From a2e8515544756c8de2a0a78d3180a92e73b37ab8 Mon Sep 17 00:00:00 2001 From: Rashed Hossain Date: Wed, 19 Aug 2026 15:27:46 +0600 Subject: [PATCH 1/2] WordPress.tv: Prevent stale nonce failure on subtitle uploads Prevent unauthenticated subtitle uploads with a valid username from failing due to stale or cached nonces, and send nocache headers on the subtitle upload page. Fixes https://meta.trac.wordpress.org/ticket/8406 Props sebastienserre, wprashed. --- .../wordpresstv-upload-subtitles.php | 8 +++++++- .../wp-content/themes/wptv2/upload-subtitles-template.php | 2 ++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-upload-subtitles/wordpresstv-upload-subtitles.php b/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-upload-subtitles/wordpresstv-upload-subtitles.php index 38a0194f4b..1d11d2d92c 100644 --- a/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-upload-subtitles/wordpresstv-upload-subtitles.php +++ b/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-upload-subtitles/wordpresstv-upload-subtitles.php @@ -103,7 +103,13 @@ function generate_filename( $file ) { * When the POST request is fired with the subtitles form and action. */ function post() { - if ( empty( $_POST['wptv-upload-subtitles-nonce'] ) || ! wp_verify_nonce( $_POST['wptv-upload-subtitles-nonce'], 'wptv-upload-subtitles' ) ) { + if ( + empty( $_POST['wptv-upload-subtitles-nonce'] ) || + ( + empty( $_POST['wptv_wporg_username'] ) && + ! wp_verify_nonce( $_POST['wptv-upload-subtitles-nonce'], 'wptv-upload-subtitles' ) + ) + ) { wp_die( 'Invalid form data. Please go back and try again.' ); } diff --git a/wordpress.tv/public_html/wp-content/themes/wptv2/upload-subtitles-template.php b/wordpress.tv/public_html/wp-content/themes/wptv2/upload-subtitles-template.php index ec221a5cee..b3be1253af 100644 --- a/wordpress.tv/public_html/wp-content/themes/wptv2/upload-subtitles-template.php +++ b/wordpress.tv/public_html/wp-content/themes/wptv2/upload-subtitles-template.php @@ -195,6 +195,8 @@ function subtitles_upload_css() { wp_die( 'You can not subtitle this video, sorry.' ); } +nocache_headers(); + get_header(); $message = ''; From 362dc83562f10d0908231b6749df91ecdc987944 Mon Sep 17 00:00:00 2001 From: Rashed Hossain Date: Wed, 19 Aug 2026 15:30:07 +0600 Subject: [PATCH 2/2] Sanitize and unslash nonce input --- .../wordpresstv-upload-subtitles.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-upload-subtitles/wordpresstv-upload-subtitles.php b/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-upload-subtitles/wordpresstv-upload-subtitles.php index 1d11d2d92c..63c975714d 100644 --- a/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-upload-subtitles/wordpresstv-upload-subtitles.php +++ b/wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-upload-subtitles/wordpresstv-upload-subtitles.php @@ -107,7 +107,7 @@ function post() { empty( $_POST['wptv-upload-subtitles-nonce'] ) || ( empty( $_POST['wptv_wporg_username'] ) && - ! wp_verify_nonce( $_POST['wptv-upload-subtitles-nonce'], 'wptv-upload-subtitles' ) + ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wptv-upload-subtitles-nonce'] ) ), 'wptv-upload-subtitles' ) ) ) { wp_die( 'Invalid form data. Please go back and try again.' );