From 809137df1feaf00f1631b42e9a0cbe42e98a1f9e Mon Sep 17 00:00:00 2001 From: davidbaumwald Date: Thu, 12 Oct 2023 14:26:21 +0000 Subject: [PATCH] Grouped backports to the 4.2 branch. - Comments: Prevent users who can not see a post from seeing comments on it. - Shortcodes: Restrict ajax handler for media shortcode. - Prevent unintended behavior when certain objects are unserialized. Merges [56835], [56836], and [56838] to the 4.1 branch. Props xknown, jorbin, joehoyle, peterwilsoncc, ehtis, tykoted, antpb. Built from https://develop.svn.wordpress.org/branches/4.2@56851 git-svn-id: http://core.svn.wordpress.org/branches/4.2@56363 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/includes/ajax-actions.php | 18 ++++++++- .../includes/class-wp-comments-list-table.php | 13 ++++++ wp-admin/includes/class-wp-list-table.php | 14 +++++++ wp-admin/includes/dashboard.php | 14 ++++++- wp-includes/class-wp-theme.php | 34 ++++++++++++++++ wp-includes/media.php | 22 ++++++++++ wp-includes/shortcodes.php | 40 ++++++++++++++++++- 7 files changed, 151 insertions(+), 4 deletions(-) diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php index 374e3d2d81..d3eb82aaff 100644 --- a/wp-admin/includes/ajax-actions.php +++ b/wp-admin/includes/ajax-actions.php @@ -2799,13 +2799,29 @@ function wp_ajax_parse_media_shortcode() { $shortcode = wp_unslash( $_POST['shortcode'] ); + // Only process previews for media related shortcodes: + $found_shortcodes = get_shortcode_tags_in_content( $shortcode ); + $media_shortcodes = array( + 'audio', + 'embed', + 'playlist', + 'video', + 'gallery', + ); + + $other_shortcodes = array_diff( $found_shortcodes, $media_shortcodes ); + + if ( ! empty( $other_shortcodes ) ) { + wp_send_json_error(); + } + if ( ! empty( $_POST['post_ID'] ) ) { $post = get_post( (int) $_POST['post_ID'] ); } // the embed shortcode requires a post if ( ! $post || ! current_user_can( 'edit_post', $post->ID ) ) { - if ( 'embed' === $shortcode ) { + if ( in_array( 'embed', $found_shortcodes, true ) ) { wp_send_json_error(); } } else { diff --git a/wp-admin/includes/class-wp-comments-list-table.php b/wp-admin/includes/class-wp-comments-list-table.php index 863585473b..0959a9d669 100644 --- a/wp-admin/includes/class-wp-comments-list-table.php +++ b/wp-admin/includes/class-wp-comments-list-table.php @@ -370,6 +370,19 @@ class WP_Comments_List_Table extends WP_List_Table { $this->user_can = current_user_can( 'edit_comment', $comment->comment_ID ); + $edit_post_cap = $post ? 'edit_post' : 'edit_posts'; + if ( + current_user_can( $edit_post_cap, $comment->comment_post_ID ) || + ( + empty( $post->post_password ) && + current_user_can( 'read_post', $comment->comment_post_ID ) + ) + ) { + // The user has access to the post + } else { + return false; + } + echo ""; $this->single_row_columns( $comment ); echo "\n"; diff --git a/wp-admin/includes/class-wp-list-table.php b/wp-admin/includes/class-wp-list-table.php index aae3d697b5..f36b83f001 100644 --- a/wp-admin/includes/class-wp-list-table.php +++ b/wp-admin/includes/class-wp-list-table.php @@ -609,6 +609,20 @@ class WP_List_Table { protected function comments_bubble( $post_id, $pending_comments ) { $pending_phrase = sprintf( __( '%s pending' ), number_format( $pending_comments ) ); + $post_object = get_post( $post_id ); + $edit_post_cap = $post_object ? 'edit_post' : 'edit_posts'; + if ( + current_user_can( $edit_post_cap, $post_id ) || + ( + empty( $post_object->post_password ) && + current_user_can( 'read_post', $post_id ) + ) + ) { + // The user has access to the post and thus can see comments + } else { + return false; + } + if ( $pending_comments ) echo ''; diff --git a/wp-admin/includes/dashboard.php b/wp-admin/includes/dashboard.php index b7dda1323d..481f78e9b3 100644 --- a/wp-admin/includes/dashboard.php +++ b/wp-admin/includes/dashboard.php @@ -786,8 +786,18 @@ function wp_dashboard_recent_comments( $total_items = 5 ) { echo '

' . __( 'Comments' ) . '

'; echo '
'; - foreach ( $comments as $comment ) - _wp_dashboard_recent_comments_row( $comment ); + foreach ( $comments as $comment ) { + $comment_post = get_post( $comment->comment_post_ID ); + if ( + current_user_can( 'edit_post', $comment->comment_post_ID ) || + ( + empty( $comment_post->post_password ) && + current_user_can( 'read_post', $comment->comment_post_ID ) + ) + ) { + _wp_dashboard_recent_comments_row( $comment ); + } + } echo '
