Skip to content

Commit dab9816

Browse files
johnbillionjohnbillion
committed
Grouped backports for the 4.8 branch.
- XML-RPC: Switch to `wp_safe_remote()` when fetching a pingback URL. - HTML API: Prevent `WP_HTML_Tag_Processor` instances being unserialized and add some extra logic for validating pattern and template file paths. - KSES: Optimize PCRE pattern detecting numeric character references. - Customize: Improve escaping approach used for nav menu attributes. - Media: Ensure the attachment parent is accessible to the user before showing a link to it in the media manager. - Administration: Ensure client-side templates are only detected when they're correctly associated with a script tag. - Filesystem API: Don't attempt to extract invalid files from a zip when using the PclZip library. Merges [61879-61884,61886-61887,61890,61913] to the 4.8 branch. Props johnbillion, xknown, dmsnell, jorbin, peterwilson, desrosj, westonruter, jonsurrell, aurdasjb. git-svn-id: https://develop.svn.wordpress.org/branches/4.8@62005 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 0a31962 commit dab9816

10 files changed

Lines changed: 47 additions & 30 deletions

File tree

‎src/wp-admin/includes/class-walker-nav-menu-checklist.php‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -103,15 +103,15 @@ public function start_el( &$output, $item, $depth = 0, $args = array(), $id = 0
103103

104104
// Menu item hidden fields
105105
$output .= '<input type="hidden" class="menu-item-db-id" name="menu-item[' . $possible_object_id . '][menu-item-db-id]" value="' . $possible_db_id . '" />';
106-
$output .= '<input type="hidden" class="menu-item-object" name="menu-item[' . $possible_object_id . '][menu-item-object]" value="'. esc_attr( $item->object ) .'" />';
107-
$output .= '<input type="hidden" class="menu-item-parent-id" name="menu-item[' . $possible_object_id . '][menu-item-parent-id]" value="'. esc_attr( $item->menu_item_parent ) .'" />';
108-
$output .= '<input type="hidden" class="menu-item-type" name="menu-item[' . $possible_object_id . '][menu-item-type]" value="'. esc_attr( $item->type ) .'" />';
109-
$output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="'. esc_attr( $item->title ) .'" />';
110-
$output .= '<input type="hidden" class="menu-item-url" name="menu-item[' . $possible_object_id . '][menu-item-url]" value="'. esc_attr( $item->url ) .'" />';
111-
$output .= '<input type="hidden" class="menu-item-target" name="menu-item[' . $possible_object_id . '][menu-item-target]" value="'. esc_attr( $item->target ) .'" />';
112-
$output .= '<input type="hidden" class="menu-item-attr_title" name="menu-item[' . $possible_object_id . '][menu-item-attr_title]" value="'. esc_attr( $item->attr_title ) .'" />';
113-
$output .= '<input type="hidden" class="menu-item-classes" name="menu-item[' . $possible_object_id . '][menu-item-classes]" value="'. esc_attr( implode( ' ', $item->classes ) ) .'" />';
114-
$output .= '<input type="hidden" class="menu-item-xfn" name="menu-item[' . $possible_object_id . '][menu-item-xfn]" value="'. esc_attr( $item->xfn ) .'" />';
106+
$output .= '<input type="hidden" class="menu-item-object" name="menu-item[' . $possible_object_id . '][menu-item-object]" value="' . esc_attr( $item->object ) . '" />';
107+
$output .= '<input type="hidden" class="menu-item-parent-id" name="menu-item[' . $possible_object_id . '][menu-item-parent-id]" value="' . esc_attr( $item->menu_item_parent ) . '" />';
108+
$output .= '<input type="hidden" class="menu-item-type" name="menu-item[' . $possible_object_id . '][menu-item-type]" value="' . esc_attr( $item->type ) . '" />';
109+
$output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . htmlspecialchars( $item->title, ENT_QUOTES ) . '" />';
110+
$output .= '<input type="hidden" class="menu-item-url" name="menu-item[' . $possible_object_id . '][menu-item-url]" value="' . esc_attr( $item->url ) . '" />';
111+
$output .= '<input type="hidden" class="menu-item-target" name="menu-item[' . $possible_object_id . '][menu-item-target]" value="' . esc_attr( $item->target ) . '" />';
112+
$output .= '<input type="hidden" class="menu-item-attr_title" name="menu-item[' . $possible_object_id . '][menu-item-attr-title]" value="' . htmlspecialchars( $item->attr_title, ENT_QUOTES ) . '" />';
113+
$output .= '<input type="hidden" class="menu-item-classes" name="menu-item[' . $possible_object_id . '][menu-item-classes]" value="' . htmlspecialchars( implode( ' ', $item->classes ), ENT_QUOTES ) . '" />';
114+
$output .= '<input type="hidden" class="menu-item-xfn" name="menu-item[' . $possible_object_id . '][menu-item-xfn]" value="' . htmlspecialchars( $item->xfn, ENT_QUOTES ) . '" />';
115115
}
116116

