CVE-2017-5610: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2017-01-30T04:59Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-admin/includes/class-wp-press-this.php, wp-includes/version.php
Commit date: 2017-01-26 13:58:44 +0000
Commit message: Press This: Do not show Categories & Tags UI for users who cannot assign terms to posts anyways.
Built from https://develop.svn.wordpress.org/trunk@39968


git-svn-id: http://core.svn.wordpress.org/trunk@39905 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-admin/includes/class-wp-press-this.php b/wp-admin/includes/class-wp-press-this.php
index 71ce5153d3a..9527ef58536 100644
--- a/wp-admin/includes/class-wp-press-this.php
+++ b/wp-admin/includes/class-wp-press-this.php
@@ -117,14 +117,32 @@ class WP_Press_This {
 			'post_title'    => ( ! empty( $_POST['post_title'] ) ) ? sanitize_text_field( trim( $_POST['post_title'] ) ) : '',
 			'post_content'  => ( ! empty( $_POST['post_content'] ) ) ? trim( $_POST['post_content'] ) : '',
 			'post_type'     => 'post',
 			'post_status'   => 'draft',
 			'post_format'   => ( ! empty( $_POST['post_format'] ) ) ? sanitize_text_field( $_POST['post_format'] ) : '',
-			'tax_input'     => ( ! empty( $_POST['tax_input'] ) ) ? $_POST['tax_input'] : array(),
-			'post_category' => ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array(),
 		);
 
+		// Only accept categories if the user actually can assign
+		$category_tax = get_taxonomy( 'category' );
+		if ( current_user_can( $category_tax->cap->assign_terms ) ) {
+			$post_data['post_category'] = ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array();
+		}
+
+		// Only accept taxonomies if the user can actually assign
+		if ( ! empty( $_POST['tax_input'] ) ) {
+			$tax_input = $_POST['tax_input'];
+			foreach ( $tax_input as $tax => $_ti ) {
+				$tax_object = get_taxonomy( $tax );
+				if ( ! $tax_object || ! current_user_can( $tax_object->cap->assign_terms ) ) {
+					unset( $tax_input[ $tax ] );
+				}
+			}
+
+			$post_data['tax_input'] = $tax_input;
+		}
+
+		// Toggle status to pending if user cannot actually publish
 		if ( ! empty( $_POST['post_status'] ) && 'publish' === $_POST['post_status'] ) {
 			if ( current_user_can( 'publish_posts' ) ) {
 				$post_data['post_status'] = 'publish';
 			} else {
 				$post_data['post_status'] = 'pending';
@@ -451,11 +469,11 @@ class WP_Press_This {
 	 *
 	 * @ignore
 	 * @since 4.2.0
 	 *
 	 * @param string $src Embed source URL.
-	 * @return string If not from a supported provider, an empty string. Otherwise, a reformattd embed URL.
+	 * @return string If not from a supported provider, an empty string. Otherwise, a reformatted embed URL.
 	 */
 	private function _limit_embed( $src ) {
 		$src = $this->_limit_url( $src );
 
 		if ( empty( $src ) )
@@ -851,10 +869,16 @@ class WP_Press_This {
 	 * @param WP_Post $post Post object.
 	 */
 	public function categories_html( $post ) {
 		$taxonomy = get_taxonomy( 'category' );
 
+		// Bail if user cannot assign terms
+		if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) {
+			return;
+		}
+
+		// Only show "add" if user can edit terms
 		if ( current_user_can( $taxonomy->cap->edit_terms ) ) {
 			?>
 			<button type="button" class="add-cat-toggle button-link" aria-expanded="false">
 				<span class="dashicons dashicons-plus"></span><span class="screen-reader-text"><?php _e( 'Toggle add category' ); ?></span>
 			</button>
@@ -1270,10 +1294,16 @@ class WP_Press_This {
 		wp_enqueue_style( 'press-this' );
 		wp_enqueue_script( 'press-this' );
 		wp_enqueue_script( 'json2' );
 		wp_enqueue_script( 'editor' );
 
