diff -r 34716fd837a4 -r be944660c56a wp/wp-admin/includes/class-custom-image-header.php
--- a/wp/wp-admin/includes/class-custom-image-header.php	Tue Dec 15 15:52:01 2020 +0100
+++ b/wp/wp-admin/includes/class-custom-image-header.php	Wed Sep 21 18:19:35 2022 +0200
@@ -71,6 +71,7 @@
 	 */
 	public function init() {
 		$page = add_theme_page( __( 'Header' ), __( 'Header' ), 'edit_theme_options', 'custom-header', array( $this, 'admin_page' ) );
+
 		if ( ! $page ) {
 			return;
 		}
@@ -80,6 +81,7 @@
 		add_action( "admin_head-{$page}", array( $this, 'help' ) );
 		add_action( "admin_head-{$page}", array( $this, 'take_action' ), 50 );
 		add_action( "admin_head-{$page}", array( $this, 'js' ), 50 );
+
 		if ( $this->admin_header_callback ) {
 			add_action( "admin_head-{$page}", $this->admin_header_callback, 51 );
 		}
@@ -141,7 +143,7 @@
 	 *
 	 * @since 2.6.0
 	 *
-	 * @return int Current step
+	 * @return int Current step.
 	 */
 	public function step() {
 		if ( ! isset( $_GET['step'] ) ) {
@@ -150,8 +152,8 @@
 
 		$step = (int) $_GET['step'];
 		if ( $step < 1 || 3 < $step ||
-			( 2 == $step && ! wp_verify_nonce( $_REQUEST['_wpnonce-custom-header-upload'], 'custom-header-upload' ) ) ||
-			( 3 == $step && ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'custom-header-crop-image' ) )
+			( 2 === $step && ! wp_verify_nonce( $_REQUEST['_wpnonce-custom-header-upload'], 'custom-header-upload' ) ) ||
+			( 3 === $step && ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'custom-header-crop-image' ) )
 		) {
 			return 1;
 		}
@@ -167,13 +169,13 @@
 	public function js_includes() {
 		$step = $this->step();
 
-		if ( ( 1 == $step || 3 == $step ) ) {
+		if ( ( 1 === $step || 3 === $step ) ) {
 			wp_enqueue_media();
 			wp_enqueue_script( 'custom-header' );
 			if ( current_theme_supports( 'custom-header', 'header-text' ) ) {
 				wp_enqueue_script( 'wp-color-picker' );
 			}
-		} elseif ( 2 == $step ) {
+		} elseif ( 2 === $step ) {
 			wp_enqueue_script( 'imgareaselect' );
 		}
 	}
@@ -186,9 +188,9 @@
 	public function css_includes() {
 		$step = $this->step();
 
-		if ( ( 1 == $step || 3 == $step ) && current_theme_supports( 'custom-header', 'header-text' ) ) {
+		if ( ( 1 === $step || 3 === $step ) && current_theme_supports( 'custom-header', 'header-text' ) ) {
 			wp_enqueue_style( 'wp-color-picker' );
-		} elseif ( 2 == $step ) {
+		} elseif ( 2 === $step ) {
 			wp_enqueue_style( 'imgareaselect' );
 		}
 	}
@@ -211,24 +213,32 @@
 
 		if ( isset( $_POST['resetheader'] ) ) {
 			check_admin_referer( 'custom-header-options', '_wpnonce-custom-header-options' );
+
 			$this->reset_header_image();
+
 			return;
 		}
 
 		if ( isset( $_POST['removeheader'] ) ) {
 			check_admin_referer( 'custom-header-options', '_wpnonce-custom-header-options' );
+
 			$this->remove_header_image();
+
 			return;
 		}
 
 		if ( isset( $_POST['text-color'] ) && ! isset( $_POST['display-header-text'] ) ) {
 			check_admin_referer( 'custom-header-options', '_wpnonce-custom-header-options' );
+
 			set_theme_mod( 'header_textcolor', 'blank' );
 		} elseif ( isset( $_POST['text-color'] ) ) {
 			check_admin_referer( 'custom-header-options', '_wpnonce-custom-header-options' );
+
 			$_POST['text-color'] = str_replace( '#', '', $_POST['text-color'] );
-			$color               = preg_replace( '/[^0-9a-fA-F]/', '', $_POST['text-color'] );
-			if ( strlen( $color ) == 6 || strlen( $color ) == 3 ) {
+
+			$color = preg_replace( '/[^0-9a-fA-F]/', '', $_POST['text-color'] );
+
+			if ( strlen( $color ) === 6 || strlen( $color ) === 3 ) {
 				set_theme_mod( 'header_textcolor', $color );
 			} elseif ( ! $color ) {
 				set_theme_mod( 'header_textcolor', 'blank' );
@@ -237,7 +247,9 @@
 
