diff -r 34716fd837a4 -r be944660c56a wp/wp-admin/includes/class-custom-background.php --- a/wp/wp-admin/includes/class-custom-background.php Tue Dec 15 15:52:01 2020 +0100 +++ b/wp/wp-admin/includes/class-custom-background.php Wed Sep 21 18:19:35 2022 +0200 @@ -117,8 +117,10 @@ if ( isset( $_POST['reset-background'] ) ) { check_admin_referer( 'custom-background-reset', '_wpnonce-custom-background-reset' ); + remove_theme_mod( 'background_image' ); remove_theme_mod( 'background_image_thumb' ); + $this->updated = true; return; } @@ -126,8 +128,10 @@ if ( isset( $_POST['remove-background'] ) ) { // @todo Uploaded files are not removed here. check_admin_referer( 'custom-background-remove', '_wpnonce-custom-background-remove' ); + set_theme_mod( 'background_image', '' ); set_theme_mod( 'background_image_thumb', '' ); + $this->updated = true; wp_safe_redirect( $_POST['_wp_http_referer'] ); return; @@ -204,8 +208,10 @@ if ( isset( $_POST['background-color'] ) ) { check_admin_referer( 'custom-background' ); + $color = preg_replace( '/[^0-9a-fA-F]/', '', $_POST['background-color'] ); - if ( strlen( $color ) == 6 || strlen( $color ) == 3 ) { + + if ( strlen( $color ) === 6 || strlen( $color ) === 3 ) { set_theme_mod( 'background_color', $color ); } else { set_theme_mod( 'background_color', '' ); @@ -308,7 +314,7 @@ - + @@ -412,7 +418,7 @@
$input ) : ?> @@ -484,6 +490,7 @@ } check_admin_referer( 'custom-background-upload', '_wpnonce-custom-background-upload' ); + $overrides = array( 'test_form' => false ); $uploaded_file = $_FILES['import']; @@ -581,6 +588,8 @@ * @deprecated 3.5.0 */ public function wp_set_background_image() { + check_ajax_referer( 'custom-background' ); + if ( ! current_user_can( 'edit_theme_options' ) || ! isset( $_POST['attachment_id'] ) ) { exit; }