Skip to content

Commit f07aa38

Browse files
johnbillionjohnbillion
committed
Grouped backports for the 5.2 branch.
- XML-RPC: Switch to `wp_safe_remote()` when fetching a pingback URL. - HTML API: Prevent `WP_HTML_Tag_Processor` instances being unserialized and add some extra logic for validating pattern and template file paths. - KSES: Optimize PCRE pattern detecting numeric character references. - Customize: Improve escaping approach used for nav menu attributes. - Media: Ensure the attachment parent is accessible to the user before showing a link to it in the media manager. - Administration: Ensure client-side templates are only detected when they're correctly associated with a script tag. - Filesystem API: Don't attempt to extract invalid files from a zip when using the PclZip library. Merges [61879-61884,61886-61887,61890,61913] to the 5.2 branch. Props johnbillion, xknown, dmsnell, jorbin, peterwilson, desrosj, westonruter, jonsurrell, aurdasjb. git-svn-id: https://develop.svn.wordpress.org/branches/5.2@62001 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 8a50b6d commit f07aa38

11 files changed

Lines changed: 69 additions & 22 deletions

File tree

‎src/js/_enqueues/wp/util.js‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,11 @@ window.wp = window.wp || {};
3636
};
3737

3838
return function ( data ) {
39-
compiled = compiled || _.template( $( '#tmpl-' + id ).html(), options );
39+
var el = document.querySelector( 'script#tmpl-' + id );
40+
if ( ! el ) {
41+
throw new Error( 'Template not found: ' + '#tmpl-' + id );
42+
}
43+
compiled = compiled || _.template( $( el ).html(), options );
4044
return compiled( data );
4145
};
4246
});

‎src/wp-admin/includes/class-walker-nav-menu-checklist.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -108,12 +108,12 @@ public function start_el( &$output, $item, $depth = 0, $args = array(), $id = 0
108108
$output .= '<input type="hidden" class="menu-item-object" name="menu-item[' . $possible_object_id . '][menu-item-object]" value="' . esc_attr( $item->object ) . '" />';
109109
$output .= '<input type="hidden" class="menu-item-parent-id" name="menu-item[' . $possible_object_id . '][menu-item-parent-id]" value="' . esc_attr( $item->menu_item_parent ) . '" />';
110110
$output .= '<input type="hidden" class="menu-item-type" name="menu-item[' . $possible_object_id . '][menu-item-type]" value="' . esc_attr( $item->type ) . '" />';
111-
$output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . esc_attr( $item->title ) . '" />';
111+
$output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . htmlspecialchars( $item->title, ENT_QUOTES ) . '" />';
112112
$output .= '<input type="hidden" class="menu-item-url" name="menu-item[' . $possible_object_id . '][menu-item-url]" value="' . esc_attr( $item->url ) . '" />';
113113
$output .= '<input type="hidden" class="menu-item-target" name="menu-item[' . $possible_object_id . '][menu-item-target]" value="' . esc_attr( $item->target ) . '" />';
114-
$output .= '<input type="hidden" class="menu-item-attr_title" name="menu-item[' . $possible_object_id . '][menu-item-attr_title]" value="' . esc_attr( $item->attr_title ) . '" />';
115-
$output .= '<input type="hidden" class="menu-item-classes" name="menu-item[' . $possible_object_id . '][menu-item-classes]" value="' . esc_attr( implode( ' ', $item->classes ) ) . '" />';
116-
$output .= '<input type="hidden" class="menu-item-xfn" name="menu-item[' . $possible_object_id . '][menu-item-xfn]" value="' . esc_attr( $item->xfn ) . '" />';
114+
$output .= '<input type="hidden" class="menu-item-attr_title" name="menu-item[' . $possible_object_id . '][menu-item-attr-title]" value="' . htmlspecialchars( $item->attr_title, ENT_QUOTES ) . '" />';
115+
$output .= '<input type="hidden" class="menu-item-classes" name="menu-item[' . $possible_object_id . '][menu-item-classes]" value="' . htmlspecialchars( implode( ' ', $item->classes ), ENT_QUOTES ) . '" />';
116+
$output .= '<input type="hidden" class="menu-item-xfn" name="menu-item[' . $possible_object_id . '][menu-item-xfn]" value="' . htmlspecialchars( $item->xfn, ENT_QUOTES ) . '" />';
117117
}
118118

