Grouped backports to the 4.3 branch.

- Comments: Prevent users who can not see a post from seeing comments on it.
- Shortcodes: Restrict ajax handler for media shortcode.
- Prevent unintended behavior when certain objects are unserialized.

Merges [56835], [56836], and [56838] to the 4.1 branch.
Props xknown, jorbin, joehoyle, peterwilsoncc, ehtis, tykoted, antpb.

git-svn-id: https://develop.svn.wordpress.org/branches/4.3@56852 602fd350-edb4-49c9-b593-d223f7449a82

Author: dream-encode

src/wp-admin/includes/ajax-actions.php

@@ -2869,13 +2869,29 @@ function wp_ajax_parse_media_shortcode() {
 
 	$shortcode = wp_unslash( $_POST['shortcode'] );
 
+	// Only process previews for media related shortcodes:
+	$found_shortcodes = get_shortcode_tags_in_content( $shortcode );
+	$media_shortcodes = array(
+		'audio',
+		'embed',
+		'playlist',
+		'video',
+		'gallery',
+	);
+
+	$other_shortcodes = array_diff( $found_shortcodes, $media_shortcodes );
+
+	if ( ! empty( $other_shortcodes ) ) {
+		wp_send_json_error();
+	}
+
 	if ( ! empty( $_POST['post_ID'] ) ) {
 		$post = get_post( (int) $_POST['post_ID'] );
 	}
 
 	// the embed shortcode requires a post
 	if ( ! $post || ! current_user_can( 'edit_post', $post->ID ) ) {
-		if ( 'embed' === $shortcode ) {
+		if ( in_array( 'embed', $found_shortcodes, true ) ) {
 			wp_send_json_error();
 		}
 	} else {

src/wp-admin/includes/class-wp-comments-list-table.php

@@ -445,6 +445,19 @@ public function single_row( $a_comment ) {
 
 		$this->user_can = current_user_can( 'edit_comment', $comment->comment_ID );
 
+		$edit_post_cap = $post ? 'edit_post' : 'edit_posts';
+		if (
+			current_user_can( $edit_post_cap, $comment->comment_post_ID ) ||
+			(
+				empty( $post->post_password ) &&
+				current_user_can( 'read_post', $comment->comment_post_ID )
+			)
+		) {
+			// The user has access to the post
+		} else {
+			return false;
+		}
+
 		echo "<tr id='comment-$comment->comment_ID' class='$the_comment_class'>";
 		$this->single_row_columns( $comment );
 		echo "</tr>\n";

src/wp-admin/includes/class-wp-list-table.php

@@ -623,7 +623,20 @@ protected function comments_bubble( $post_id, $pending_comments ) {
 		$approved_phrase = sprintf( _n( '%s approved comment', '%s approved comments', $approved_comments ), $approved_comments_number );
 		$pending_phrase = sprintf( _n( '%s pending comment', '%s pending comments', $pending_comments ), $pending_comments_number );
 
-		// No comments at all.
+		$post_object   = get_post( $post_id );
+		$edit_post_cap = $post_object ? 'edit_post' : 'edit_posts';
+		if (
+			current_user_can( $edit_post_cap, $post_id ) ||
+			(
+				empty( $post_object->post_password ) &&
+				current_user_can( 'read_post', $post_id )
+			)
+		) {
+			// The user has access to the post and thus can see comments
+		} else {
+			return false;
+		}
+
 		if ( ! $approved_comments && ! $pending_comments ) {
 			printf( '<span aria-hidden="true">—</span><span class="screen-reader-text">%s</span>',
 				__( 'No comments' )

src/wp-admin/includes/dashboard.php

@@ -821,8 +821,18 @@ function wp_dashboard_recent_comments( $total_items = 5 ) {
 		echo '<h4>' . __( 'Comments' ) . '</h4>';
 
 		echo '<div id="the-comment-list" data-wp-lists="list:comment">';
-		foreach ( $comments as $comment )
-			_wp_dashboard_recent_comments_row( $comment );
+		foreach ( $comments as $comment ) {
+			$comment_post = get_post( $comment->comment_post_ID );
+			if (
+				current_user_can( 'edit_post', $comment->comment_post_ID ) ||
+				(
+					empty( $comment_post->post_password ) &&
+					current_user_can( 'read_post', $comment->comment_post_ID )
+				)
+			) {
+				_wp_dashboard_recent_comments_row( $comment );
+			}
+		}
 		echo '</div>';
 
 		if ( current_user_can('edit_posts') )

src/wp-includes/class-wp-theme.php

@@ -506,6 +506,28 @@ public function parent() {
 		return isset( $this->parent ) ? $this->parent : false;
 	}
 
