diff --git a/wp-admin/async-upload.php b/wp-admin/async-upload.php index d29884446d..81b0cc1a40 100644 --- a/wp-admin/async-upload.php +++ b/wp-admin/async-upload.php @@ -22,7 +22,7 @@ if ( defined( 'ABSPATH' ) ) { require_once( ABSPATH . 'wp-admin/admin.php' ); -header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) ); +header( 'Content-Type: text/plain; charset=' . get_option( 'blog_charset' ) ); if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) { include( ABSPATH . 'wp-admin/includes/ajax-actions.php' ); diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php index 8389dcabcb..347afd7b59 100644 --- a/wp-admin/includes/ajax-actions.php +++ b/wp-admin/includes/ajax-actions.php @@ -2312,7 +2312,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'Sorry, you are not allowed to upload files.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ), ) ); @@ -2328,7 +2328,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'Sorry, you are not allowed to attach files to this post.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ), ) ); @@ -2354,7 +2354,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'The uploaded file is not a valid image. Please try again.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ), ) ); @@ -2371,7 +2371,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => $attachment_id->get_error_message(), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ), ) ); diff --git a/wp-includes/version.php b/wp-includes/version.php index 44cc8b31f8..ecf589b6fb 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -13,7 +13,7 @@ * * @global string $wp_version */ -$wp_version = '5.2.3-RC1-45937'; +$wp_version = '5.2.3-RC1-45938'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.