+		$categories_tax   = get_taxonomy( 'category' );
+		$show_categories  = current_user_can( $categories_tax->cap->assign_terms ) || current_user_can( $categories_tax->cap->edit_terms );
+
+		$tag_tax          = get_taxonomy( 'post_tag' );
+		$show_tags        = current_user_can( $tag_tax->cap->assign_terms );
+
 		$supports_formats = false;
 		$post_format      = 0;
 
 		if ( current_theme_supports( 'post-formats' ) && post_type_supports( $post->post_type, 'post-formats' ) ) {
 			$supports_formats = true;
@@ -1421,21 +1451,25 @@ class WP_Press_This {
 						<span class="post-option-contents" id="post-option-post-format"><?php echo esc_html( get_post_format_string( $post_format ) ); ?></span>
 						<span class="dashicons post-option-forward"></span>
 					</button>
 				<?php endif; ?>
 
-				<button type="button" class="button-link post-option">
-					<span class="dashicons dashicons-category"></span>
-					<span class="post-option-title"><?php _e( 'Categories' ); ?></span>
-					<span class="dashicons post-option-forward"></span>
-				</button>
-
-				<button type="button" class="button-link post-option">
-					<span class="dashicons dashicons-tag"></span>
-					<span class="post-option-title"><?php _e( 'Tags' ); ?></span>
-					<span class="dashicons post-option-forward"></span>
-				</button>
+				<?php if ( $show_categories ) : ?>
+					<button type="button" class="button-link post-option">
+						<span class="dashicons dashicons-category"></span>
+						<span class="post-option-title"><?php _e( 'Categories' ); ?></span>
+						<span class="dashicons post-option-forward"></span>
+					</button>
+				<?php endif; ?>
+
+				<?php if ( $show_tags ) : ?>
+					<button type="button" class="button-link post-option">
+						<span class="dashicons dashicons-tag"></span>
+						<span class="post-option-title"><?php _e( 'Tags' ); ?></span>
+						<span class="dashicons post-option-forward"></span>
+					</button>
+				<?php endif; ?>
 			</div>
 
 			<?php if ( $supports_formats ) : ?>
 				<div class="setting-modal is-off-screen is-hidden">
 					<button type="button" class="button-link modal-close">
@@ -1445,27 +1479,31 @@ class WP_Press_This {
 					</button>
 					<?php $this->post_formats_html( $post ); ?>
 				</div>
 			<?php endif; ?>
 
-			<div class="setting-modal is-off-screen is-hidden">
-				<button type="button" class="button-link modal-close">
-					<span class="dashicons post-option-back"></span>
-					<span class="setting-title" aria-hidden="true"><?php _e( 'Categories' ); ?></span>
-					<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
-				</button>
-				<?php $this->categories_html( $post ); ?>
-			</div>
+			<?php if ( $show_categories ) : ?>
+				<div class="setting-modal is-off-screen is-hidden">
+					<button type="button" class="button-link modal-close">
+						<span class="dashicons post-option-back"></span>
+						<span class="setting-title" aria-hidden="true"><?php _e( 'Categories' ); ?></span>
+						<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
+					</button>
+					<?php $this->categories_html( $post ); ?>
+				</div>
+			<?php endif; ?>
 
-			<div class="setting-modal tags is-off-screen is-hidden">
-				<button type="button" class="button-link modal-close">
-					<span class="dashicons post-option-back"></span>
-					<span class="setting-title" aria-hidden="true"><?php _e( 'Tags' ); ?></span>
-					<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
-				</button>
-				<?php $this->tags_html( $post ); ?>
-			</div>
+			<?php if ( $show_tags ) : ?>
+				<div class="setting-modal tags is-off-screen is-hidden">
+					<button type="button" class="button-link modal-close">
+						<span class="dashicons post-option-back"></span>
+						<span class="setting-title" aria-hidden="true"><?php _e( 'Tags' ); ?></span>
+						<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
+					</button>
+					<?php $this->tags_html( $post ); ?>
+				</div>
+			<?php endif; ?>
 		</div><!-- .options-panel -->
 	</div><!-- .wrapper -->
 