'; if ( current_user_can('edit_posts') ) diff --git a/wp-includes/class-wp-theme.php b/wp-includes/class-wp-theme.php index 5404827d63..f9b4e6ad09 100644 --- a/wp-includes/class-wp-theme.php +++ b/wp-includes/class-wp-theme.php @@ -476,6 +476,28 @@ final class WP_Theme implements ArrayAccess { return isset( $this->parent ) ? $this->parent : false; } + /** + * Perform reinitialization tasks. + * + * Prevents a callback from being injected during unserialization of an object. + * + * @return void + */ + public function __wakeup() { + if ( $this->parent && ! $this->parent instanceof self ) { + throw new UnexpectedValueException(); + } + if ( $this->headers && ! is_array( $this->headers ) ) { + throw new UnexpectedValueException(); + } + foreach ( $this->headers as $value ) { + if ( ! is_string( $value ) ) { + throw new UnexpectedValueException(); + } + } + $this->headers_sanitized = array(); + } + /** * Adds theme data to cache. * @@ -1235,4 +1257,16 @@ final class WP_Theme implements ArrayAccess { // Don't mark up; Do translate. return strnatcasecmp( $a->display( 'Name', false, true ), $b->display( 'Name', false, true ) ); } + + private static function _check_headers_property_has_correct_type( $headers ) { + if ( ! is_array( $headers ) ) { + return false; + } + foreach ( $headers as $key => $value ) { + if ( ! is_string( $key ) || ! is_string( $value ) ) { + return false; + } + } + return true; + } } diff --git a/wp-includes/media.php b/wp-includes/media.php index d44cabfac6..9906359fb5 100644 --- a/wp-includes/media.php +++ b/wp-includes/media.php @@ -1010,11 +1010,24 @@ function gallery_shortcode( $attr ) { $attachments[$val->ID] = $_attachments[$key]; } } elseif ( ! empty( $atts['exclude'] ) ) { + $post_parent_id = $id; $attachments = get_children( array( 'post_parent' => $id, 'exclude' => $atts['exclude'], 'post_status' => 'inherit', 'post_type' => 'attachment', 'post_mime_type' => 'image', 'order' => $atts['order'], 'orderby' => $atts['orderby'] ) ); } else { + $post_parent_id = $id; $attachments = get_children( array( 'post_parent' => $id, 'post_status' => 'inherit', 'post_type' => 'attachment', 'post_mime_type' => 'image', 'order' => $atts['order'], 'orderby' => $atts['orderby'] ) ); } + if ( ! empty( $post_parent_id ) ) { + $post_parent = get_post( $post_parent_id ); + + // terminate the shortcode execution if user cannot read the post or password-protected + if ( + ( ! is_post_publicly_viewable( $post_parent->ID ) && ! current_user_can( 'read_post', $post_parent->ID ) ) + || post_password_required( $post_parent ) ) { + return ''; + } + } + if ( empty( $attachments ) ) { return ''; } @@ -1305,6 +1318,15 @@ function wp_playlist_shortcode( $attr ) { $attachments = get_children( $args ); } + if ( ! empty( $args['post_parent'] ) ) { + $post_parent = get_post( $id ); + + // terminate the shortcode execution if user cannot read the post or password-protected + if ( ! current_user_can( 'read_post', $post_parent->ID ) || post_password_required( $post_parent ) ) { + return ''; + } + } + if ( empty( $attachments ) ) { return ''; } diff --git a/wp-includes/shortcodes.php b/wp-includes/shortcodes.php index 810db20076..3b86b763de 100644 --- a/wp-includes/shortcodes.php +++ b/wp-includes/shortcodes.php @@ -173,7 +173,45 @@ function has_shortcode( $content, $tag ) { } /** - * Search content for shortcodes and filter shortcodes through their hooks. + * Returns a list of registered shortcode names found in the given content. + * + * Example usage: + * + * get_shortcode_tags_in_content( '[audio src="file.mp3"][/audio] [foo] [gallery ids="1,2,3"]' ); + * // array( 'audio', 'gallery' ) + * + * @since 6.3.2 + * + * @param string $content The content to check. + * @return string[] An array of registered shortcode names found in the content. + */ +function get_shortcode_tags_in_content( $content ) { + if ( false === strpos( $content, '[' ) ) { + return array(); + } + + preg_match_all( '/' . get_shortcode_regex() . '/', $content, $matches, PREG_SET_ORDER ); + if ( empty( $matches ) ) { + return array(); + } + + $tags = array(); + foreach ( $matches as $shortcode ) { + $tags[] = $shortcode[2]; + + if ( ! empty( $shortcode[5] ) ) { + $deep_tags = get_shortcode_tags_in_content( $shortcode[5] ); + if ( ! empty( $deep_tags ) ) { + $tags = array_merge( $tags, $deep_tags ); + } + } + } + + return $tags; +} + +/** + * Searches content for shortcodes and filter shortcodes through their hooks. * * If there are no shortcode tags defined, then the content will be returned * without any filtering. This might cause issues when plugins are disabled but