From 131222c5872e125650aa7152f07b8cd98b8887e5 Mon Sep 17 00:00:00 2001 From: Sergey Biryukov Date: Wed, 4 Sep 2019 16:18:53 +0000 Subject: [PATCH] Escape the output in `wp_ajax_upload_attachment()`. Merges [45936] to the 5.1 branch. Props whyisjake, sstoqnov. Built from https://develop.svn.wordpress.org/branches/5.1@45939 git-svn-id: http://core.svn.wordpress.org/branches/5.1@45750 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/async-upload.php | 2 +- wp-admin/includes/ajax-actions.php | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/wp-admin/async-upload.php b/wp-admin/async-upload.php index d29884446d..81b0cc1a40 100644 --- a/wp-admin/async-upload.php +++ b/wp-admin/async-upload.php @@ -22,7 +22,7 @@ if ( defined( 'ABSPATH' ) ) { require_once( ABSPATH . 'wp-admin/admin.php' ); -header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) ); +header( 'Content-Type: text/plain; charset=' . get_option( 'blog_charset' ) ); if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) { include( ABSPATH . 'wp-admin/includes/ajax-actions.php' ); diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php index 90665bef05..6867cf2576 100644 --- a/wp-admin/includes/ajax-actions.php +++ b/wp-admin/includes/ajax-actions.php @@ -2303,7 +2303,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'Sorry, you are not allowed to upload files.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ), ) ); @@ -2319,7 +2319,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'Sorry, you are not allowed to attach files to this post.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ), ) ); @@ -2345,7 +2345,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'The uploaded file is not a valid image. Please try again.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ), ) ); @@ -2362,7 +2362,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => $attachment_id->get_error_message(), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ), ) );