Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-12-23 01:27:36 +01:00
Code Issues Projects Releases Wiki Activity

Filesystem: Normalize allowed_files so comparison is apples to apples.

Browse Source 
In [58470] a change was made to normalize the filename in validate_file, however this leads to instances where the list of files that are allowed aren't normalized such as in the theme editor. By normalizing the array, the comparison is apples to apples.

Fixes #61488.
Props jorbin, hellofromtonya, swissspidy, misulicus, script2see, Presskopp, audrasjb, peterwilsoncc, siliconforks, littler.chicken, paulkevan,

Built from https://develop.svn.wordpress.org/trunk@58570


git-svn-id: http://core.svn.wordpress.org/trunk@58018 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Aaron Jorbin 2024-06-25 14:19:12 +00:00
parent 3b4a816522
commit 9da0418c41
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
wp-includes/functions.php
View File

@ -6199,8 +6199,10 @@ function validate_file( $file, $allowed_files = array() ) {
return 0;
}
// Normalize path for Windows servers
// Normalize path for Windows servers.
$file = wp_normalize_path( $file );
// Normalize path for $allowed_files as well so it's an apples to apples comparison.
$allowed_files = array_map( 'wp_normalize_path', $allowed_files );
// `../` on its own is not allowed:
if ( '../' === $file ) {

2
wp-includes/version.php
View File

@ -16,7 +16,7 @@
*
* @global string $wp_version
*/
$wp_version = '6.6-beta4-58569';
$wp_version = '6.6-beta4-58570';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.