merge: WordPress 7.1.2 into the vendored subtree

wordpress/wp-admin/about.php

@@ -61,6 +61,26 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
 		<div class="about__section changelog has-subtle-background-color">
 			<div class="column">
 				<h2><?php _e( 'Maintenance and Security Releases' ); ?></h2>
+				<p>
+					<?php
+					printf(
+						/* translators: %s: WordPress version. */
+						__( '<strong>Version %s</strong> addressed one security issue.' ),
+						'7.1.2'
+					);
+					?>
+					<?php
+					printf(
+						/* translators: %s: HelpHub URL. */
+						__( 'For more information, see <a href="%s">the release notes</a>.' ),
+						sprintf(
+							/* translators: %s: WordPress version. */
+							esc_url( __( 'https://wordpress.org/documentation/wordpress-version/version-%s/' ) ),
+							sanitize_title( '7.1.2' )
+						)
+					);
+					?>
+				</p>
 				<p>
 					<?php
 					printf(

wordpress/wp-includes/template.php

@@ -490,7 +490,7 @@ function get_page_template() {
 	}
 	if ( $pagename ) {
 		$pagename_decoded = urldecode( $pagename );
-		if ( $pagename_decoded !== $pagename ) {
+		if ( $pagename_decoded !== $pagename && 0 === validate_file( $pagename_decoded ) ) {
 			$templates[] = "page-{$pagename_decoded}.php";
 		}
 		$templates[] = "page-{$pagename}.php";
@@ -698,6 +698,67 @@ function wp_set_template_globals() {
 	$wp_template_path   = get_template_directory();
 }
 
+/**
+ * Determines whether a template found by locate_template() may be loaded.
+ *
+ * @since 7.1.2
+ * @access private
+ *
+ * @global string $wp_stylesheet_path Path to current theme's stylesheet directory.
+ * @global string $wp_template_path   Path to current theme's template directory.
+ *
+ * @param string $path Path to an existing template file.
+ * @return bool Whether the template may be loaded.
+ */
+function _wp_is_template_path_allowed( $path ) {
+	global $wp_stylesheet_path, $wp_template_path;
+
+	// A file path that exists and does not contain `..` is allowed.
+	if ( 0 === preg_match( '#(?:^|/)\.\.[. ]*(?:/|$)#', wp_normalize_path( $path ) ) ) {
+		return true;
+	}
+
+	// Resolve the true location of the requested file for later comparison.
+	$real_path = realpath( $path );
+
+	if ( false === $real_path ) {
+		return false;
+	}
+
+	$real_path = trailingslashit( wp_normalize_path( $real_path ) );
+
+	$directories = array(
+		$wp_stylesheet_path,
+		$wp_template_path,
+		ABSPATH . WPINC . '/theme-compat',
+	);
+
+	// If a theme is in a subdirectory, accept templates from its direct parent directory.
+	if ( str_contains( get_stylesheet(), '/' ) ) {
+		$directories[] = dirname( $wp_stylesheet_path );
+	}
+
+	// If a parent theme is in a subdirectory, accept templates from its direct parent directory.
+	if ( str_contains( get_template(), '/' ) ) {
+		$directories[] = dirname( $wp_template_path );
+	}
+
+	foreach ( $directories as $directory ) {
+		$real_directory = realpath( $directory );
+
+		if ( false === $real_directory ) {
+			continue;
+		}
+
+		// The true location of the requested file must be inside one of the allowed directories.
+		if ( str_starts_with( $real_path, trailingslashit( wp_normalize_path( $real_directory ) ) ) ) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
 /**
  * Retrieves the name of the highest priority template file that exists.
  *
@@ -707,6 +768,7 @@ function wp_set_template_globals() {
  *
  * @since 2.7.0
  * @since 5.5.0 The `$args` parameter was added.
+ * @since 7.1.2 A template name containing `..` is only located if it resolves inside the theme.
  *
  * @global string $wp_stylesheet_path Path to current theme's stylesheet directory.
  * @global string $wp_template_path   Path to current theme's template directory.
@@ -734,13 +796,17 @@ function locate_template( $template_names, $load = false, $load_once = true, $ar
 			continue;
 		}
 		if ( file_exists( $wp_stylesheet_path . '/' . $template_name ) ) {
-			$located = $wp_stylesheet_path . '/' . $template_name;
+			$candidate = $wp_stylesheet_path . '/' . $template_name;
-			break;
 		} elseif ( $is_child_theme && file_exists( $wp_template_path . '/' . $template_name ) ) {
-			$located = $wp_template_path . '/' . $template_name;
+			$candidate = $wp_template_path . '/' . $template_name;
-			break;
 		} elseif ( file_exists( ABSPATH . WPINC . '/theme-compat/' . $template_name ) ) {
-			$located = ABSPATH . WPINC . '/theme-compat/' . $template_name;
+			$candidate = ABSPATH . WPINC . '/theme-compat/' . $template_name;
+		} else {
+			continue;
+		}
+
+		if ( _wp_is_template_path_allowed( $candidate ) ) {
+			$located = $candidate;
 			break;
 		}
 	}

wordpress/wp-includes/version.php

@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.1.1';
+$wp_version = '7.1.2';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.