Audio/video uploads are broken in 4.2.13 and 4.3.9

[uzegonemad]

As the title states, audio/video uploads are broken in the 4.2.13 and 4.3.9 security releases.

These releases backport a function for validating metadata, wp_kses_post_deep, but this function wasn't introduced until 4.4.

Uploading an audio/video file will respond with an undefined function error.

Relevant 4.2 commit: [40148]

Relevant 4.3 commit: [40153]

Trac doesn't let me choose 4.2.13, so I've filed this against trunk.

[SergeyBiryukov]

Hi @uzegonemad, welcome to Trac! Thanks for the report.

I can confirm the issue. [40148] was backported to all branches from 3.7 to 4.3, so they all appear to be affected.

[uzegonemad]

I just noticed that as well. It looks like this affects the following releases:

• 3.7.19
• 3.8.19
• 3.9.17
• 4.0.16
• 4.1.16
• 4.2.13
• 4.3.9

[SergeyBiryukov]

Related: #40075

[joemcgill]

Initially thought we could simply backport both wp_kses_post_deep() and map_deep() to these branches, but am thinking we should revert and use a more targeted approach than wp_kses_post_deep() (see: @ocean90 's comment on 40075).

Also need to investigate why we aren't seeing failing tests on these branches and make sure we have coverage for these code paths.

[joemcgill]

40085.diff​ moves the call to wp_kses_post() inside wp_add_id3_tag_data() which I think sanitizes all the metadata that might be used in a display context. This should also avoid #40075. Testing and feedback welcome.

[dlh]

I tested 40085.diff​ with some audio files on the 4.3, 4.2, and 3.9 branches.

Although I can't speak intelligently about the use of wp_kses_post() itself in this context, I can at least report that the uploads succeeded, and the files and metadata seemed OK.

I would also note there was a PHP 7-specific fatal error in 3.9: Fatal error: 'break' not in the 'loop' or 'switch' context in /wp-includes/ID3/getid3.lib.php on line 285. It looks like that break was removed in [29734].

[joemcgill]

Thanks for testing, @dlh. I'm not sure we need to patch a PHP 7 specific bug as far back as 3.9, but it's good to have documented.

[kirasong]

Took a look at the patch.

This makes sense, but it'd be good to have someone familiar with ID3 like @wonderboymusic to take a look and make sure there isn't anything that wp_kses_post() sanitizes that commonly occurs in ID3 comments and would need to be preserved.

[lukecavanagh]

@joemcgill

I tested 40058.diff and it does fix the issues in #40075. But a JPEG thumbnail image is still generated besides having the mp3 display with the cover artwork correctly in the media library.

[lukecavanagh]

mp3 Media Library patch fix test

[joemcgill]

Thanks @lukecavanagh. I think that may have been existing behavior so the image could be used as a post_thumbnail for the attachment page, but will have to investigate further.

[lukecavanagh]

@joemcgill 

Okay in that case, then it makes sense as to why the image would be generated.

[SergeyBiryukov]

Uploaded a workaround plugin for both this ticket and and #40075, so that people on support forums could use it until the next minor release is available: ​https://wordpress.org/plugins/correct-audio-video-uploads/

The plugin is based on 40085.diff​.

[joemcgill]

In 40400:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

Fixes #40075, #40085.

[joemcgill]

[40400] needs to be backported back to the 3.7 branch.

[swissspidy]

In 40460:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

Fixes #40075, #40085.

Merges [40400] to the 4.7 branch.

[swissspidy]

In 40461:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.6 branch.

[swissspidy]

In 40462:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.5 branch.

[swissspidy]

In 40463:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.4 branch.

[swissspidy]

In 40464:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.3 branch.

[swissspidy]

In 40465:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.2 branch.

[swissspidy]

In 40466:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.1 branch.

[swissspidy]

In 40467:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.0 branch.

[swissspidy]

In 40468:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 3.9 branch.

[swissspidy]

In 40469:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 3.8 branch.

[swissspidy]

In 40470:

Fix broken audio/video functions when sanitizing ID3 data

This fixes a bug where running wp_kses_post_deep() on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 3.7 branch.