 		if ( isset( $_POST['default-header'] ) ) {
 			check_admin_referer( 'custom-header-options', '_wpnonce-custom-header-options' );
+
 			$this->set_header_image( $_POST['default-header'] );
+
 			return;
 		}
 	}
@@ -263,9 +275,19 @@
 		$this->default_headers    = $_wp_default_headers;
 		$template_directory_uri   = get_template_directory_uri();
 		$stylesheet_directory_uri = get_stylesheet_directory_uri();
+
 		foreach ( array_keys( $this->default_headers ) as $header ) {
-			$this->default_headers[ $header ]['url']           = sprintf( $this->default_headers[ $header ]['url'], $template_directory_uri, $stylesheet_directory_uri );
-			$this->default_headers[ $header ]['thumbnail_url'] = sprintf( $this->default_headers[ $header ]['thumbnail_url'], $template_directory_uri, $stylesheet_directory_uri );
+			$this->default_headers[ $header ]['url'] = sprintf(
+				$this->default_headers[ $header ]['url'],
+				$template_directory_uri,
+				$stylesheet_directory_uri
+			);
+
+			$this->default_headers[ $header ]['thumbnail_url'] = sprintf(
+				$this->default_headers[ $header ]['thumbnail_url'],
+				$template_directory_uri,
+				$stylesheet_directory_uri
+			);
 		}
 	}
 
@@ -297,10 +319,12 @@
 		}
 
 		echo '<div class="available-headers">';
+
 		foreach ( $headers as $header_key => $header ) {
 			$header_thumbnail = $header['thumbnail_url'];
 			$header_url       = $header['url'];
 			$header_alt_text  = empty( $header['alt_text'] ) ? '' : $header['alt_text'];
+
 			echo '<div class="default-header">';
 			echo '<label><input name="default-header" type="radio" value="' . esc_attr( $header_key ) . '" ' . checked( $header_url, get_theme_mod( 'header_image' ), false ) . ' />';
 			$width = '';
@@ -310,6 +334,7 @@
 			echo '<img src="' . set_url_scheme( $header_thumbnail ) . '" alt="' . esc_attr( $header_alt_text ) . '"' . $width . ' /></label>';
 			echo '</div>';
 		}
+
 		echo '<div class="clear"></div></div>';
 	}
 
@@ -320,9 +345,10 @@
 	 */
 	public function js() {
 		$step = $this->step();
-		if ( ( 1 == $step || 3 == $step ) && current_theme_supports( 'custom-header', 'header-text' ) ) {
+
+		if ( ( 1 === $step || 3 === $step ) && current_theme_supports( 'custom-header', 'header-text' ) ) {
 			$this->js_1();
-		} elseif ( 2 == $step ) {
+		} elseif ( 2 === $step ) {
 			$this->js_2();
 		}
 	}
@@ -343,7 +369,7 @@
 		?>
 <script type="text/javascript">
 (function($){
-	var default_color = '<?php echo $default_color; ?>',
+	var default_color = '<?php echo esc_js( $default_color ); ?>',
 		header_text_fields;
 
