From a04e391085379eba9f9788f08e2b95746bf07655 Mon Sep 17 00:00:00 2001 From: Sergey Biryukov Date: Wed, 4 Sep 2019 16:08:03 +0000 Subject: [PATCH] Escape the output in `wp_ajax_upload_attachment()`. Props whyisjake, sstoqnov. git-svn-id: https://develop.svn.wordpress.org/trunk@45936 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/async-upload.php | 2 +- src/wp-admin/includes/ajax-actions.php | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/wp-admin/async-upload.php b/src/wp-admin/async-upload.php index 32d650d2f3..4d37f7f644 100644 --- a/src/wp-admin/async-upload.php +++ b/src/wp-admin/async-upload.php @@ -22,7 +22,7 @@ if ( defined( 'ABSPATH' ) ) { require_once( ABSPATH . 'wp-admin/admin.php' ); -header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) ); +header( 'Content-Type: text/plain; charset=' . get_option( 'blog_charset' ) ); if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) { include( ABSPATH . 'wp-admin/includes/ajax-actions.php' ); diff --git a/src/wp-admin/includes/ajax-actions.php b/src/wp-admin/includes/ajax-actions.php index d9b688851e..7825d5cc09 100644 --- a/src/wp-admin/includes/ajax-actions.php +++ b/src/wp-admin/includes/ajax-actions.php @@ -2508,7 +2508,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'Sorry, you are not allowed to upload files.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ), ) ); @@ -2525,7 +2525,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'Sorry, you are not allowed to attach files to this post.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ), ) ); @@ -2552,7 +2552,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => __( 'The uploaded file is not a valid image. Please try again.' ), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ), ) ); @@ -2569,7 +2569,7 @@ function wp_ajax_upload_attachment() { 'success' => false, 'data' => array( 'message' => $attachment_id->get_error_message(), - 'filename' => $_FILES['async-upload']['name'], + 'filename' => esc_html( $_FILES['async-upload']['name'] ), ), ) );