117117
} // Walker_Nav_Menu_Checklist

‎src/wp-admin/includes/class-walker-nav-menu-edit.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -162,13 +162,13 @@ public function start_el( &$output, $item, $depth = 0, $args = array(), $id = 0
162162
<p class="description description-wide">
163163
<label for="edit-menu-item-title-<?php echo $item_id; ?>">
164164
<?php _e( 'Navigation Label' ); ?><br />
165-
<input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $item->title ); ?>" />
165+
<input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $item->title, ENT_QUOTES ); ?>" />
166166
</label>
167167
</p>
168168
<p class="field-title-attribute field-attr-title description description-wide">
169169
<label for="edit-menu-item-attr-title-<?php echo $item_id; ?>">
170170
<?php _e( 'Title Attribute' ); ?><br />
171-
<input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $item->post_excerpt ); ?>" />
171+
<input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $item->post_excerpt, ENT_QUOTES ); ?>" />
172172
</label>
173173
</p>
174174
<p class="field-link-target description">
@@ -180,13 +180,13 @@ public function start_el( &$output, $item, $depth = 0, $args = array(), $id = 0
180180
<p class="field-css-classes description description-thin">
181181
<label for="edit-menu-item-classes-<?php echo $item_id; ?>">
182182
<?php _e( 'CSS Classes (optional)' ); ?><br />
183-
<input type="text" id="edit-menu-item-classes-<?php echo $item_id; ?>" class="widefat code edit-menu-item-classes" name="menu-item-classes[<?php echo $item_id; ?>]" value="<?php echo esc_attr( implode(' ', $item->classes ) ); ?>" />
183+
<input type="text" id="edit-menu-item-classes-<?php echo $item_id; ?>" class="widefat code edit-menu-item-classes" name="menu-item-classes[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( implode( ' ', $item->classes ), ENT_QUOTES ); ?>" />
184184
</label>
185185
</p>
186186
<p class="field-xfn description description-thin">
187187
<label for="edit-menu-item-xfn-<?php echo $item_id; ?>">
188188
<?php _e( 'Link Relationship (XFN)' ); ?><br />
189-
<input type="text" id="edit-menu-item-xfn-<?php echo $item_id; ?>" class="widefat code edit-menu-item-xfn" name="menu-item-xfn[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $item->xfn ); ?>" />
189+
<input type="text" id="edit-menu-item-xfn-<?php echo $item_id; ?>" class="widefat code edit-menu-item-xfn" name="menu-item-xfn[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $item->xfn, ENT_QUOTES ); ?>" />
190190
</label>
191191
</p>
192192
<p class="field-description description description-wide">

‎src/wp-admin/includes/file.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -763,6 +763,11 @@ function _unzip_file_pclzip($file, $to, $needed_dirs = array()) {
763763
if ( '__MACOSX/' === substr($file['filename'], 0, 9) ) // Skip the OS X-created __MACOSX directory
764764
continue;
765765

766+
// Don't extract invalid files:
767+
if ( 0 !== validate_file( $file['filename'] ) ) {
768+
continue;
769+
}
770+
766771
$uncompressed_size += $file['size'];
767772

768773
$needed_dirs[] = $to . untrailingslashit( $file['folder'] ? $file['filename'] : dirname($file['filename']) );

‎src/wp-includes/ID3/getid3.lib.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -523,7 +523,7 @@ public static function XML2array($XMLstring) {
523523
// http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html
524524
// https://core.trac.wordpress.org/changeset/29378
525525
$loader = libxml_disable_entity_loader(true);
526-
$XMLobject = simplexml_load_string($XMLstring, 'SimpleXMLElement', LIBXML_NOENT);
526+
$XMLobject = simplexml_load_string($XMLstring, 'SimpleXMLElement', 0);
527527
$return = self::SimpleXMLelement2array($XMLobject);
528528
libxml_disable_entity_loader($loader);
529529
return $return;

‎src/wp-includes/class-wp-http-ixr-client.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ public function query() {
8686
echo '<pre class="ixr_request">' . htmlspecialchars($xml) . "\n</pre>\n\n";
8787
}
8888

89-
$response = wp_remote_post($url, $args);
89+
$response = wp_safe_remote_post( $url, $args );
9090

9191
if ( is_wp_error($response) ) {
9292
$errno = $response->get_error_code();

‎src/wp-includes/js/wp-util.js‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,11 @@ window.wp = window.wp || {};
3030
};
3131

3232
return function ( data ) {
33-
compiled = compiled || _.template( $( '#tmpl-' + id ).html(), options );
33+
var el = document.querySelector( 'script#tmpl-' + id );
34+
if ( ! el ) {
35+
throw new Error( 'Template not found: ' + '#tmpl-' + id );
36+
}
37+
compiled = compiled || _.template( $( el ).html(), options );
3438
return compiled( data );
3539
};
3640
});

