Prevent drafts from being listed and disclosed

admin/panels/static/admin.static.delete.php

@@ -48,8 +48,8 @@ function ondelete() {
 		// Clean up input
 		$id = sanitize_text_field($this->page);
 
-		// Validate static pages directly here
-		if (empty($id) || !preg_match('/^[a-zA-Z0-9-_]+$/', $id)) {
+		// Keep the existing ASCII admin policy, but share the Core safety check.
+		if (empty($id) || !static_isvalid($id) || !preg_match('/^[a-zA-Z0-9-_]+$/', $id)) {
 			// Error status
 			$this->smarty->assign('success', -1);
 			return 1;

admin/panels/static/admin.static.write.php

@@ -125,7 +125,12 @@ function sanitizePageId($id) {
 			'/[^\p{L}\p{N}_-]/u'
 		], '', $id);
 
-		return trim(str_replace(' ', '', $id));
+		if (!is_string($id)) {
+			return '';
+		}
+
+		$id = trim(str_replace(' ', '', $id));
+		return static_isvalid($id) ? $id : '';
 	}
 
 	function makePageTitle($title, $sep) {

fp-includes/core/core.static.php

@@ -76,7 +76,15 @@ function static_parse($id) {
 }
 
 function static_isvalid($id) {
-	return preg_match('![^./\\\\]+!', $id);
+	if (!is_string($id) || $id === '') {
+		return false;
+	}
+
+	if (strpos($id, "\0") !== false) {
+		return false;
+	}
+
+	return preg_match('/\A[\p{L}\p{N}_-]+\z/u', $id) === 1;
 }
 
 function static_save($entry, $id, $oldid = null) {

fp-includes/fp-smartyplugins/validate_criteria.isValidEntryId.php

@@ -39,6 +39,7 @@ function smarty_validate_criteria_isValidEntryId($value, $empty, &$params, &$for
 		return false;
 	}
 
-	return !preg_match('/[^a-z0-9\-_]/i',$value);
+	// Keep the existing ASCII editor policy, but share the Core safety check.
+	return static_isvalid($value) && !preg_match('/[^a-z0-9\-_]/i', $value);
 }
 ?>

fp-plugins/prettyurls/plugin.prettyurls.php

@@ -137,6 +137,10 @@ function lastcomments_feed_link_atom($str) {
 	}
 
 	function staticlink($str, $id) {
+		if (!static_isvalid($id)) {
+			return $str;
+		}
+
 		return $this->baseurl . $id . "/";
 	}
 
@@ -226,8 +230,13 @@ function handle_date($matches) {
 	}
 
 	function handle_static($matches) {
+		if (!isset($matches [1]) || !static_isvalid($matches [1])) {
+			return isset($matches [0]) ? $matches [0] : '';
+		}
+
 		$this->fp_params ['page'] = $matches [1];
 		$this->status = 2;
+		return '';
 	}
 
 	function handle_entry($matches) {
@@ -1160,8 +1169,13 @@ function prettyurls_redirect_canonical() {
 			}
 			$target = $base . 'page/' . $pn . '/';
 		} elseif ($has_page) {
-			$id = preg_replace('/[^A-Za-z0-9_-]/', '', (string) $_GET ['page']);
-			if ($id === '') {
+			$rawId = (string) $_GET ['page'];
+			if (!static_isvalid($rawId)) {
+				return;
+			}
+
+			$id = preg_replace('/[^A-Za-z0-9_-]/', '', $rawId);
+			if ($id === '' || !static_isvalid($id)) {
 				return;
 			}
 			// Build via staticlink() to respect all modes

sitemap.php

@@ -61,6 +61,10 @@
 $statics = static_getlist();
 foreach ($statics as $currentstatic) {
 	$currentStaticData = static_parse($currentstatic);
+	if (!is_array($currentStaticData)) {
+		continue;
+	}
+
 	$loc = BLOG_BASEURL . '?page=' . $currentstatic;
 
 	// If current static has no date, use timestamp of now