 	function pickColor(color) {
@@ -430,7 +456,9 @@
 			x2: xinit,
 			y2: yinit,
 			<?php
-			if ( ! current_theme_supports( 'custom-header', 'flex-height' ) && ! current_theme_supports( 'custom-header', 'flex-width' ) ) {
+			if ( ! current_theme_supports( 'custom-header', 'flex-height' )
+				&& ! current_theme_supports( 'custom-header', 'flex-width' )
+			) {
 				?>
 			aspectRatio: xinit + ':' + yinit,
 				<?php
@@ -550,9 +578,15 @@
 <td>
 	<p><?php _e( 'You can select an image to be shown at the top of your site by uploading from your computer or choosing from your media library. After selecting an image you will be able to crop it.' ); ?><br />
 			<?php
-			if ( ! current_theme_supports( 'custom-header', 'flex-height' ) && ! current_theme_supports( 'custom-header', 'flex-width' ) ) {
-				/* translators: 1: Image width in pixels, 2: Image height in pixels. */
-				printf( __( 'Images of exactly <strong>%1$d &times; %2$d pixels</strong> will be used as-is.' ) . '<br />', get_theme_support( 'custom-header', 'width' ), get_theme_support( 'custom-header', 'height' ) );
+			if ( ! current_theme_supports( 'custom-header', 'flex-height' )
+				&& ! current_theme_supports( 'custom-header', 'flex-width' )
+			) {
+				printf(
+					/* translators: 1: Image width in pixels, 2: Image height in pixels. */
+					__( 'Images of exactly <strong>%1$d &times; %2$d pixels</strong> will be used as-is.' ) . '<br />',
+					get_theme_support( 'custom-header', 'width' ),
+					get_theme_support( 'custom-header', 'height' )
+				);
 			} elseif ( current_theme_supports( 'custom-header', 'flex-height' ) ) {
 				if ( ! current_theme_supports( 'custom-header', 'flex-width' ) ) {
 					printf(
@@ -578,7 +612,10 @@
 					);
 				}
 			}
-			if ( current_theme_supports( 'custom-header', 'flex-height' ) || current_theme_supports( 'custom-header', 'flex-width' ) ) {
+
+			if ( current_theme_supports( 'custom-header', 'flex-height' )
+				|| current_theme_supports( 'custom-header', 'flex-width' )
+			) {
 				if ( current_theme_supports( 'custom-header', 'width' ) ) {
 					printf(
 						/* translators: %s: Size in pixels. */
@@ -590,6 +627,7 @@
 						)
 					);
 				}
+
 				if ( current_theme_supports( 'custom-header', 'height' ) ) {
 					printf(
 						/* translators: %s: Size in pixels. */
@@ -683,8 +721,13 @@
 			<?php
 	endif;
 
-		$default_image = sprintf( get_theme_support( 'custom-header', 'default-image' ), get_template_directory_uri(), get_stylesheet_directory_uri() );
-		if ( $default_image && get_header_image() != $default_image ) :
+		$default_image = sprintf(
+			get_theme_support( 'custom-header', 'default-image' ),
+			get_template_directory_uri(),
+			get_stylesheet_directory_uri()
+		);
+
+		if ( $default_image && get_header_image() !== $default_image ) :
 			?>
 <tr>
 <th scope="row"><?php _e( 'Reset Image' ); ?></th>
@@ -770,6 +813,7 @@
 	 */
 	public function step_2() {
 		check_admin_referer( 'custom-header-upload', '_wpnonce-custom-header-upload' );
+
 		if ( ! current_theme_supports( 'custom-header', 'uploads' ) ) {
 			wp_die(
 				'<h1>' . __( 'Something went wrong.' ) . '</h1>' .
@@ -791,15 +835,16 @@
 		}
 
 		if ( file_exists( $file ) ) {
-			list( $width, $height, $type, $attr ) = @getimagesize( $file );
+			list( $width, $height, $type, $attr ) = wp_getimagesize( $file );
 		} else {
 			$data   = wp_get_attachment_metadata( $attachment_id );
-			$height = isset( $data['height'] ) ? $data['height'] : 0;
-			$width  = isset( $data['width'] ) ? $data['width'] : 0;
+			$height = isset( $data['height'] ) ? (int) $data['height'] : 0;
+			$width  = isset( $data['width'] ) ? (int) $data['width'] : 0;
 			unset( $data );
 		}
 
 		$max_width = 0;
+
 		// For flex, limit size of image displayed to 1500px unless theme says otherwise.
 		if ( current_theme_supports( 'custom-header', 'flex-width' ) ) {
 			$max_width = 1500;
@@ -808,11 +853,15 @@
 		if ( current_theme_supports( 'custom-header', 'max-width' ) ) {
 			$max_width = max( $max_width, get_theme_support( 'custom-header', 'max-width' ) );
 		}
+
 		$max_width = max( $max_width, get_theme_support( 'custom-header', 'width' ) );
 
