silentmode/sirius-press
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

merge: WordPress 7.1.2 into the vendored subtree

Browse source
This commit is contained in:
Silent Mode 2026-09-22 20:15:34 +02:00
parent 2287138149
commit 6a835fcfac
3 changed files with 93 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
wordpress/wp-admin/about.php
View file

@ -61,6 +61,26 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
<div class="about__section changelog has-subtle-background-color">
<div class="column">
<h2><?php _e( 'Maintenance and Security Releases' ); ?></h2>
<p>
<?php
printf(
/* translators: %s: WordPress version. */
__( '<strong>Version %s</strong> addressed one security issue.' ),
'7.1.2'
);
?>
<?php
printf(
/* translators: %s: HelpHub URL. */
__( 'For more information, see <a href="%s">the release notes</a>.' ),
sprintf(
/* translators: %s: WordPress version. */
esc_url( __( 'https://wordpress.org/documentation/wordpress-version/version-%s/' ) ),
sanitize_title( '7.1.2' )
)
);
?>
</p>
<p>
<?php
printf(

78
wordpress/wp-includes/template.php
View file

@ -490,7 +490,7 @@ function get_page_template() {
}
if ( $pagename ) {
$pagename_decoded = urldecode( $pagename );
if ( $pagename_decoded !== $pagename ) {
if ( $pagename_decoded !== $pagename && 0 === validate_file( $pagename_decoded ) ) {
$templates[] = "page-{$pagename_decoded}.php";
}
$templates[] = "page-{$pagename}.php";
@ -698,6 +698,67 @@ function wp_set_template_globals() {
$wp_template_path = get_template_directory();
}
/**
* Determines whether a template found by locate_template() may be loaded.
*
* @since 7.1.2
* @access private
*
* @global string $wp_stylesheet_path Path to current theme's stylesheet directory.
* @global string $wp_template_path Path to current theme's template directory.
*
* @param string $path Path to an existing template file.
* @return bool Whether the template may be loaded.
*/
function _wp_is_template_path_allowed( $path ) {
global $wp_stylesheet_path, $wp_template_path;
// A file path that exists and does not contain `..` is allowed.
if ( 0 === preg_match( '#(?:^|/)\.\.[. ]*(?:/|$)#', wp_normalize_path( $path ) ) ) {
return true;
}
// Resolve the true location of the requested file for later comparison.
$real_path = realpath( $path );
if ( false === $real_path ) {
return false;
}
$real_path = trailingslashit( wp_normalize_path( $real_path ) );
$directories = array(
$wp_stylesheet_path,
$wp_template_path,
ABSPATH . WPINC . '/theme-compat',
);
// If a theme is in a subdirectory, accept templates from its direct parent directory.
if ( str_contains( get_stylesheet(), '/' ) ) {
$directories[] = dirname( $wp_stylesheet_path );
}
// If a parent theme is in a subdirectory, accept templates from its direct parent directory.
if ( str_contains( get_template(), '/' ) ) {
$directories[] = dirname( $wp_template_path );
}
foreach ( $directories as $directory ) {
$real_directory = realpath( $directory );
if ( false === $real_directory ) {
continue;
}
// The true location of the requested file must be inside one of the allowed directories.
if ( str_starts_with( $real_path, trailingslashit( wp_normalize_path( $real_directory ) ) ) ) {
return true;
}
}
return false;
}
/**
* Retrieves the name of the highest priority template file that exists.
*
@ -707,6 +768,7 @@ function wp_set_template_globals() {
*
* @since 2.7.0
* @since 5.5.0 The `$args` parameter was added.
* @since 7.1.2 A template name containing `..` is only located if it resolves inside the theme.
*
* @global string $wp_stylesheet_path Path to current theme's stylesheet directory.
* @global string $wp_template_path Path to current theme's template directory.
@ -734,13 +796,17 @@ function locate_template( $template_names, $load = false, $load_once = true, $ar
continue;
}
if ( file_exists( $wp_stylesheet_path . '/' . $template_name ) ) {
$located = $wp_stylesheet_path . '/' . $template_name;
break;
$candidate = $wp_stylesheet_path . '/' . $template_name;
} elseif ( $is_child_theme && file_exists( $wp_template_path . '/' . $template_name ) ) {
$located = $wp_template_path . '/' . $template_name;
break;
$candidate = $wp_template_path . '/' . $template_name;
} elseif ( file_exists( ABSPATH . WPINC . '/theme-compat/' . $template_name ) ) {
$located = ABSPATH . WPINC . '/theme-compat/' . $template_name;
$candidate = ABSPATH . WPINC . '/theme-compat/' . $template_name;
} else {
continue;
}
if ( _wp_is_template_path_allowed( $candidate ) ) {
$located = $candidate;
break;
}
}

2
wordpress/wp-includes/version.php
View file

@ -16,7 +16,7 @@
*
* @global string $wp_version
*/
$wp_version = '7.1.1';
$wp_version = '7.1.2';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.