From ea65ee36b2be6dc2c6b77837b637a85df27de6c8 Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov.ru@gmail.com>
Date: Tue, 16 May 2023 15:24:21 +0000
Subject: [PATCH] Grouped backports to the 4.2 branch.

- Media: Prevent CSRF setting attachment thumbnails.

Merges [55764] to the 4.2 branch.
Props dd32, isabel_brison, martinkrcho, matveb, ocean90, paulkevan, peterwilsoncc, timothyblynjacobs, xknown, youknowriad.
Built from https://develop.svn.wordpress.org/branches/4.2@55775


git-svn-id: http://core.svn.wordpress.org/branches/4.2@55287 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/about.php                 | 22 +++++++++++++++++++++-
 wp-admin/includes/ajax-actions.php |  4 ++++
 wp-includes/media.php              |  3 ++-
 wp-includes/version.php            |  2 +-
 4 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/wp-admin/about.php b/wp-admin/about.php
index ac9bf19a65..49d93e6d2d 100644
--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -41,7 +41,27 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 </h2>
 
 <div class="changelog point-releases">
-	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 34 ); ?></h3>
+	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 35 ); ?></h3>
+	<p>
+		<?php
+		printf(
+			/* translators: %s: WordPress version number */
+			__( '<strong>Version %1$s</strong> addressed a security issue.' ),
+			'4.2.35'
+		);
+		?>
+		<?php
+		printf(
+			/* translators: %s: HelpHub URL */
+			__( 'For more information, see <a href="%s">the release notes</a>.' ),
+			sprintf(
+				/* translators: %s: WordPress version */
+				esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+				sanitize_title( '4.2.35' )
+			)
+		);
+		?>
+	</p>
 	<p>
 		<?php
 		printf(
diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php
index fc643b82ad..374e3d2d81 100644
--- a/wp-admin/includes/ajax-actions.php
+++ b/wp-admin/includes/ajax-actions.php
@@ -2024,6 +2024,10 @@ function wp_ajax_set_attachment_thumbnail() {
 		wp_send_json_error();
 	}
 
+	if ( false === check_ajax_referer( 'set-attachment-thumbnail', '_ajax_nonce', false ) ) {
+		wp_send_json_error();
+	}
+
 	$post_ids = array();
 	// For each URL, try to find its corresponding post ID.
 	foreach ( $_POST['urls'] as $url ) {
diff --git a/wp-includes/media.php b/wp-includes/media.php
index 0272dcddfc..d44cabfac6 100644
--- a/wp-includes/media.php
+++ b/wp-includes/media.php
@@ -2951,7 +2951,8 @@ function wp_enqueue_media( $args = array() ) {
 		/** This filter is documented in wp-admin/includes/media.php */
 		'captions'  => ! apply_filters( 'disable_captions', '' ),
 		'nonce'     => array(
-			'sendToEditor' => wp_create_nonce( 'media-send-to-editor' ),
+			'sendToEditor'           => wp_create_nonce( 'media-send-to-editor' ),
+			'setAttachmentThumbnail' => wp_create_nonce( 'set-attachment-thumbnail' ),
 		),
 		'post'    => array(
 			'id' => 0,
diff --git a/wp-includes/version.php b/wp-includes/version.php
index eeb2473096..90f1e21b61 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.2.34';
+$wp_version = '4.2.35';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.