Skip to content

Commit 62b9af9

Browse files
desrosjdesrosj
committed
Grouped backports for the 6.7 branch.
- XML-RPC: Switch to `wp_safe_remote()` when fetching a pingback URL. - HTML API: Prevent `WP_HTML_Tag_Processor` instances being unserialized and add some extra logic for validating pattern and template file paths. - KSES: Optimize PCRE pattern detecting numeric character references. - Customize: Improve escaping approach used for nav menu attributes. - Media: Ensure the attachment parent is accessible to the user before showing a link to it in the media manager. - Interactivity API: Skip binding event handler attributes. The corresponding `data-wp-on--` attribute should be used instead. - Administration: Ensure client-side templates are only detected when they're correctly associated with a script tag. - Filesystem API: Don't attempt to extract invalid files from a zip when using the PclZip library. - Comments: Don't attempt to create a note if the user cannot edit the target post. - Media: Disable XML entity substitution in getID3. Merges [61879-61890] to the 6.7 branch. Props johnbillion, xknown, dmsnell, jorbin, peterwilson, adamsilverstein, desrosj, luisherranz, ocean90, westonruter, jonsurrell, aurdasjb. git-svn-id: https://develop.svn.wordpress.org/branches/6.7@61902 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 74ec547 commit 62b9af9

14 files changed

Lines changed: 68 additions & 26 deletions

‎src/js/_enqueues/wp/util.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,11 @@ window.wp = window.wp || {};
3636
};
3737

3838
return function ( data ) {
39-
if ( ! document.getElementById( 'tmpl-' + id ) ) {
39+
var el = document.querySelector( 'script#tmpl-' + id );
40+
if ( ! el ) {
4041
throw new Error( 'Template not found: ' + '#tmpl-' + id );
4142
}
42-
compiled = compiled || _.template( $( '#tmpl-' + id ).html(), options );
43+
compiled = compiled || _.template( $( el ).html(), options );
4344
return compiled( data );
4445
};
4546
});

‎src/wp-admin/includes/class-walker-nav-menu-checklist.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -116,11 +116,11 @@ public function start_el( &$output, $data_object, $depth = 0, $args = null, $cur
116116
$output .= '<input type="hidden" class="menu-item-object" name="menu-item[' . $possible_object_id . '][menu-item-object]" value="' . esc_attr( $menu_item->object ) . '" />';
117117
$output .= '<input type="hidden" class="menu-item-parent-id" name="menu-item[' . $possible_object_id . '][menu-item-parent-id]" value="' . esc_attr( $menu_item->menu_item_parent ) . '" />';
118118
$output .= '<input type="hidden" class="menu-item-type" name="menu-item[' . $possible_object_id . '][menu-item-type]" value="' . esc_attr( $menu_item->type ) . '" />';
119-
$output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . esc_attr( $menu_item->title ) . '" />';
119+
$output .= '<input type="hidden" class="menu-item-title" name="menu-item[' . $possible_object_id . '][menu-item-title]" value="' . htmlspecialchars( $menu_item->title, ENT_QUOTES ) . '" />';
120120
$output .= '<input type="hidden" class="menu-item-url" name="menu-item[' . $possible_object_id . '][menu-item-url]" value="' . esc_attr( $menu_item->url ) . '" />';
121121
$output .= '<input type="hidden" class="menu-item-target" name="menu-item[' . $possible_object_id . '][menu-item-target]" value="' . esc_attr( $menu_item->target ) . '" />';
122-
$output .= '<input type="hidden" class="menu-item-attr-title" name="menu-item[' . $possible_object_id . '][menu-item-attr-title]" value="' . esc_attr( $menu_item->attr_title ) . '" />';
123-
$output .= '<input type="hidden" class="menu-item-classes" name="menu-item[' . $possible_object_id . '][menu-item-classes]" value="' . esc_attr( implode( ' ', $menu_item->classes ) ) . '" />';
124-
$output .= '<input type="hidden" class="menu-item-xfn" name="menu-item[' . $possible_object_id . '][menu-item-xfn]" value="' . esc_attr( $menu_item->xfn ) . '" />';
122+
$output .= '<input type="hidden" class="menu-item-attr-title" name="menu-item[' . $possible_object_id . '][menu-item-attr-title]" value="' . htmlspecialchars( $menu_item->attr_title, ENT_QUOTES ) . '" />';
123+
$output .= '<input type="hidden" class="menu-item-classes" name="menu-item[' . $possible_object_id . '][menu-item-classes]" value="' . htmlspecialchars( implode( ' ', $menu_item->classes ), ENT_QUOTES ) . '" />';
124+
$output .= '<input type="hidden" class="menu-item-xfn" name="menu-item[' . $possible_object_id . '][menu-item-xfn]" value="' . htmlspecialchars( $menu_item->xfn, ENT_QUOTES ) . '" />';
125125
}
126126
}

