Skip to content

Commit a44cc35

Browse files
whyisjakewhyisjake
committed
Backporting several bug fixes.
- Query: Remove the static query property. - HTTP API: Protect against hex interpretation. - Filesystem API: Prevent directory travelersals when creating new folders. - Administration: Ensure that admin referer nonce is valid. - REST API: Send a Vary: Origin header on GET requests. Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 5.0 branch. git-svn-id: https://develop.svn.wordpress.org/branches/5.0@46492 602fd350-edb4-49c9-b593-d223f7449a82
1 parent fad34f4 commit a44cc35

File tree

8 files changed

+80
-62
lines changed

8 files changed

+80
-62
lines changed

‎src/wp-includes/class-wp-query.php‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -529,7 +529,6 @@ public function fill_query_vars($array) {
529529
, 'attachment'
530530
, 'attachment_id'
531531
, 'name'
532-
, 'static'
533532
, 'pagename'
534533
, 'page_id'
535534
, 'second'
@@ -764,7 +763,7 @@ public function parse_query( $query = '' ) {
764763
// If year, month, day, hour, minute, and second are set, a single
765764
// post is being queried.
766765
$this->is_single = true;
767-
} elseif ( '' != $qv['static'] || '' != $qv['pagename'] || !empty($qv['page_id']) ) {
766+
} elseif ( '' != $qv['pagename'] || !empty($qv['page_id']) ) {
768767
$this->is_page = true;
769768
$this->is_single = false;
770769
} else {

‎src/wp-includes/class-wp.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ class WP {
1414
* @since 2.0.0
1515
* @var array
1616
*/
17-
public $public_query_vars = array('m', 'p', 'posts', 'w', 'cat', 'withcomments', 'withoutcomments', 's', 'search', 'exact', 'sentence', 'calendar', 'page', 'paged', 'more', 'tb', 'pb', 'author', 'order', 'orderby', 'year', 'monthnum', 'day', 'hour', 'minute', 'second', 'name', 'category_name', 'tag', 'feed', 'author_name', 'static', 'pagename', 'page_id', 'error', 'attachment', 'attachment_id', 'subpost', 'subpost_id', 'preview', 'robots', 'taxonomy', 'term', 'cpage', 'post_type', 'embed' );
17+
public $public_query_vars = array( 'm', 'p', 'posts', 'w', 'cat', 'withcomments', 'withoutcomments', 's', 'search', 'exact', 'sentence', 'calendar', 'page', 'paged', 'more', 'tb', 'pb', 'author', 'order', 'orderby', 'year', 'monthnum', 'day', 'hour', 'minute', 'second', 'name', 'category_name', 'tag', 'feed', 'author_name', 'pagename', 'page_id', 'error', 'attachment', 'attachment_id', 'subpost', 'subpost_id', 'preview', 'robots', 'taxonomy', 'term', 'cpage', 'post_type', 'embed' );
1818

1919
/**
2020
* Private query variables.

‎src/wp-includes/functions.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1621,6 +1621,11 @@ function wp_mkdir_p( $target ) {
16211621
if ( file_exists( $target ) )
16221622
return @is_dir( $target );
16231623

1624+
// Do not allow path traversals.
1625+
if ( false !== strpos( $target, '../' ) || false !== strpos( $target, '..' . DIRECTORY_SEPARATOR ) ) {
1626+
return false;
1627+
}
1628+
16241629
// We need to find the permissions of the parent folder that exists and inherit that.
16251630
$target_parent = dirname( $target );
16261631
while ( '.' != $target_parent && ! is_dir( $target_parent ) && dirname( $target_parent ) !== $target_parent ) {

‎src/wp-includes/http.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -541,8 +541,9 @@ function wp_http_validate_url( $url ) {
541541
$ip = $host;
542542
} else {
543543
$ip = gethostbyname( $host );
544-
if ( $ip === $host ) // Error condition for gethostbyname()
545-
$ip = false;
544+
if ( $ip === $host ) { // Error condition for gethostbyname()
545+
return false;
546+
}
546547
}
547548
if ( $ip ) {
548549
$parts = array_map( 'intval', explode( '.', $ip ) );

‎src/wp-includes/pluggable.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1083,7 +1083,7 @@ function auth_redirect() {
10831083
* 0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago.
10841084
*/
10851085
function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) {
1086-
if ( -1 == $action )
1086+
if ( -1 === $action )
10871087
_doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2.0' );
10881088

10891089
$adminurl = strtolower(admin_url());
@@ -1101,7 +1101,7 @@ function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) {
11011101
*/
11021102
do_action( 'check_admin_referer', $action, $result );
11031103

