From 94aa7baeb29587bafbed2f698f902dfb17d2f1e2 Mon Sep 17 00:00:00 2001 From: Sergey Biryukov Date: Wed, 4 Sep 2019 16:29:27 +0000 Subject: [PATCH] Escape the output in `wp_ajax_upload_attachment()`. Merges [45936] to the 4.9 branch. Props whyisjake, sstoqnov. Built from https://develop.svn.wordpress.org/branches/4.9@45943 git-svn-id: http://core.svn.wordpress.org/branches/4.9@45754 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/async-upload.php | 2 +- wp-admin/includes/ajax-actions.php | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/wp-admin/async-upload.php b/wp-admin/async-upload.php index 2293fde811..d07f9865a3 100644 --- a/wp-admin/async-upload.php +++ b/wp-admin/async-upload.php @@ -22,7 +22,7 @@ if ( defined( 'ABSPATH' ) ) { require_once( ABSPATH . 'wp-admin/admin.php' ); -header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) ); +header( 'Content-Type: text/plain; charset=' . get_option( 'blog_charset' ) ); if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) { include( ABSPATH . 'wp-admin/includes/ajax-actions.php' ); diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php index b4b87cf1ca..a4389acce6 100644 --- a/wp-admin/includes/ajax-actions.php +++ b/wp-admin/includes/ajax-actions.php @@ -2070,7 +2070,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'Sorry, you are not allowed to upload files.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ) ) ); @@ -2084,7 +2084,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'Sorry, you are not allowed to attach files to this post.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ) ) ); @@ -2108,7 +2108,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'The uploaded file is not a valid image. Please try again.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ) ) ); @@ -2123,7 +2123,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => $attachment_id->get_error_message(), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ) ) );