Changeset 9163

Timestamp:

10/14/2008 03:56:33 PM (16 years ago)

Author:

ryan

Message:

Sanitation and error handling for plugin install. Props DD32. see #6015

Location:

trunk

Files:

• wp-admin/includes/plugin-install.php (modified) (10 diffs)
• wp-settings.php (modified) (2 diffs)

trunk/wp-admin/includes/plugin-install.php

@@ -38 +38 @@
     if ( ! $res ) {
         $request = wp_remote_post('http://api.wordpress.org/plugins/info/1.0/', array( 'body' => array('action' => $action, 'request' => serialize($args))) );
-        $res = unserialize($request['body']);
-        if ( ! $res )
-            $res = new WP_Error('plugins_api_failed', __('An unknown error occured'), $request['body']);
+        if ( is_wp_error($request) ) {
+            $res = new WP_Error('plugins_api_failed', __('An Unexpected HTTP Error occured during the API request.</p> <p><a href="?" onclick="document.location.reload(); return false;">Try again</a>'), $request->get_error_message() );
+        } else {
+            $res = unserialize($request['body']);
+            if ( ! $res )
+                $res = new WP_Error('plugins_api_failed', __('An unknown error occured'), $request['body']);
+        }
     }
 
@@ -62 +66 @@
 
     $tags = plugins_api('hot_tags', $args);
+
+    if ( is_wp_error($tags) )
+        return $tags;
 
     $cache = (object) array('timeout' => time(), 'cached' => $tags);
@@ -100 +107 @@
 
     $api = plugins_api('query_plugins', $args);
+
+    if ( is_wp_error($api) )
+        wp_die($api);
 
     add_action('install_plugins_table_header', 'install_search_form');
@@ -174 +184 @@
     $args = array('browse' => 'featured', 'page' => $page);
     $api = plugins_api('query_plugins', $args);
+    if ( is_wp_error($api) )
+        wp_die($api);
     display_plugins_table($api->plugins, $api->info['page'], $api->info['pages']);
 }
@@ -202 +214 @@
     $args = array('browse' => 'new', 'page' => $page);
     $api = plugins_api('query_plugins', $args);
+    if ( is_wp_error($api) )
+        wp_die($api);
     display_plugins_table($api->plugins, $api->info['page'], $api->info['pages']);
 }
@@ -235 +249 @@
     $term = isset($_REQUEST['s']) ? $_REQUEST['s'] : '';
 
-    $plugins_allowedtags = array('a' => array('href' => array(),'title' => array(), 'target' => array()),'abbr' => array('title' => array()),'acronym' => array('title' => array()),'code' => array(),'em' => array(),'strong' => array());
+    $plugins_allowedtags = array('a' => array('href' => array(),'title' => array(), 'target' => array()),
+                                'abbr' => array('title' => array()),'acronym' => array('title' => array()),
+                                'code' => array(),'em' => array(),'strong' => array());
 
 ?>
@@ -317 +333 @@
                 <td class="vers"><?php echo $version; ?></td>
                 <td class="vers">
-                    <div class="star-holder" title="<?php printf( __('based on %d ratings'), $plugin['num_ratings'] ); ?>">
+                    <div class="star-holder" title="<?php printf(__ngettext(__('based on %d rating'), __('based on %d ratings'), $plugin['num_ratings']), $plugin['num_ratings']) ?>">
                         <div class="star star-rating" style="width: <?php echo attribute_escape($plugin['rating']) ?>px"></div>
                         <div class="star star5"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('5 stars') ?>" /></div>
@@ -355 +371 @@
 
     $api = plugins_api('plugin_information', array('slug' => $_REQUEST['plugin']));
+
+    if ( is_wp_error($api) )
+        wp_die($api);
+
+    $plugins_allowedtags = array('a' => array('href' => array(), 'title' => array(), 'target' => array()),
+                                'abbr' => array('title' => array()), 'acronym' => array('title' => array()),
+                                'code' => array(), 'em' => array(), 'strong' => array(), 'div' => array(),
+                                'p' => array(), 'ul' => array(), 'ol' => array(), 'li' => array());
+    //Sanitize HTML
+    foreach ( (array)$api->sections as $section_name => $content )
+        $api->sections[$section_name] = wp_kses($content, $plugins_allowedtags);
+    foreach ( array('version', 'author', 'requires', 'tested', 'homepage', 'downloaded', 'slug') as $key )
+        $api->$key = wp_kses($api->$key, $plugins_allowedtags);
 
     $section = isset($_REQUEST['section']) ? $_REQUEST['section'] : 'description'; //Default to the Description tab, Do not translate, API returns English.
@@ -522 +551 @@
     check_admin_referer('install-plugin_' . $plugin);
     $api = plugins_api('plugin_information', array('slug' => $plugin, 'fields' => array('sections' => false) ) ); //Save on a bit of bandwidth.
+    
+    if ( is_wp_error($api) )
+        wp_die($api);
 
     echo '<div class="wrap">';
@@ -835 +867 @@
 }
 
-
-
 ?>

trunk/wp-settings.php

@@ -109 +109 @@
 
 if ( file_exists(ABSPATH . '.maintenance') && !defined('WP_INSTALLING') ) {
-    if ( file_exists( WP_CONTENT_DIR . '/maintenance.php' ) ) {
-        require_once( WP_CONTENT_DIR . '/maintenance.php' );
-        die();
-    }
-
-    $protocol = $_SERVER["SERVER_PROTOCOL"];
-    if ( 'HTTP/1.1' != $protocol && 'HTTP/1.0' != $protocol )
-        $protocol = 'HTTP/1.0';
-    header( "$protocol 503 Service Unavailable", true, 503 );
-    header( 'Content-Type: text/html; charset=utf-8' );
+    include(ABSPATH . '.maintenance');
+    // If the $upgrading timestamp is older than 10 minutes, don't die.
+    if ( ( time() - $upgrading ) < 600 ) {
+        if ( file_exists( WP_CONTENT_DIR . '/maintenance.php' ) ) {
+            require_once( WP_CONTENT_DIR . '/maintenance.php' );
+            die();
+        }
+
+        $protocol = $_SERVER["SERVER_PROTOCOL"];
+        if ( 'HTTP/1.1' != $protocol && 'HTTP/1.0' != $protocol )
+            $protocol = 'HTTP/1.0';
+        header( "$protocol 503 Service Unavailable", true, 503 );
+        header( 'Content-Type: text/html; charset=utf-8' );
 ?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
@@ -132 +135 @@
 </html>
 <?php
-die();
+        die();
+    }
 }