diff --git a/wp-admin/load-scripts.php b/wp-admin/load-scripts.php
index b2e63b4394..f0a7efe76d 100644
--- a/wp-admin/load-scripts.php
+++ b/wp-admin/load-scripts.php
@@ -16,6 +16,7 @@ define( 'WPINC', 'wp-includes' );
$load = $_GET['load'];
if ( is_array( $load ) ) {
+ ksort( $load );
$load = implode( '', $load );
}
diff --git a/wp-admin/load-styles.php b/wp-admin/load-styles.php
index d6c5afc330..7ba0ce3247 100644
--- a/wp-admin/load-styles.php
+++ b/wp-admin/load-styles.php
@@ -20,8 +20,10 @@ require( ABSPATH . WPINC . '/version.php' );
$load = $_GET['load'];
if ( is_array( $load ) ) {
+ ksort( $load );
$load = implode( '', $load );
}
+
$load = preg_replace( '/[^a-z0-9,_-]+/i', '', $load );
$load = array_unique( explode( ',', $load ) );
diff --git a/wp-includes/script-loader.php b/wp-includes/script-loader.php
index f600fc5fb9..3de6291a03 100644
--- a/wp-includes/script-loader.php
+++ b/wp-includes/script-loader.php
@@ -2461,9 +2461,13 @@ function _print_scripts() {
}
$concat = str_split( $concat, 128 );
- $concat = 'load%5B%5D=' . implode( '&load%5B%5D=', $concat );
+ $concatenated = '';
- $src = $wp_scripts->base_url . "/wp-admin/load-scripts.php?c={$zip}&" . $concat . '&ver=' . $wp_scripts->default_version;
+ foreach ( $concat as $key => $chunk ) {
+ $concatenated .= "&load%5Bchunk_{$key}%5D={$chunk}";
+ }
+
+ $src = $wp_scripts->base_url . "/wp-admin/load-scripts.php?c={$zip}" . $concatenated . '&ver=' . $wp_scripts->default_version;
echo "\n";
}
@@ -2631,9 +2635,13 @@ function _print_styles() {
$ver = $wp_styles->default_version;
$concat = str_split( $concat, 128 );
- $concat = 'load%5B%5D=' . implode( '&load%5B%5D=', $concat );
+ $concatenated = '';
- $href = $wp_styles->base_url . "/wp-admin/load-styles.php?c={$zip}&dir={$dir}&" . $concat . '&ver=' . $ver;
+ foreach ( $concat as $key => $chunk ) {
+ $concatenated .= "&load%5Bchunk_{$key}%5D={$chunk}";
+ }
+
+ $href = $wp_styles->base_url . "/wp-admin/load-styles.php?c={$zip}&dir={$dir}" . $concatenated . '&ver=' . $ver;
echo "\n";
if ( ! empty( $wp_styles->print_code ) ) {
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 6682b204ca..08e074fc79 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -13,7 +13,7 @@
*
* @global string $wp_version
*/
-$wp_version = '5.3-alpha-45455';
+$wp_version = '5.3-alpha-45456';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.