119119
} // Walker_Nav_Menu_Checklist

‎src/wp-admin/includes/class-walker-nav-menu-edit.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -170,13 +170,13 @@ public function start_el( &$output, $item, $depth = 0, $args = array(), $id = 0
170170
<p class="description description-wide">
171171
<label for="edit-menu-item-title-<?php echo $item_id; ?>">
172172
<?php _e( 'Navigation Label' ); ?><br />
173-
<input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $item->title ); ?>" />
173+
<input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $item->title, ENT_QUOTES ); ?>" />
174174
</label>
175175
</p>
176176
<p class="field-title-attribute field-attr-title description description-wide">
177177
<label for="edit-menu-item-attr-title-<?php echo $item_id; ?>">
178178
<?php _e( 'Title Attribute' ); ?><br />
179-
<input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $item->post_excerpt ); ?>" />
179+
<input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $item->post_excerpt, ENT_QUOTES ); ?>" />
180180
</label>
181181
</p>
182182
<p class="field-link-target description">
@@ -188,13 +188,13 @@ public function start_el( &$output, $item, $depth = 0, $args = array(), $id = 0
188188
<p class="field-css-classes description description-thin">
189189
<label for="edit-menu-item-classes-<?php echo $item_id; ?>">
190190
<?php _e( 'CSS Classes (optional)' ); ?><br />
191-
<input type="text" id="edit-menu-item-classes-<?php echo $item_id; ?>" class="widefat code edit-menu-item-classes" name="menu-item-classes[<?php echo $item_id; ?>]" value="<?php echo esc_attr( implode( ' ', $item->classes ) ); ?>" />
191+
<input type="text" id="edit-menu-item-classes-<?php echo $item_id; ?>" class="widefat code edit-menu-item-classes" name="menu-item-classes[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( implode( ' ', $item->classes ), ENT_QUOTES ); ?>" />
192192
</label>
193193
</p>
194194
<p class="field-xfn description description-thin">
195195
<label for="edit-menu-item-xfn-<?php echo $item_id; ?>">
196196
<?php _e( 'Link Relationship (XFN)' ); ?><br />
197-
<input type="text" id="edit-menu-item-xfn-<?php echo $item_id; ?>" class="widefat code edit-menu-item-xfn" name="menu-item-xfn[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $item->xfn ); ?>" />
197+
<input type="text" id="edit-menu-item-xfn-<?php echo $item_id; ?>" class="widefat code edit-menu-item-xfn" name="menu-item-xfn[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $item->xfn, ENT_QUOTES ); ?>" />
198198
</label>
199199
</p>
200200
<p class="field-description description description-wide">

‎src/wp-admin/includes/file.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1576,6 +1576,11 @@ function _unzip_file_pclzip( $file, $to, $needed_dirs = array() ) {
15761576
continue;
15771577
}
15781578

1579+
// Don't extract invalid files:
1580+
if ( 0 !== validate_file( $file['filename'] ) ) {
1581+
continue;
1582+
}
1583+
15791584
$uncompressed_size += $file['size'];
15801585

15811586
$needed_dirs[] = $to . untrailingslashit( $file['folder'] ? $file['filename'] : dirname( $file['filename'] ) );

‎src/wp-includes/ID3/getid3.lib.php‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -535,15 +535,12 @@ public static function array_min($arraydata, $returnkey=false) {
535535
return ($returnkey ? $minkey : $minvalue);
536536
}
537537

