Make WordPress Core

Opened 12 years ago

Closed 12 years ago

#24092 closed defect (bug) (fixed)

Embed handlers for the audio and video shortcodes are too permissive

Reported by: kovshenin's profile kovshenin Owned by: sergeybiryukov's profile SergeyBiryukov
Milestone: 3.6 Priority: normal
Severity: normal Version: 3.6
Component: Media Keywords: has-patch commit
Focuses: Cc:

Description (last modified by kovshenin)

The regex patterns in the audio and video embed handlers introduced in [23729], do not contain the beginning and end of string markers (^ and $) and will thus match things such as:

http://example.org/wp-content/uploads/directory.mp3/file.php

Not a big deal, but it probably shouldn't.

Attachments (2)

24092.diff (1.3 KB) - added by kovshenin 12 years ago.
24092.2.diff (5.3 KB) - added by kovshenin 12 years ago.

Download all attachments as: .zip

Change History (7)

@kovshenin
12 years ago

#1 @kovshenin
12 years ago

  • Description modified (diff)

#2 @SergeyBiryukov
12 years ago

  • Keywords commit added

#3 @SergeyBiryukov
12 years ago

Shouldn't wp_audio_embed() and wp_video_embed() handlers registration be moved to wp_maybe_load_embeds()?
http://core.trac.wordpress.org/browser/tags/3.5.1/wp-includes/media.php#L1074

@kovshenin
12 years ago

#4 @kovshenin
12 years ago

In 24092.2.diff:

  • Add the pattern start/end markers
  • Per @SergeyBiryukov move registration to wp_maybe_load_embeds
  • Rename both handler functions to match the wp_embed_handler_* pattern
  • Move handler functions closer to wp_embed_handler_googlevideo

#5 @SergeyBiryukov
12 years ago

  • Owner set to SergeyBiryukov
  • Resolution set to fixed
  • Status changed from new to closed

In 24000:

  • Add start/end markers to the regex patterns in audio and video embed handlers.
  • Move the handler functions registration to wp_maybe_load_embeds().
  • Rename both functions to match the wp_embed_handler_* pattern.
  • Move the functions closer to wp_embed_handler_googlevideo().

props kovshenin. fixes #24092.

Note: See TracTickets for help on using tickets.