Changeset 55765

Timestamp:

05/16/2023 02:40:11 PM (3 years ago)

Author:

audrasjb

Message:

I18N: Introduce sanitization function for locale.

Introduce the sanitize_locale_name() for sanitizing user input of locales.

Props xknown, timothyblynjacobs, ocean90, peterwilsoncc.
Merges [55760] to branch 6.2.

Location:

branches/6.2

Files:

• src/wp-includes/formatting.php (modified) (1 diff)
• src/wp-includes/l10n.php (modified) (1 diff)
• tests/phpunit/tests/formatting/sanitizeLocaleName.php (added)

branches/6.2/src/wp-includes/formatting.php

@@ -2435 +2435 @@
 
 /**
+ * Strips out all characters not allowed in a locale name.
+ *
+ * @since 6.2.1
+ *
+ * @param string $locale_name The locale name to be sanitized.
+ * @return string The sanitized value.
+ */
+function sanitize_locale_name( $locale_name ) {
+        // Limit to A-Z, a-z, 0-9, '_', '-'.
+        $sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $locale_name );
+
+        /**
+         * Filters a sanitized locale name string.
+         *
+         * @since 6.2.1
+         *
+         * @param string $sanitized   The sanitized locale name.
+         * @param string $locale_name The locale name before sanitization.
+         */
+        return apply_filters( 'sanitize_locale_name', $sanitized, $locale_name );
+}
+
+/**
  * Converts lone & characters into `&` (a.k.a. `&`)
  *

branches/6.2/src/wp-includes/l10n.php

@@ -150 +150 @@
 
         if ( ! empty( $_GET['wp_lang'] ) ) {
-                $wp_lang = sanitize_text_field( $_GET['wp_lang'] );
+                $wp_lang = sanitize_locale_name( wp_unslash( $_GET['wp_lang'] ) );
         } elseif ( ! empty( $_COOKIE['wp_lang'] ) ) {
-                $wp_lang = sanitize_text_field( $_COOKIE['wp_lang'] );
+                $wp_lang = sanitize_locale_name( wp_unslash( $_COOKIE['wp_lang'] ) );
         }