‎src/wp-admin/includes/class-walker-nav-menu-edit.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -203,13 +203,13 @@ public function start_el( &$output, $data_object, $depth = 0, $args = null, $cur
203203
<p class="description description-wide">
204204
<label for="edit-menu-item-title-<?php echo $item_id; ?>">
205205
<?php _e( 'Navigation Label' ); ?><br />
206-
<input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->title ); ?>" />
206+
<input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->title, ENT_QUOTES ); ?>" />
207207
</label>
208208
</p>
209209
<p class="field-title-attribute field-attr-title description description-wide">
210210
<label for="edit-menu-item-attr-title-<?php echo $item_id; ?>">
211211
<?php _e( 'Title Attribute' ); ?><br />
212-
<input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->post_excerpt ); ?>" />
212+
<input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->post_excerpt, ENT_QUOTES ); ?>" />
213213
</label>
214214
</p>
215215
<p class="field-link-target description">
@@ -222,20 +222,20 @@ public function start_el( &$output, $data_object, $depth = 0, $args = null, $cur
222222
<p class="field-css-classes description description-thin">
223223
<label for="edit-menu-item-classes-<?php echo $item_id; ?>">
224224
<?php _e( 'CSS Classes (optional)' ); ?><br />
225-
<input type="text" id="edit-menu-item-classes-<?php echo $item_id; ?>" class="widefat code edit-menu-item-classes" name="menu-item-classes[<?php echo $item_id; ?>]" value="<?php echo esc_attr( implode( ' ', $menu_item->classes ) ); ?>" />
225+
<input type="text" id="edit-menu-item-classes-<?php echo $item_id; ?>" class="widefat code edit-menu-item-classes" name="menu-item-classes[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( implode( ' ', $menu_item->classes ), ENT_QUOTES ); ?>" />
226226
</label>
227227
</p>
228228
<p class="field-xfn description description-thin">
229229
<label for="edit-menu-item-xfn-<?php echo $item_id; ?>">
230230
<?php _e( 'Link Relationship (XFN)' ); ?><br />
231-
<input type="text" id="edit-menu-item-xfn-<?php echo $item_id; ?>" class="widefat code edit-menu-item-xfn" name="menu-item-xfn[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $menu_item->xfn ); ?>" />
231+
<input type="text" id="edit-menu-item-xfn-<?php echo $item_id; ?>" class="widefat code edit-menu-item-xfn" name="menu-item-xfn[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $menu_item->xfn, ENT_QUOTES ); ?>" />
232232
</label>
233233
</p>
234234
</div>
235235
<p class="field-description description description-wide">
236236
<label for="edit-menu-item-description-<?php echo $item_id; ?>">
237237
<?php _e( 'Description' ); ?><br />
238-
<textarea id="edit-menu-item-description-<?php echo $item_id; ?>" class="widefat edit-menu-item-description" rows="3" cols="20" name="menu-item-description[<?php echo $item_id; ?>]"><?php echo esc_html( $menu_item->description ); // textarea_escaped ?></textarea>
238+
<textarea id="edit-menu-item-description-<?php echo $item_id; ?>" class="widefat edit-menu-item-description" rows="3" cols="20" name="menu-item-description[<?php echo $item_id; ?>]"><?php echo esc_textarea( $menu_item->description ); // textarea_escaped ?></textarea>
239239
<span class="description"><?php _e( 'The description will be displayed in the menu if the active theme supports it.' ); ?></span>
240240
</label>
241241
</p>
@@ -347,4 +347,4 @@ public function start_el( &$output, $data_object, $depth = 0, $args = null, $cur
347347
<?php
348348
$output .= ob_get_clean();
349349
}
350-
}
350+
}

‎src/wp-admin/includes/file.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1883,6 +1883,11 @@ function _unzip_file_pclzip( $file, $to, $needed_dirs = array() ) {
18831883
continue;
18841884
}
18851885

1886+
// Don't extract invalid files:
1887+
if ( 0 !== validate_file( $file['filename'] ) ) {
1888+
continue;
1889+
}
1890+
18861891
$uncompressed_size += $file['size'];
18871892

18881893
$needed_dirs[] = $to . untrailingslashit( $file['folder'] ? $file['filename'] : dirname( $file['filename'] ) );

‎src/wp-includes/ID3/getid3.lib.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@
1313