 		// If flexible height isn't supported and the image is the exact right size.
-		if ( ! current_theme_supports( 'custom-header', 'flex-height' ) && ! current_theme_supports( 'custom-header', 'flex-width' )
-			&& get_theme_support( 'custom-header', 'width' ) == $width && get_theme_support( 'custom-header', 'height' ) == $height ) {
+		if ( ! current_theme_supports( 'custom-header', 'flex-height' )
+			&& ! current_theme_supports( 'custom-header', 'flex-width' )
+			&& (int) get_theme_support( 'custom-header', 'width' ) === $width
+			&& (int) get_theme_support( 'custom-header', 'height' ) === $height
+		) {
 			// Add the metadata.
 			if ( file_exists( $file ) ) {
 				wp_update_attachment_metadata( $attachment_id, wp_generate_attachment_metadata( $attachment_id, $file ) );
@@ -833,7 +882,19 @@
 			return $this->finished();
 		} elseif ( $width > $max_width ) {
 			$oitar = $width / $max_width;
-			$image = wp_crop_image( $attachment_id, 0, 0, $width, $height, $max_width, $height / $oitar, false, str_replace( wp_basename( $file ), 'midsize-' . wp_basename( $file ), $file ) );
+
+			$image = wp_crop_image(
+				$attachment_id,
+				0,
+				0,
+				$width,
+				$height,
+				$max_width,
+				$height / $oitar,
+				false,
+				str_replace( wp_basename( $file ), 'midsize-' . wp_basename( $file ), $file )
+			);
+
 			if ( ! $image || is_wp_error( $image ) ) {
 				wp_die( __( 'Image could not be processed. Please go back and try again.' ), __( 'Image Processing Error' ) );
 			}
@@ -860,10 +921,10 @@
 		<img src="<?php echo esc_url( $url ); ?>" id="upload" width="<?php echo $width; ?>" height="<?php echo $height; ?>" alt="" />
 	</div>
 
-	<input type="hidden" name="x1" id="x1" value="0"/>
-	<input type="hidden" name="y1" id="y1" value="0"/>
-	<input type="hidden" name="width" id="width" value="<?php echo esc_attr( $width ); ?>"/>
-	<input type="hidden" name="height" id="height" value="<?php echo esc_attr( $height ); ?>"/>
+	<input type="hidden" name="x1" id="x1" value="0" />
+	<input type="hidden" name="y1" id="y1" value="0" />
+	<input type="hidden" name="width" id="width" value="<?php echo esc_attr( $width ); ?>" />
+	<input type="hidden" name="height" id="height" value="<?php echo esc_attr( $height ); ?>" />
 	<input type="hidden" name="attachment_id" id="attachment_id" value="<?php echo esc_attr( $attachment_id ); ?>" />
 	<input type="hidden" name="oitar" id="oitar" value="<?php echo esc_attr( $oitar ); ?>" />
 		<?php if ( empty( $_POST ) && isset( $_GET['file'] ) ) { ?>
@@ -874,7 +935,10 @@
 	<p class="submit">
 		<?php submit_button( __( 'Crop and Publish' ), 'primary', 'submit', false ); ?>
 		<?php
-		if ( isset( $oitar ) && 1 == $oitar && ( current_theme_supports( 'custom-header', 'flex-height' ) || current_theme_supports( 'custom-header', 'flex-width' ) ) ) {
+		if ( isset( $oitar ) && 1 === $oitar
+			&& ( current_theme_supports( 'custom-header', 'flex-height' )
+				|| current_theme_supports( 'custom-header', 'flex-width' ) )
+		) {
 			submit_button( __( 'Skip Cropping, Publish Image as Is' ), '', 'skip-cropping', false );
 		}
 		?>
@@ -895,6 +959,7 @@
 
 		$uploaded_file = $_FILES['import'];
 		$wp_filetype   = wp_check_filetype_and_ext( $uploaded_file['tmp_name'], $uploaded_file['name'] );
+
 		if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) ) {
 			wp_die( __( 'The uploaded file is not a valid image. Please try again.' ) );
 		}
@@ -921,6 +986,7 @@
 
 		// Save the data.
 		$attachment_id = wp_insert_attachment( $object, $file );
+
 		return compact( 'attachment_id', 'file', 'filename', 'url', 'type' );
 	}
 