+	/**
+	 * Perform reinitialization tasks.
+	 *
+	 * Prevents a callback from being injected during unserialization of an object.
+	 *
+	 * @return void
+	 */
+	public function __wakeup() {
+		if ( $this->parent && ! $this->parent instanceof self ) {
+			throw new UnexpectedValueException();
+		}
+		if ( $this->headers && ! is_array( $this->headers ) ) {
+			throw new UnexpectedValueException();
+		}
+		foreach ( $this->headers as $value ) {
+			if ( ! is_string( $value ) ) {
+				throw new UnexpectedValueException();
+			}
+		}
+		$this->headers_sanitized = array();
+	}
+
 	/**
 	 * Adds theme data to cache.
 	 *
@@ -1303,4 +1325,16 @@ private static function _name_sort_i18n( $a, $b ) {
 		// Don't mark up; Do translate.
 		return strnatcasecmp( $a->display( 'Name', false, true ), $b->display( 'Name', false, true ) );
 	}
+
+	private static function _check_headers_property_has_correct_type( $headers ) {
+		if ( ! is_array( $headers ) ) {
+			return false;
+		}
+		foreach ( $headers as $key => $value ) {
+			if ( ! is_string( $key ) || ! is_string( $value ) ) {
+				return false;
+			}
+		}
+		return true;
+	}
 }

src/wp-includes/media.php

@@ -1028,11 +1028,24 @@ function gallery_shortcode( $attr ) {
 			$attachments[$val->ID] = $_attachments[$key];
 		}
 	} elseif ( ! empty( $atts['exclude'] ) ) {
+		$post_parent_id = $id;
 		$attachments = get_children( array( 'post_parent' => $id, 'exclude' => $atts['exclude'], 'post_status' => 'inherit', 'post_type' => 'attachment', 'post_mime_type' => 'image', 'order' => $atts['order'], 'orderby' => $atts['orderby'] ) );
 	} else {
+		$post_parent_id = $id;
 		$attachments = get_children( array( 'post_parent' => $id, 'post_status' => 'inherit', 'post_type' => 'attachment', 'post_mime_type' => 'image', 'order' => $atts['order'], 'orderby' => $atts['orderby'] ) );
 	}
 
+	if ( ! empty( $post_parent_id ) ) {
+		$post_parent = get_post( $post_parent_id );
+
+		// terminate the shortcode execution if user cannot read the post or password-protected
+		if (
+		( ! is_post_publicly_viewable( $post_parent->ID ) && ! current_user_can( 'read_post', $post_parent->ID ) )
+		|| post_password_required( $post_parent ) ) {
+			return '';
+		}
+	}
+
 	if ( empty( $attachments ) ) {
 		return '';
 	}
@@ -1326,6 +1339,15 @@ function wp_playlist_shortcode( $attr ) {
 		$attachments = get_children( $args );
 	}
 
+	if ( ! empty( $args['post_parent'] ) ) {
+		$post_parent = get_post( $id );
+
+		// terminate the shortcode execution if user cannot read the post or password-protected
+		if ( ! current_user_can( 'read_post', $post_parent->ID ) || post_password_required( $post_parent ) ) {
+			return '';
+		}
+	}
+
 	if ( empty( $attachments ) ) {
 		return '';
 	}

src/wp-includes/shortcodes.php

@@ -171,7 +171,45 @@ function has_shortcode( $content, $tag ) {
 }
 
 /**
- * Search content for shortcodes and filter shortcodes through their hooks.
+ * Returns a list of registered shortcode names found in the given content.
+ *
+ * Example usage:
+ *
+ *     get_shortcode_tags_in_content( '[audio src="file.mp3"][/audio] [foo] [gallery ids="1,2,3"]' );
+ *     // array( 'audio', 'gallery' )
+ *
+ * @since 6.3.2
+ *
+ * @param string $content The content to check.
+ * @return string[] An array of registered shortcode names found in the content.
+ */
+function get_shortcode_tags_in_content( $content ) {
+	if ( false === strpos( $content, '[' ) ) {
+		return array();
+	}
+
+	preg_match_all( '/' . get_shortcode_regex() . '/', $content, $matches, PREG_SET_ORDER );
+	if ( empty( $matches ) ) {
+		return array();
+	}
+
+	$tags = array();
+	foreach ( $matches as $shortcode ) {
+		$tags[] = $shortcode[2];
+
+		if ( ! empty( $shortcode[5] ) ) {
+			$deep_tags = get_shortcode_tags_in_content( $shortcode[5] );
+			if ( ! empty( $deep_tags ) ) {
+				$tags = array_merge( $tags, $deep_tags );
+			}
+		}
+	}
+
+	return $tags;
+}
+
+/**
+ * Searches content for shortcodes and filter shortcodes through their hooks.
  *
  * If there are no shortcode tags defined, then the content will be returned
  * without any filtering. This might cause issues when plugins are disabled but