‎src/wp-includes/kses.php‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -540,7 +540,7 @@ function wp_kses_one_attr( $string, $element ) {
540540
$allowed_html = wp_kses_allowed_html( 'post' );
541541
$allowed_protocols = wp_allowed_protocols();
542542
$string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
543-
543+
544544
// Preserve leading and trailing whitespace.
545545
$matches = array();
546546
preg_match('/^\s*/', $string, $matches);
@@ -552,7 +552,7 @@ function wp_kses_one_attr( $string, $element ) {
552552
} else {
553553
$string = substr( $string, strlen( $lead ), -strlen( $trail ) );
554554
}
555-
555+
556556
// Parse attribute name and value from input.
557557
$split = preg_split( '/\s*=\s*/', $string, 2 );
558558
$name = $split[0];
@@ -589,7 +589,7 @@ function wp_kses_one_attr( $string, $element ) {
589589
$value = '';
590590
$vless = 'y';
591591
}
592-
592+
593593
// Sanitize attribute by name.
594594
wp_kses_attr_check( $name, $value, $string, $vless, $element, $allowed_html );
595595

@@ -1124,7 +1124,7 @@ function wp_kses_attr_parse( $element ) {
11241124
} else {
11251125
$xhtml_slash = '';
11261126
}
1127-
1127+
11281128
// Split it
11291129
$attrarr = wp_kses_hair_parse( $attr );
11301130
if ( false === $attrarr ) {
@@ -1134,7 +1134,7 @@ function wp_kses_attr_parse( $element ) {
11341134
// Make sure all input is returned by adding front and back matter.
11351135
array_unshift( $attrarr, $begin . $slash . $elname );
11361136
array_push( $attrarr, $xhtml_slash . $end );
1137-
1137+
11381138
return $attrarr;
11391139
}
11401140

@@ -1449,10 +1449,9 @@ function wp_kses_normalize_entities($string) {
14491449
// Disarm all entities by converting & to &amp;
14501450
$string = str_replace('&', '&amp;', $string);
14511451

1452-
// Change back the allowed entities in our entity whitelist
1453-
$string = preg_replace_callback('/&amp;([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string);
1454-
$string = preg_replace_callback('/&amp;#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $string);
1455-
$string = preg_replace_callback('/&amp;#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $string);
1452+
$string = preg_replace_callback( '/&amp;([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string );
1453+
$string = preg_replace_callback( '/&amp;#(0*+[1-9][0-9]{0,6});/', 'wp_kses_normalize_entities2', $string );
1454+
$string = preg_replace_callback( '/&amp;#[Xx](0*+[1-9A-Fa-f][0-9A-Fa-f]{0,5});/', 'wp_kses_normalize_entities3', $string );
14561455

14571456
return $string;
14581457
}

‎src/wp-includes/media.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3150,14 +3150,14 @@ function wp_prepare_attachment_for_js( $attachment ) {
31503150
$post_parent = false;
31513151
}
31523152

3153-
if ( $post_parent ) {
3153+
if ( $post_parent && current_user_can( 'read_post', $attachment->post_parent ) ) {
31543154
$parent_type = get_post_type_object( $post_parent->post_type );
31553155

31563156
if ( $parent_type && $parent_type->show_ui && current_user_can( 'edit_post', $attachment->post_parent ) ) {
31573157
$response['uploadedToLink'] = get_edit_post_link( $attachment->post_parent, 'raw' );
31583158
}
31593159

3160-
if ( $parent_type && current_user_can( 'read_post', $attachment->post_parent ) ) {
3160+
if ( $parent_type ) {
31613161
$response['uploadedToTitle'] = $post_parent->post_title ? $post_parent->post_title : __( '(no title)' );
31623162
}
31633163
}

‎src/wp-includes/nav-menu.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -434,8 +434,9 @@ function wp_update_nav_menu_item( $menu_id = 0, $menu_item_db_id = 0, $menu_item
434434
}
435435
}
436436

437-
if ( $args['menu-item-title'] == $original_title )
437+
if ( wp_unslash( $args['menu-item-title'] ) === $original_title ) {
438438
$args['menu-item-title'] = '';
439+
}
439440

440441
// hack to get wp to create a post object when too many properties are empty
441442
if ( '' == $args['menu-item-title'] && '' == $args['menu-item-description'] )

‎src/wp-includes/template-loader.php‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,16 @@
7070
*
7171
* @param string $template The path of the template to include.
7272
*/
73-
if ( $template = apply_filters( 'template_include', $template ) ) {
74-
include( $template );
73+
$template = apply_filters( 'template_include', $template );
74+
$is_stringy = is_string( $template ) || ( is_object( $template ) && method_exists( $template, '__toString' ) );
75+
$template = $is_stringy ? realpath( (string) $template ) : null;
76+
if (
77+
is_string( $template ) &&
78+
( str_ends_with( $template, '.php' ) || str_ends_with( $template, '.html' ) ) &&
79+
is_file( $template ) &&
80+
is_readable( $template )
81+
) {
82+
include $template;
7583
} elseif ( current_user_can( 'switch_themes' ) ) {
7684
$theme = wp_get_theme();
7785
if ( $theme->errors() ) {

0 commit comments

Comments
 (0)