeta and its
+                         * data displayed. Note that an ID of zero must be skipped rather than looked up, as
+                         * get_post_mime_type() falls back to the global post when passed an empty value.
+                         */
+                        if ( $attachment_id > 0 ) {
+                                $mime_type = get_post_mime_type( $attachment_id );
+                                if ( ! is_string( $mime_type ) || ! str_starts_with( $mime_type, 'image/' ) ) {
+                                        return null;
+                                }
+                        }
+
+                        $sanitized['attachment_id'] = $attachment_id;
+                }
+
+                if ( isset( $value['url'] ) ) {
+                        if ( ! is_string( $value['url'] ) ) {
+                                return null;
+                        }
+                        $sanitized['url'] = esc_url_raw( $value['url'] );
+                        if ( '' === $sanitized['url'] ) {
+                                return new WP_Error( 'invalid_url', __( 'Invalid URL.' ) );
+                        }
+                }
+
+                if ( isset( $value['thumbnail_url'] ) ) {
+                        if ( ! is_string( $value['thumbnail_url'] ) ) {
+                                return null;
+                        }
+                        $sanitized['thumbnail_url'] = esc_url_raw( $value['thumbnail_url'] );
+                        if ( '' === $sanitized['thumbnail_url'] ) {
+                                return new WP_Error( 'invalid_url', __( 'Invalid URL.' ) );
+                        }
+                }
+
+                if ( isset( $value['timestamp'] ) ) {
+                        if ( ! is_scalar( $value['timestamp'] ) ) {
+                                return null;
+                        }
+                        $sanitized['timestamp'] = absint( $value['timestamp'] );
+                }
+
+                if ( isset( $value['width'] ) ) {
+                        if ( ! is_scalar( $value['width'] ) ) {
+                                return null;
+                        }
+                        $sanitized['width'] = absint( $value['width'] );
+                }
+
+                if ( isset( $value['height'] ) ) {
+                        if ( ! is_scalar( $value['height'] ) ) {
+                                return null;
+                        }
+                        $sanitized['height'] = absint( $value['height'] );
+                }
+
+                if ( isset( $value['alt_text'] ) ) {
+                        if ( ! is_string( $value['alt_text'] ) ) {
+                                return null;
+                        }
+                        $sanitized['alt_text'] = sanitize_text_field( $value['alt_text'] );
+                }
+
+                if ( isset( $value['attachment_parent'] ) ) {
+                        if ( ! is_scalar( $value['attachment_parent'] ) ) {
+                                return null;
+                        }
+                        $sanitized['attachment_parent'] = absint( $value['attachment_parent'] );
+                }
+
+                return $sanitized;
+        }
 }