From 8fcbf67732313902f180e7fe454d80c47cd06e1a Mon Sep 17 00:00:00 2001 From: Sergey Biryukov Date: Wed, 4 Sep 2019 16:34:50 +0000 Subject: [PATCH] Escape the output in `wp_ajax_upload_attachment()`. Merges [45936] to the 4.7 branch. Props whyisjake, sstoqnov. git-svn-id: https://develop.svn.wordpress.org/branches/4.7@45947 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/async-upload.php | 2 +- src/wp-admin/includes/ajax-actions.php | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/wp-admin/async-upload.php b/src/wp-admin/async-upload.php index 4022b523a3..748458529e 100644 --- a/src/wp-admin/async-upload.php +++ b/src/wp-admin/async-upload.php @@ -32,7 +32,7 @@ if ( ! ( isset( $_REQUEST['action'] ) && 'upload-attachment' == $_REQUEST['actio require_once( ABSPATH . 'wp-admin/admin.php' ); -header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) ); +header( 'Content-Type: text/plain; charset=' . get_option( 'blog_charset' ) ); if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) { include( ABSPATH . 'wp-admin/includes/ajax-actions.php' ); diff --git a/src/wp-admin/includes/ajax-actions.php b/src/wp-admin/includes/ajax-actions.php index decf409e67..0511bbb4f3 100644 --- a/src/wp-admin/includes/ajax-actions.php +++ b/src/wp-admin/includes/ajax-actions.php @@ -2008,7 +2008,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'Sorry, you are not allowed to upload files.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ) ) ); @@ -2022,7 +2022,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'Sorry, you are not allowed to attach files to this post.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ) ) ); @@ -2046,7 +2046,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'The uploaded file is not a valid image. Please try again.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ) ) ); @@ -2061,7 +2061,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => $attachment_id->get_error_message(), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ) ) );