Changeset 13442

Timestamp:

04/03/2024 06:52:32 AM (6 months ago)

Author:

dd32

Message:

Theme Directory: Validate that the query input is a string before processing, to reduce the number of pentester warnings.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/theme-directory/theme-directory.php (modified) (4 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/theme-directory/theme-directory.php

@@ -846 +846 @@
 
     $request = array();
-    if ( get_query_var( 'browse' ) ) {
+    if ( get_query_var( 'browse' ) && is_string( get_query_var( 'browse' ) ) ) {
         $request['browse'] = get_query_var( 'browse' );
 
@@ -853 +853 @@
         }
 
-    } else if ( get_query_var( 'tag' ) ) {
+    } else if ( get_query_var( 'tag' ) && is_string( get_query_var( 'tag' ) ) ) {
         $request['tag'] = (array) explode( '+', get_query_var( 'tag' ) );
 
-    } else if ( get_query_var( 's' ) ) {
+    } else if ( get_query_var( 's' ) && is_string( get_query_var( 's' ) ) ) {
         $request['search'] = get_query_var( 's' );
 
@@ -863 +863 @@
 
     } else if ( get_query_var( 'name' ) || get_query_var( 'pagename' ) ) {
-        $request['theme'] = basename( get_query_var( 'name' ) ?: get_query_var( 'pagename' ) );
+        $name = get_query_var( 'name' ) ?: get_query_var( 'pagename' );
+        if ( is_string( $name ) ) {
+            $request['theme'] = basename( $name );
+        }
     }
 
     if ( get_query_var( 'paged' ) ) {
-        $request['page'] = (int)get_query_var( 'paged' );
+        $request['page'] = (int) get_query_var( 'paged' );
     }
 
@@ -924 +927 @@
 function wporg_themes_theme_information( $slug ) {
     return wporg_themes_query_api( 'theme_information', array(
-        'slug' => $slug,
+        'slug'   => $slug,
         'fields' => array(
             'description' => true,