1414
if(!defined('GETID3_LIBXML_OPTIONS') && defined('LIBXML_VERSION')) {
1515
if(LIBXML_VERSION >= 20621) {
16-
define('GETID3_LIBXML_OPTIONS', LIBXML_NOENT | LIBXML_NONET | LIBXML_NOWARNING | LIBXML_COMPACT);
16+
define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOWARNING | LIBXML_COMPACT);
1717
} else {
18-
define('GETID3_LIBXML_OPTIONS', LIBXML_NOENT | LIBXML_NONET | LIBXML_NOWARNING);
18+
define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOWARNING);
1919
}
2020
}
2121

‎src/wp-includes/class-wp-block-patterns-registry.php‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,12 +173,21 @@ private function get_content( $pattern_name, $outside_init_only = false ) {
173173
} else {
174174
$patterns = &$this->registered_patterns;
175175
}
176-
if ( ! isset( $patterns[ $pattern_name ]['content'] ) && isset( $patterns[ $pattern_name ]['filePath'] ) ) {
176+
177+
$pattern_path = realpath( $patterns[ $pattern_name ]['filePath'] ?? '' );
178+
if (
179+
! isset( $patterns[ $pattern_name ]['content'] ) &&
180+
is_string( $pattern_path ) &&
181+
( str_ends_with( $pattern_path, '.php' ) || str_ends_with( $pattern_path, '.html' ) ) &&
182+
is_file( $pattern_path ) &&
183+
is_readable( $pattern_path )
184+
) {
177185
ob_start();
178186
include $patterns[ $pattern_name ]['filePath'];
179187
$patterns[ $pattern_name ]['content'] = ob_get_clean();
180188
unset( $patterns[ $pattern_name ]['filePath'] );
181189
}
190+
182191
return $patterns[ $pattern_name ]['content'];
183192
}
184193

‎src/wp-includes/class-wp-http-ixr-client.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ public function query( ...$args ) {
8989
echo '<pre class="ixr_request">' . htmlspecialchars( $xml ) . "\n</pre>\n\n";
9090
}
9191

92-
$response = wp_remote_post( $url, $args );
92+
$response = wp_safe_remote_post( $url, $args );
9393

9494
if ( is_wp_error( $response ) ) {
9595
$errno = $response->get_error_code();

‎src/wp-includes/html-api/class-wp-html-tag-processor.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4555,4 +4555,13 @@ public function get_doctype_info(): ?WP_HTML_Doctype_Info {
45554555
* @since 6.7.0
45564556
*/
45574557
const TEXT_IS_WHITESPACE = 'TEXT_IS_WHITESPACE';
4558+
4559+
/**
4560+
* Wakeup magic method.
4561+
*
4562+
* @since 6.9.2
4563+
*/
4564+
public function __wakeup() {
4565+
throw new \LogicException( __CLASS__ . ' should never be unserialized' );
4566+
}
45584567
}

‎src/wp-includes/interactivity-api/class-wp-interactivity-api.php‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -818,6 +818,20 @@ private function data_wp_bind_processor( WP_Interactivity_API_Directives_Process
818818
return;
819819
}
820820

821+
// Skip if the bound attribute is an event handler.
822+
if ( str_starts_with( $bound_attribute, 'on' ) ) {
823+
_doing_it_wrong(
824+
__METHOD__,
825+
sprintf(
826+
/* translators: %s: The directive, e.g. data-wp-on--click. */
827+
__( 'Binding event handler attributes is not supported. Please use "%s" instead.' ),
828+
esc_attr( 'data-wp-on--' . substr( $bound_attribute, 2 ) )
829+
),
830+
'x.y.z'
831+
);
832+
continue;
833+
}
834+
821835
$attribute_value = $p->get_attribute( $attribute_name );
822836
$result = $this->evaluate( $attribute_value );
823837

‎src/wp-includes/kses.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1962,8 +1962,8 @@ function wp_kses_normalize_entities( $content, $context = 'html' ) {
19621962
} else {
19631963
$content = preg_replace_callback( '/&amp;([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $content );
19641964
}
1965-
$content = preg_replace_callback( '/&amp;#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $content );
1966-
$content = preg_replace_callback( '/&amp;#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $content );
1965+
$content = preg_replace_callback( '/&amp;#(0*[1-9][0-9]{0,6});/', 'wp_kses_normalize_entities2', $content );
1966+
$content = preg_replace_callback( '/&amp;#[Xx](0*[1-9A-Fa-f][0-9A-Fa-f]{0,5});/', 'wp_kses_normalize_entities3', $content );
19671967

19681968
return $content;
19691969
}

0 commit comments

Comments
 (0)