Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

validate postId in the site-editor.php #7188

Open
wants to merge 13 commits into
base: trunk
Choose a base branch
from
Open

validate postId in the site-editor.php #7188

Changes from 9 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
4683dbe
validate postId in the site-editor.php
mi5t4n Aug 13, 2024
038bead
Merge branch 'WordPress:trunk' into fix/61796
mi5t4n Aug 23, 2024
84c3c8a
Ensure the post type is not wp_block
mi5t4n Aug 23, 2024
bb0bb39
Ensure the post type is not page.
mi5t4n Aug 23, 2024
8fd4278
Add a check to ensure `postType` exists before proceeding with the re…
mi5t4n Aug 23, 2024
a7b6460
Introduced $post_type_param variable with sanitize value of $_GET["po…
mi5t4n Aug 23, 2024
32b11c0
Bail early if postId and postType are not valid, so that the unnecess…
mi5t4n Aug 23, 2024
a0b8164
removed the new line.
mi5t4n Aug 23, 2024
fbcd239
Reuse and avoid a PHP error if the value is not set
hellofromtonya Oct 4, 2024
ff15ab1
Added a link to the site editor in wp_die() when the page does not ex…
mi5t4n Nov 25, 2024
64e135c
Added a link to the patterns page in wp_die() when the pattern does n…
mi5t4n Nov 25, 2024
25ecd75
Added a link to the templates page in wp_die() when the template does…
mi5t4n Nov 25, 2024
39669ab
Added a link to the template parts page in wp_die() when the template…
mi5t4n Nov 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 40 additions & 2 deletions src/wp-admin/site-editor.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,11 @@
);
}

$is_template_part = isset( $_GET['postType'] ) && 'wp_template_part' === sanitize_key( $_GET['postType'] );
$post_type_param = isset( $_GET['postType'] ) ? sanitize_key( wp_unslash( $_GET['postType'] ) ) : '';
$is_template_part = $post_type_param && 'wp_template_part' === $post_type_param;
$is_template_part_path = isset( $_GET['path'] ) && 'wp_template_partall' === sanitize_key( $_GET['path'] );
$is_template_part_editor = $is_template_part || $is_template_part_path;
$is_patterns = isset( $_GET['postType'] ) && 'wp_block' === sanitize_key( $_GET['postType'] );
$is_patterns = $post_type_param && 'wp_block' === $post_type_param;
$is_patterns_path = isset( $_GET['path'] ) && 'patterns' === sanitize_key( $_GET['path'] );
$is_patterns_editor = $is_patterns || $is_patterns_path;

Expand All @@ -34,6 +35,43 @@
}
}

// Validate postId and postType.
if ( isset( $_GET['postId'] ) && $post_type_param ) {
switch ( $post_type_param ) {
case 'page':
$post = get_post( (int) $_GET['postId'] );

if ( null === $post || 'page' !== get_post_type( $post ) ) {
wp_die( __( 'Invalid page ID.' ) );
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To help with the user's experience, please add the following as suggested by @peterwilsoncc :

Suggested change
wp_die( __( 'Invalid page ID.' ) );
wp_die(
__( 'Invalid page ID.' ),
'',
array(
'link_url' => admin_url( 'site-editor.php' ),
'link_text' => 'Return to site editor',
)
);

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolved ff15ab1

}
break;

case 'wp_block':
$post = get_post( (int) $_GET['postId'] );

if ( null === $post || 'wp_block' !== get_post_type( $post ) ) {
wp_die( __( 'Invalid pattern ID.' ) );
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here, but maybe should link to the Patterns page.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolved 64e135c

}
break;

case 'wp_template':
$block_template = get_block_template( $_GET['postId'] );
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Noting that $_GET['postId'] isn't sanitized here or in the next case.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This has been fixed


if ( null === $block_template ) {
wp_die( __( 'Invalid template ID.' ) );
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here, but maybe should link to the Templates page.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolved 25ecd75

}
break;

case 'wp_template_part':
$block_template = get_block_template( $_GET['postId'], 'wp_template_part' );

if ( null === $block_template ) {
wp_die( __( 'Invalid template part ID.' ) );
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here, but maybe should link to the Templates page.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolved 39669ab

}
break;
}
}

// Used in the HTML title tag.
$title = _x( 'Editor', 'site editor title tag' );
$parent_file = 'themes.php';
Expand Down
Loading