Description: Media: Simplify upload error message construction.
 Fixes CVE-2017-9061 XSS when attempting to upload very large files
Author: swisspidy@wordpress.org
Origin: upstream, https://core.trac.wordpress.org/changeset/40743
Applied-Upstream: 4.7.5
Reviewed-by: Craig Small <csmall@debian.org>
Last-Update: 2017-05-19
--- a/wp-includes/js/plupload/handlers.js
+++ b/wp-includes/js/plupload/handlers.js
@@ -328,15 +328,24 @@
 	}
 }
 
-function uploadSizeError( up, file, over100mb ) {
-	var message;
+function uploadSizeError( up, file ) {
+	var message, errorDiv;
 
-	if ( over100mb )
-		message = pluploadL10n.big_upload_queued.replace('%s', file.name) + ' ' + pluploadL10n.big_upload_failed.replace('%1$s', '<a class="uploader-html" href="#">').replace('%2$s', '</a>');
-	else
-		message = pluploadL10n.file_exceeds_size_limit.replace('%s', file.name);
+	message = pluploadL10n.file_exceeds_size_limit.replace('%s', file.name);
 
-	jQuery('#media-items').append('<div id="media-item-' + file.id + '" class="media-item error"><p>' + message + '</p></div>');
+	// Construct the error div.
+	errorDiv = jQuery( '<div />' )
+		.attr( {
+			'id':    'media-item-' + file.id,
+			'class': 'media-item error'
+		} )
+		.append(
+			jQuery( '<p />' )
+				.text( message )
+		);
+
+	// Append the error.
+	jQuery('#media-items').append( errorDiv );
 	up.removeFile(file);
 }
 
