Changeset 15148

Timestamp:

09/04/2026 07:57:23 PM (2 weeks ago)

Author:

obenland

Message:

Photo Directory: refuse submitted shortcodes instead of editing them out

Closes ​https://github.com/WordPress/wordpress.org/pull/875.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/photo-directory/inc/uploads.php (modified) (3 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/photo-directory/inc/uploads.php

@@ -430 +430 @@
                                         $rejection = __( 'Your submission must be an image in the JPEG format.', 'wporg-photos' );
                                         break;
+                                case 'shortcode-in-text':
+                                        $rejection = __( 'The title, description, and caption cannot contain shortcodes. Please remove them and submit again.', 'wporg-photos' );
+                                        break;
                                 case 'file-too-large':
                                         $rejection = sprintf(
@@ -499 +502 @@
                         }
 
-                        $value = $sanitize( wp_unslash( $post_array[ $field ] ) );
-
-                        $post_array[ $field ] = wp_slash( strip_shortcodes( $value ) );
+                        $post_array[ $field ] = wp_slash( $sanitize( wp_unslash( $post_array[ $field ] ) ) );
                 }
 
@@ -701 +702 @@
                 if ( ! isset( $_POST['photo_license'] ) || ! $_POST['photo_license'] ) {
                         return 'checkbox_unchecked_license';
+                }
+
+                foreach ( [ 'post_title', 'post_content', 'post_excerpt' ] as $field ) {
+                        // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Read raw: sanitizing before the check would hide what it looks for.
+                        $submitted = isset( $_POST[ $field ] ) ? wp_unslash( $_POST[ $field ] ) : '';
+
+                        // A field can arrive as an array, which Frontend Uploader drops before it builds the post.
+                        if ( ! is_string( $submitted ) || '' === $submitted ) {
+                                continue;
+                        }
+
+                        if ( preg_match( '/' . get_shortcode_regex() . '/', $submitted ) ) {
+                                return 'shortcode-in-text';
+                        }
                 }