 	<div class="press-this-actions">
 		<div class="pressthis-media-buttons">
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 7cea374b4ad..3e9d9414817 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-39967';
+$wp_version = '4.8-alpha-39968';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 			'tax_input'     => ( ! empty( $_POST['tax_input'] ) ) ? $_POST['tax_input'] : array(),
			'post_category' => ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array(),
	 * @return string If not from a supported provider, an empty string. Otherwise, a reformattd embed URL.
				<button type="button" class="button-link post-option">
					<span class="dashicons dashicons-category"></span>
					<span class="post-option-title"><?php _e( 'Categories' ); ?></span>
					<span class="dashicons post-option-forward"></span>
				</button>

				<button type="button" class="button-link post-option">
					<span class="dashicons dashicons-tag"></span>
					<span class="post-option-title"><?php _e( 'Tags' ); ?></span>
					<span class="dashicons post-option-forward"></span>
				</button>
			<div class="setting-modal is-off-screen is-hidden">
				<button type="button" class="button-link modal-close">
					<span class="dashicons post-option-back"></span>
					<span class="setting-title" aria-hidden="true"><?php _e( 'Categories' ); ?></span>
					<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
				</button>
				<?php $this->categories_html( $post ); ?>
			</div>
			<div class="setting-modal tags is-off-screen is-hidden">
				<button type="button" class="button-link modal-close">
					<span class="dashicons post-option-back"></span>
					<span class="setting-title" aria-hidden="true"><?php _e( 'Tags' ); ?></span>
					<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
				</button>
				<?php $this->tags_html( $post ); ?>
			</div>
$wp_version = '4.8-alpha-39967';
Fixed code: 		// Only accept categories if the user actually can assign
		$category_tax = get_taxonomy( 'category' );
		if ( current_user_can( $category_tax->cap->assign_terms ) ) {
			$post_data['post_category'] = ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array();
		}

		// Only accept taxonomies if the user can actually assign
		if ( ! empty( $_POST['tax_input'] ) ) {
			$tax_input = $_POST['tax_input'];
			foreach ( $tax_input as $tax => $_ti ) {
				$tax_object = get_taxonomy( $tax );
				if ( ! $tax_object || ! current_user_can( $tax_object->cap->assign_terms ) ) {
					unset( $tax_input[ $tax ] );
				}
			}

			$post_data['tax_input'] = $tax_input;
		}

		// Toggle status to pending if user cannot actually publish
	 * @return string If not from a supported provider, an empty string. Otherwise, a reformatted embed URL.
		// Bail if user cannot assign terms
		if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) {
			return;
		}

		// Only show "add" if user can edit terms
		$categories_tax   = get_taxonomy( 'category' );
		$show_categories  = current_user_can( $categories_tax->cap->assign_terms ) || current_user_can( $categories_tax->cap->edit_terms );

		$tag_tax          = get_taxonomy( 'post_tag' );
		$show_tags        = current_user_can( $tag_tax->cap->assign_terms );

				<?php if ( $show_categories ) : ?>
					<button type="button" class="button-link post-option">
						<span class="dashicons dashicons-category"></span>
						<span class="post-option-title"><?php _e( 'Categories' ); ?></span>
						<span class="dashicons post-option-forward"></span>
					</button>
				<?php endif; ?>

				<?php if ( $show_tags ) : ?>
					<button type="button" class="button-link post-option">
						<span class="dashicons dashicons-tag"></span>
						<span class="post-option-title"><?php _e( 'Tags' ); ?></span>
						<span class="dashicons post-option-forward"></span>
					</button>
				<?php endif; ?>
			<?php if ( $show_categories ) : ?>
				<div class="setting-modal is-off-screen is-hidden">
					<button type="button" class="button-link modal-close">
						<span class="dashicons post-option-back"></span>
						<span class="setting-title" aria-hidden="true"><?php _e( 'Categories' ); ?></span>
						<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
					</button>
					<?php $this->categories_html( $post ); ?>
				</div>
			<?php endif; ?>
			<?php if ( $show_tags ) : ?>
				<div class="setting-modal tags is-off-screen is-hidden">
					<button type="button" class="button-link modal-close">
						<span class="dashicons post-option-back"></span>
						<span class="setting-title" aria-hidden="true"><?php _e( 'Tags' ); ?></span>
						<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
					</button>
					<?php $this->tags_html( $post ); ?>
				</div>
			<?php endif; ?>
$wp_version = '4.8-alpha-39968';