1104-
if ( ! $result && ! ( -1 == $action && strpos( $referer, $adminurl ) === 0 ) ) {
1104+
if ( ! $result && ! ( -1 === $action && strpos( $referer, $adminurl ) === 0 ) ) {
11051105
wp_nonce_ays( $action );
11061106
die();
11071107
}
@@ -2649,4 +2649,3 @@ function wp_text_diff( $left_string, $right_string, $args = null ) {
26492649
return $r;
26502650
}
26512651
endif;
2652-

‎src/wp-includes/rest-api.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -210,7 +210,7 @@ function create_initial_rest_routes() {
210210
$controller->register_routes();
211211

212212
// Taxonomies.
213-
$controller = new WP_REST_Taxonomies_Controller;
213+
$controller = new WP_REST_Taxonomies_Controller();
214214
$controller->register_routes();
215215

216216
// Terms.
@@ -573,7 +573,9 @@ function rest_send_cors_headers( $value ) {
573573
header( 'Access-Control-Allow-Origin: ' . $origin );
574574
header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
575575
header( 'Access-Control-Allow-Credentials: true' );
576-
header( 'Vary: Origin' );
576+
header( 'Vary: Origin', false );
577+
} elseif ( ! headers_sent() && 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
578+
header( 'Vary: Origin', false );
577579
}
578580

579581
return $value;

‎tests/phpunit/tests/auth.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,15 @@ public function test_check_admin_referer_with_no_action_triggers_doing_it_wrong(
163163
unset( $_REQUEST['_wpnonce'] );
164164
}
165165

166+
public function test_check_admin_referer_with_default_action_as_string_not_doing_it_wrong() {
167+
// A valid nonce needs to be set so the check doesn't die()
168+
$_REQUEST['_wpnonce'] = wp_create_nonce( '-1' );
169+
$result = check_admin_referer( '-1' );
170+
$this->assertSame( 1, $result );
171+
172+
unset( $_REQUEST['_wpnonce'] );
173+
}
174+
166175
/**
167176
* @ticket 36361
168177
*/

‎tests/phpunit/tests/query/vars.php‎

Lines changed: 55 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -16,61 +16,64 @@ public function testPublicQueryVarsAreAsExpected() {
1616
// Re-initialise any dynamically-added public query vars:
1717
do_action( 'init' );
1818

19-
$this->assertEquals( array(
19+
$this->assertEquals(
20+
array(
2021

21-
// Static public query vars:
22-
'm',
23-
'p',
24-
'posts',
25-
'w',
26-
'cat',
27-
'withcomments',
28-
'withoutcomments',
29-
's',
30-
'search',
31-
'exact',
32-
'sentence',
33-
'calendar',
34-
'page',
35-
'paged',
36-
'more',
37-
'tb',
38-
'pb',
39-
'author',
40-
'order',
41-
'orderby',
42-
'year',
43-
'monthnum',
44-
'day',
45-
'hour',
46-
'minute',
47-
'second',
48-
'name',
49-
'category_name',
50-
'tag',
51-
'feed',
52-
'author_name',
53-
'static',
54-
'pagename',
55-
'page_id',
56-
'error',
57-
'attachment',
58-
'attachment_id',
59-
'subpost',
60-
'subpost_id',
61-
'preview',
62-
'robots',
63-
'taxonomy',
64-
'term',
65-
'cpage',
66-
'post_type',
67-
'embed',
22+
// Static public query vars:
23+
'm',
24+
'p',
25+
'posts',
26+
'w',
27+
'cat',
28+
'withcomments',
29+
'withoutcomments',
30+
's',
31+
'search',
32+
'exact',
33+
'sentence',
34+
'calendar',
35+
'page',
36+
'paged',
37+
'more',
38+
'tb',
39+
'pb',
40+
'author',
41+
'order',
42+
'orderby',
43+
'year',
44+
'monthnum',
45+
'day',
46+
'hour',
47+
'minute',
48+
'second',
49+
'name',
50+
'category_name',
51+
'tag',
52+
'feed',
53+
'author_name',
54+
'pagename',
55+
'page_id',
56+
'error',
57+
'attachment',
58+
'attachment_id',
59+
'subpost',
60+
'subpost_id',
61+
'preview',
62+
'robots',
63+
'taxonomy',
64+
'term',
65+
'cpage',
66+
'post_type',
67+
'embed',
6868

69-
// Dynamically added public query vars:
70-
'post_format',
71-
'rest_route',
69+
// Dynamically added public query vars:
70+
'post_format',
71+
'rest_route',
7272

73-
), $wp->public_query_vars, 'Care should be taken when introducing new public query vars. See https://core.trac.wordpress.org/ticket/35115' );
73+
),
74+
$wp->public_query_vars,
75+
'Care should be taken when introducing new public query vars. See https://core.trac.wordpress.org/ticket/35115'
76+
);
7477
}
7578

7679
}

0 commit comments

Comments
 (0)