Changeset 13275

Timestamp:

03/05/2024 04:54:40 AM (17 months ago)

Author:

dd32

Message:

Plugin Directory: Readme Validator: Discard invalid inputs to avoid processing invalid readme's.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-readme-validator.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-readme-validator.php

@@ -21 +21 @@
             $readme_contents = '';
             if ( ! empty( $_REQUEST['readme'] ) && is_string( $_REQUEST['readme'] ) ) {
-                $readme_url = $_REQUEST['readme'];
+                $readme_url = wp_unslash( $_REQUEST['readme'] );
             }
             if ( ! empty( $_POST['readme_contents'] ) && is_string( $_POST['readme_contents'] ) ) {
-                $readme_contents = base64_decode( wp_unslash( $_POST['readme_contents'] ) );
+                $readme_contents = base64_decode( wp_unslash( $_POST['readme_contents'] ), true );
             }
             ?>
@@ -68 +68 @@
 
         } elseif ( ! empty( $_POST['readme_contents'] ) && is_string( $_POST['readme_contents'] ) ) {
-            $errors = Validator::instance()->validate_content( base64_decode( wp_unslash( $_REQUEST['readme_contents'] ) ) );
+            $contents = base64_decode( wp_unslash( $_REQUEST['readme_contents'] ), true );
+            if ( ! $contents ) {
+                return;
+            }
+
+            $errors = Validator::instance()->validate_content( $contents );
 
         } else {