From cde194a21e69f05830fd2456f30b2ac01d04975c Mon Sep 17 00:00:00 2001 From: Sergey Biryukov Date: Sat, 17 Aug 2019 13:59:55 +0000 Subject: [PATCH] Pings/Trackbacks: In `wp_xmlrpc_server::pingback_ping()`, strip inline JS and CSS while trying to figure out the pingback context. Props david.binda. Fixes #47283. Built from https://develop.svn.wordpress.org/trunk@45823 git-svn-id: http://core.svn.wordpress.org/trunk@45634 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/class-wp-xmlrpc-server.php | 5 ++++- wp-includes/version.php | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php index a8fad5fdbf..260c6f86dc 100644 --- a/wp-includes/class-wp-xmlrpc-server.php +++ b/wp-includes/class-wp-xmlrpc-server.php @@ -6880,7 +6880,10 @@ class wp_xmlrpc_server extends IXR_Server { return $this->pingback_error( 32, __( 'We cannot find a title on that page.' ) ); } - $remote_source = strip_tags( $remote_source, '' ); // just keep the tag we need + // Remove all script and style tags including their content. + $remote_source = preg_replace( '@<(script|style)[^>]*?>.*?@si', '', $remote_source ); + // Just keep the tag we need. + $remote_source = strip_tags( $remote_source, '' ); $p = explode( "\n\n", $remote_source ); diff --git a/wp-includes/version.php b/wp-includes/version.php index 5dedea8ea8..b859bab0e9 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -13,7 +13,7 @@ * * @global string $wp_version */ -$wp_version = '5.3-alpha-45822'; +$wp_version = '5.3-alpha-45823'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.