@@ -942,7 +1008,10 @@
 			);
 		}
 
-		if ( ! empty( $_POST['skip-cropping'] ) && ! ( current_theme_supports( 'custom-header', 'flex-height' ) || current_theme_supports( 'custom-header', 'flex-width' ) ) ) {
+		if ( ! empty( $_POST['skip-cropping'] )
+			&& ! current_theme_supports( 'custom-header', 'flex-height' )
+			&& ! current_theme_supports( 'custom-header', 'flex-width' )
+		) {
 			wp_die(
 				'<h1>' . __( 'Something went wrong.' ) . '</h1>' .
 				'<p>' . __( 'The current theme does not support a flexible sized header image.' ) . '</p>',
@@ -970,7 +1039,15 @@
 		$width      = $dimensions['dst_width'];
 
 		if ( empty( $_POST['skip-cropping'] ) ) {
-			$cropped = wp_crop_image( $attachment_id, (int) $_POST['x1'], (int) $_POST['y1'], (int) $_POST['width'], (int) $_POST['height'], $width, $height );
+			$cropped = wp_crop_image(
+				$attachment_id,
+				(int) $_POST['x1'],
+				(int) $_POST['y1'],
+				(int) $_POST['width'],
+				(int) $_POST['height'],
+				$width,
+				$height
+			);
 		} elseif ( ! empty( $_POST['create-new-attachment'] ) ) {
 			$cropped = _copy_image_file( $attachment_id );
 		} else {
@@ -1028,10 +1105,12 @@
 		if ( ! current_user_can( 'edit_theme_options' ) ) {
 			wp_die( __( 'Sorry, you are not allowed to customize headers.' ) );
 		}
+
 		$step = $this->step();
-		if ( 2 == $step ) {
+
+		if ( 2 === $step ) {
 			$this->step_2();
-		} elseif ( 3 == $step ) {
+		} elseif ( 3 === $step ) {
 			$this->step_3();
 		} else {
 			$this->step_1();
@@ -1077,6 +1156,7 @@
 	final public function set_header_image( $choice ) {
 		if ( is_array( $choice ) || is_object( $choice ) ) {
 			$choice = (array) $choice;
+
 			if ( ! isset( $choice['attachment_id'] ) || ! isset( $choice['url'] ) ) {
 				return;
 			}
@@ -1092,21 +1172,24 @@
 			);
 
 			update_post_meta( $choice['attachment_id'], '_wp_attachment_is_custom_header', get_stylesheet() );
+
 			set_theme_mod( 'header_image', $choice['url'] );
 			set_theme_mod( 'header_image_data', $header_image_data );
+
 			return;
 		}
 
 		if ( in_array( $choice, array( 'remove-header', 'random-default-image', 'random-uploaded-image' ), true ) ) {
 			set_theme_mod( 'header_image', $choice );
 			remove_theme_mod( 'header_image_data' );
+
 			return;
 		}
 
 		$uploaded = get_uploaded_header_images();
+
 		if ( $uploaded && isset( $uploaded[ $choice ] ) ) {
 			$header_image_data = $uploaded[ $choice ];
-
 		} else {
 			$this->process_default_headers();
 			if ( isset( $this->default_headers[ $choice ] ) ) {
@@ -1144,11 +1227,12 @@
 			$this->remove_header_image();
 			return;
 		}
+
 		$default = sprintf( $default, get_template_directory_uri(), get_stylesheet_directory_uri() );
 
 		$default_data = array();
 		foreach ( $this->default_headers as $header => $details ) {
-			if ( $details['url'] == $default ) {
+			if ( $details['url'] === $default ) {
 				$default_data = $details;
 				break;
 			}
@@ -1223,7 +1307,7 @@
 		$parent_url = wp_get_attachment_url( $parent->ID );
 		$url        = str_replace( wp_basename( $parent_url ), wp_basename( $cropped ), $parent_url );
 
-		$size       = @getimagesize( $cropped );
+		$size       = wp_getimagesize( $cropped );
 		$image_type = ( $size ) ? $size['mime'] : 'image/jpeg';
 
 		$object = array(
@@ -1407,9 +1491,11 @@
 	public function customize_set_last_used( $wp_customize ) {
 
 		$header_image_data_setting = $wp_customize->get_setting( 'header_image_data' );
+
 		if ( ! $header_image_data_setting ) {
 			return;
 		}
+
 		$data = $header_image_data_setting->post_value();
 
 		if ( ! isset( $data['attachment_id'] ) ) {
@@ -1438,7 +1524,8 @@
 			return $this->default_headers;
 		}
 
-		$default             = sprintf( $default, get_template_directory_uri(), get_stylesheet_directory_uri() );
+		$default = sprintf( $default, get_template_directory_uri(), get_stylesheet_directory_uri() );
+
 		$already_has_default = false;
 
 		foreach ( $this->default_headers as $k => $h ) {