538-
/**
539-
* Converts an XML string to an array, using SimpleXML if available
540-
*/
541538
public static function XML2array($XMLstring) {
542539
if (function_exists('simplexml_load_string') && function_exists('libxml_disable_entity_loader')) {
543540
// http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html
544541
// https://core.trac.wordpress.org/changeset/29378
545542
$loader = libxml_disable_entity_loader(true);
546-
$XMLobject = simplexml_load_string($XMLstring, 'SimpleXMLElement', LIBXML_NOENT);
543+
$XMLobject = simplexml_load_string($XMLstring, 'SimpleXMLElement', 0);
547544
$return = self::SimpleXMLelement2array($XMLobject);
548545
libxml_disable_entity_loader($loader);
549546
return $return;

‎src/wp-includes/class-wp-http-ixr-client.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ public function query() {
8585
echo '<pre class="ixr_request">' . htmlspecialchars( $xml ) . "\n</pre>\n\n";
8686
}
8787

88-
$response = wp_remote_post( $url, $args );
88+
$response = wp_safe_remote_post( $url, $args );
8989

9090
if ( is_wp_error( $response ) ) {
9191
$errno = $response->get_error_code();

‎src/wp-includes/kses.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1727,10 +1727,9 @@ function wp_kses_normalize_entities( $string ) {
17271727
// Disarm all entities by converting & to &amp;
17281728
$string = str_replace( '&', '&amp;', $string );
17291729

1730-
// Change back the allowed entities in our entity whitelist
17311730
$string = preg_replace_callback( '/&amp;([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string );
1732-
$string = preg_replace_callback( '/&amp;#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $string );
1733-
$string = preg_replace_callback( '/&amp;#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $string );
1731+
$string = preg_replace_callback( '/&amp;#(0*[1-9][0-9]{0,6});/', 'wp_kses_normalize_entities2', $string );
1732+
$string = preg_replace_callback( '/&amp;#[Xx](0*[1-9A-Fa-f][0-9A-Fa-f]{0,5});/', 'wp_kses_normalize_entities3', $string );
17341733

17351734
return $string;
17361735
}

‎src/wp-includes/media.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3276,14 +3276,14 @@ function wp_prepare_attachment_for_js( $attachment ) {
32763276
$post_parent = false;
32773277
}
32783278

3279-
if ( $post_parent ) {
3279+
if ( $post_parent && current_user_can( 'read_post', $attachment->post_parent ) ) {
32803280
$parent_type = get_post_type_object( $post_parent->post_type );
32813281

32823282
if ( $parent_type && $parent_type->show_ui && current_user_can( 'edit_post', $attachment->post_parent ) ) {
32833283
$response['uploadedToLink'] = get_edit_post_link( $attachment->post_parent, 'raw' );
32843284
}
32853285

3286-
if ( $parent_type && current_user_can( 'read_post', $attachment->post_parent ) ) {
3286+
if ( $parent_type ) {
32873287
$response['uploadedToTitle'] = $post_parent->post_title ? $post_parent->post_title : __( '(no title)' );
32883288
}
32893289
}

‎src/wp-includes/nav-menu.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -484,7 +484,7 @@ function wp_update_nav_menu_item( $menu_id = 0, $menu_item_db_id = 0, $menu_item
484484
}
485485
}
486486

487-
if ( $args['menu-item-title'] == $original_title ) {
487+
if ( wp_unslash( $args['menu-item-title'] ) === $original_title ) {
488488
$args['menu-item-title'] = '';
489489
}
490490

‎src/wp-includes/template-loader.php‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@
7474
*
7575
* @param string $template The path of the template to include.
7676
*/
77-
if ( $template = apply_filters( 'template_include', $template ) ) {
78-
include( $template );
77+
$template = apply_filters( 'template_include', $template );
78+
$is_stringy = is_string( $template ) || ( is_object( $template ) && method_exists( $template, '__toString' ) );
79+
$template = $is_stringy ? realpath( (string) $template ) : null;
80+
if (
81+
is_string( $template ) &&
82+
( str_ends_with( $template, '.php' ) || str_ends_with( $template, '.html' ) ) &&
83+
is_file( $template ) &&
84+
is_readable( $template )
85+
) {
86+
include $template;
7987
} elseif ( current_user_can( 'switch_themes' ) ) {
8088
$theme = wp_get_theme();
8189
if ( $theme->errors() ) {

0 commit comments

Comments
 (0)