Changeset 62004 for branches/4.9/src/wp-admin/includes/file.php

Timestamp:

03/13/2026 12:57:21 PM (11 hours ago)

Author:

johnbillion

Message:

Grouped backports for the 4.9 branch.

• XML-RPC: Switch to wp_safe_remote() when fetching a pingback URL.
• HTML API: Prevent WP_HTML_Tag_Processor instances being unserialized and add some extra logic for validating pattern and template file paths.
• KSES: Optimize PCRE pattern detecting numeric character references.
• Customize: Improve escaping approach used for nav menu attributes.
• Media: Ensure the attachment parent is accessible to the user before showing a link to it in the media manager.
• Administration: Ensure client-side templates are only detected when they're correctly associated with a script tag.
• Filesystem API: Don't attempt to extract invalid files from a zip when using the PclZip library.

Merges [61879-61884,61886-61887,61890,61913] to the 4.9 branch.

Props johnbillion, xknown, dmsnell, jorbin, peterwilson, desrosj, westonruter, jonsurrell, audrasjb.

Location:

branches/4.9

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/file.php (modified) (1 diff)

branches/4.9/src/wp-admin/includes/file.php

@@ -1243 +1243 @@
             continue;
 
+        // Don't extract invalid files:
+        if ( 0 !== validate_file( $file['filename'] ) ) {
+            continue;
+        }
+
         $uncompressed_size += $file['size'];