Skip to content

Commit f04772a

Browse files
whyisjakewhyisjake
committed
General: WordPress updates
* XML-RPC: Improve error messages for unprivileged users. * External Libraries: Disable deserialization in Requests_Utility_FilteredIterator * Embeds: Disable embeds on deactivated Multisite sites. * Coding standards: Modify escaping functions to avoid potential false positives. * XML-RPC: Return error message if attachment ID is incorrect. * Upgrade/install: Improve logic check when determining installation status. * Meta: Sanitize meta key before checking protection status. * Themes: Ensure that only privileged users can set a background image when a theme is using the deprecated custom background page. Brings the changes from [49380,49382-49388] to the 5.0 branch. Props xknown, zieladam, peterwilsoncc, whyisjake, desrosj, dd32. git-svn-id: https://develop.svn.wordpress.org/branches/5.0@49396 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 2579f5c commit f04772a

File tree

18 files changed

+146
-31
lines changed

18 files changed

+146
-31
lines changed

‎src/wp-admin/admin-header.php‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -75,13 +75,13 @@
7575
$admin_body_class = preg_replace('/[^a-z0-9_-]+/i', '-', $hook_suffix);
7676
?>
7777
<script type="text/javascript">
78-
addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
79-
var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
80-
pagenow = '<?php echo $current_screen->id; ?>',
81-
typenow = '<?php echo $current_screen->post_type; ?>',
82-
adminpage = '<?php echo $admin_body_class; ?>',
83-
thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
84-
decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
78+
addLoadEvent = function(func){if(typeof jQuery!=='undefined')jQuery(document).ready(func);else if(typeof wpOnload!=='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
79+
var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
80+
pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
81+
typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
82+
adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
83+
thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
84+
decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
8585
isRtl = <?php echo (int) is_rtl(); ?>;
8686
</script>
8787
<meta name="viewport" content="width=device-width,initial-scale=1.0">

‎src/wp-admin/custom-background.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -541,6 +541,7 @@ public function filter_upload_tabs( $tabs ) {
541541
* @deprecated 3.5.0
542542
*/
543543
public function wp_set_background_image() {
544+
check_ajax_referer( 'custom-background' );
544545
if ( ! current_user_can('edit_theme_options') || ! isset( $_POST['attachment_id'] ) ) exit;
545546
$attachment_id = absint($_POST['attachment_id']);
546547
/** This filter is documented in wp-admin/includes/media.php */

‎src/wp-admin/custom-header.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,7 +322,7 @@ public function js_1() {
322322
?>
323323
<script type="text/javascript">
324324
(function($){
325-
var default_color = '<?php echo $default_color; ?>',
325+
var default_color = '<?php echo esc_js( $default_color ); ?>',
326326
header_text_fields;
327327

328328
function pickColor(color) {

‎src/wp-admin/includes/media.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -473,7 +473,7 @@ function wp_iframe($content_func /* ... */) {
473473
?>
474474
<script type="text/javascript">
475475
addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
476-
var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
476+
var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
477477
isRtl = <?php echo (int) is_rtl(); ?>;
478478
</script>
479479
<?php

‎src/wp-admin/includes/ms.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -745,7 +745,7 @@ function can_edit_network( $network_id ) {
745745
function _thickbox_path_admin_subfolder() {
746746
?>
747747
<script type="text/javascript">
748-
var tb_pathToImage = "<?php echo includes_url( 'js/thickbox/loadingAnimation.gif', 'relative' ); ?>";
748+
var tb_pathToImage = "<?php echo esc_js( includes_url( 'js/thickbox/loadingAnimation.gif', 'relative' ) ); ?>";
749749
</script>
750750
<?php
751751
}

‎src/wp-admin/includes/template.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1783,12 +1783,12 @@ function iframe_header( $title = '', $deprecated = false ) {
17831783
<script type="text/javascript">
17841784
addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
17851785
function tb_close(){var win=window.dialogArguments||opener||parent||top;win.tb_remove();}
1786-
var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
1787-
pagenow = '<?php echo $current_screen->id; ?>',
1788-
typenow = '<?php echo $current_screen->post_type; ?>',
1789-
adminpage = '<?php echo $admin_body_class; ?>',
1790-
thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
1791-
decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
1786+
var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
1787+
pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
1788+
typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
1789+
adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
1790+
thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
1791+
decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
17921792
isRtl = <?php echo (int) is_rtl(); ?>;
17931793
</script>
17941794
<?php

‎src/wp-admin/js/custom-background.js‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,11 +122,13 @@
122122
frame.on( 'select', function() {
123123
// Grab the selected attachment.
124124
var attachment = frame.state().get('selection').first();
125+
var nonceValue = $( '#_wpnonce' ).val() || '';
125126

126127
// Run an AJAX request to set the background image.
127128
$.post( ajaxurl, {
128129
action: 'set-background-image',
129130
attachment_id: attachment.id,
131+
_ajax_nonce: nonceValue,
130132
size: 'full'
131133
}).done( function() {
132134
// When the request completes, reload the window.

‎src/wp-admin/js/media-gallery.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jQuery(function($) {
99
* Adds a click event handler to the element with a 'wp-gallery' class.
1010
*/
1111
$( 'body' ).bind( 'click.wp-gallery', function(e) {
12-
var target = $( e.target ), id, img_size;
12+
var target = $( e.target ), id, img_size, nonceValue;
1313

1414
if ( target.hasClass( 'wp-set-header' ) ) {
1515
// Opens the image to preview it full size.
@@ -19,13 +19,15 @@ jQuery(function($) {
1919
// Sets the image as background of the theme.
2020
id = target.data( 'attachment-id' );
2121
img_size = $( 'input[name="attachments[' + id + '][image-size]"]:checked').val();
22+
nonceValue = $( '#_wpnonce' ).val() && '';
2223

2324
/**
2425
* This AJAX action has been deprecated since 3.5.0, see custom-background.php
2526
*/
2627
jQuery.post(ajaxurl, {
2728
action: 'set-background-image',
2829
attachment_id: id,
30+
_ajax_nonce: nonceValue,
2931
size: img_size
3032
}, function() {
3133
var win = window.dialogArguments || opener || parent || top;

‎src/wp-admin/media-new.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,9 @@
7272
<?php media_upload_form(); ?>
7373

7474
<script type="text/javascript">
75-
var post_id = <?php echo $post_id; ?>, shortform = 3;
75+
var post_id = <?php echo absint( $post_id ); ?>, shortform = 3;
7676
</script>
77-
<input type="hidden" name="post_id" id="post_id" value="<?php echo $post_id; ?>" />
77+
<input type="hidden" name="post_id" id="post_id" value="<?php echo absint( $post_id ); ?>" />
7878
<?php wp_nonce_field('media-form'); ?>
7979
<div id="media-items" class="hide-if-no-js"></div>
8080
</form>

‎src/wp-admin/network/site-users.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,7 @@
211211
require( ABSPATH . 'wp-admin/admin-header.php' ); ?>
212212

213213
<script type="text/javascript">
214-
var current_site_id = <?php echo $id; ?>;
214+
var current_site_id = <?php echo absint( $id ); ?>;
215215
</script>
216216

217217

0 commit comments

Comments
 (0)