Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
27,341 Commits 48 Branches 719 Tags 907 MiB
Commit Graph

27341 Commits

Author SHA1 Message Date
Dion Hulse 31b12793ea Bump the 4.0 branch to 4.0.22. 
Built from https://develop.svn.wordpress.org/branches/4.0@42503


git-svn-id: http://core.svn.wordpress.org/branches/4.0@42332 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 21:46:19 +00:00
Dion Hulse d6fc54f0f0 External Libraries: Remove unnecessary / obsoleted MediaElement.js files. 
Merges [42478] to the 4.0 branch.
Fixes #42720 for 4.0.

Built from https://develop.svn.wordpress.org/branches/4.0@42486


git-svn-id: http://core.svn.wordpress.org/branches/4.0@42315 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 08:14:22 +00:00
Dion Hulse c5ccc7cdfa Upgrade: When deleting old files, if deletion fails attempt to empty the file instead. 
Props joemcgill, dd32.
Merges [42434] to the 4.0 branch.
Fixes #42963 for 4.0.

Built from https://develop.svn.wordpress.org/branches/4.0@42474


git-svn-id: http://core.svn.wordpress.org/branches/4.0@42303 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 06:58:39 +00:00
John Blackbourn dcff9fb48a Bump 4.0 branch to version 4.0.21. 
Built from https://develop.svn.wordpress.org/branches/4.0@42325


git-svn-id: http://core.svn.wordpress.org/branches/4.0@42154 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 19:03:19 +00:00
John Blackbourn 80aef7ba67 Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability. 
Merges [42261] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@42303


git-svn-id: http://core.svn.wordpress.org/branches/4.0@42132 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:40:35 +00:00
John Blackbourn a44ccc633f Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds. 
Merges [42260] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@42302


git-svn-id: http://core.svn.wordpress.org/branches/4.0@42131 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:40:18 +00:00
John Blackbourn 5532a29f59 Hardening: Add escaping to the language attributes used on `html` elements. 
Merges [42259] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@42301


git-svn-id: http://core.svn.wordpress.org/branches/4.0@42130 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:39:05 +00:00
John Blackbourn c2be27457f Hardening: Use a properly generated hash for the `newbloguser` key instead of a determinate substring. 
Merges [42258] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@42300


git-svn-id: http://core.svn.wordpress.org/branches/4.0@42129 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:38:47 +00:00
Dion Hulse 6105b0dedb WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined. 
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.0 branch.
Fixes #42431 and #42401 for 4.0.

Built from https://develop.svn.wordpress.org/branches/4.0@42238


git-svn-id: http://core.svn.wordpress.org/branches/4.0@42067 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-27 01:14:18 +00:00
John Blackbourn 0c9b121594 General: Remove the version number from the readme file in the 4.0 branch. 
See #42386

Built from https://develop.svn.wordpress.org/branches/4.0@42096


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41925 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 18:02:19 +00:00
Gary Pendergast a9c82ac560 Bump 4.0 branch to version 4.0.20. 
Built from https://develop.svn.wordpress.org/branches/4.0@42077


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41906 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 13:44:19 +00:00
Gary Pendergast 907fe8136e Database: Restore numbered placeholders in `wpdb::prepare()`. 
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.

This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.

Merges [41662], [42056] to the 4.0 branch.
See #41925.


Built from https://develop.svn.wordpress.org/branches/4.0@42065


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41894 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 12:55:20 +00:00
Dominik Schilling 03aec8b402 Users: Use correct escaping function for URLs. 
Merge of [41522] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@41531


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41364 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 21:39:43 +00:00
Aaron Campbell 42af396f21 Bump 4.0 branch to version 4.0.19. 
Built from https://develop.svn.wordpress.org/branches/4.0@41518


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41351 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 20:10:20 +00:00
Aaron Campbell f10a53cf41 Database: Hardening to bring `wpdb::prepare()` inline with documentation. 
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.

Merges [41496] to 4.0 branch.


Built from https://develop.svn.wordpress.org/branches/4.0@41505


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41338 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 18:42:19 +00:00
Aaron Campbell a133648403 Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`. 
While `wpdb::prepare()` does not support null values (see #12819) they still appear in the wild like in the WordPress Importer and other plugins.

Merges [41483] to 4.0 branch.


Built from https://develop.svn.wordpress.org/branches/4.0@41492


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41325 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 16:26:35 +00:00
Aaron Campbell f80bd53e4b Database: Hardening for `wpdb::prepare()` 
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

Merges [41470] to 4.0 branch.


Built from https://develop.svn.wordpress.org/branches/4.0@41479


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41312 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 15:04:19 +00:00
John Blackbourn d29f744559 Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues. 
Merges [41457] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@41466


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41299 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 14:44:37 +00:00
John Blackbourn 9f5d4f74be General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area. 
Merges [41434] with changes to the 4.0 branch.

See #13377

Built from https://develop.svn.wordpress.org/branches/4.0@41447


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41280 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 13:42:20 +00:00
Dominik Schilling 4c6018f7ea TinyMCE: Improve the previews for shortcodes. 
Merge of [41395] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@41443


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41276 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 12:45:12 +00:00
Dominik Schilling ed1fb81c47 Users: Provide a fallback for incorrect HTTP referrers. 
Merge of [41398] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@41425


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41258 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 11:15:17 +00:00
Dominik Schilling 5fc965b084 Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog. 
Merge of [41393] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@41408


git-svn-id: http://core.svn.wordpress.org/branches/4.0@41241 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 10:20:09 +00:00
Aaron Campbell 395d3d7bfc Bump 4.0 branch to version 4.0.18. 
Built from https://develop.svn.wordpress.org/branches/4.0@40755


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40613 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 21:53:42 +00:00
Pascal Birchler 8f69071d2d Media: Simplify upload error message construction. 
Merges [40736] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@40744


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40602 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 18:05:18 +00:00
Aaron Campbell f27c1f06fe Add nonce for updating file system credentials. 
Merges [40723] to 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@40731


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40589 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 14:57:18 +00:00
Dominik Schilling 89a35259c0 Customize: Ignore invalid customization sessions. 
Merge of [40704] to the 4.0 branch.
Built from https://develop.svn.wordpress.org/branches/4.0@40712


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40575 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 12:20:43 +00:00
Pascal Birchler f7259c14e2 Adjust post meta checks 
Merges [40692] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@40700


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40563 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:53:37 +00:00
Pascal Birchler f35de85c64 Whitelist post arguments in XML-RPC 
Merges [40677] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@40685


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40548 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:27:19 +00:00
Pascal Birchler 7b33a67b95 Bump 4.0 branch to version 4.0.17. 
Built from https://develop.svn.wordpress.org/branches/4.0@40494


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40370 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-04-20 16:27:43 +00:00
Pascal Birchler 47b7dedef6 Fix broken audio/video functions when sanitizing ID3 data 
This fixes a bug where running `wp_kses_post_deep()` on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@40467


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40343 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-04-17 13:31:19 +00:00
James Nylen a40fe1c493 Bump 4.0 branch to version 4.0.16. 
Built from https://develop.svn.wordpress.org/branches/4.0@40209


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40148 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 16:39:19 +00:00
Aaron Campbell cd7144b8cd Strip control characters before validating redirect. 
Merges [40183] to 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@40191


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40130 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 13:45:44 +00:00
Aaron Campbell acbd361baf Plugins: Add file check to plugin deletions. 
Merges [40169] to 4.0 branch.


Built from https://develop.svn.wordpress.org/branches/4.0@40177


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40116 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 13:04:19 +00:00
Dominik Schilling 706528048b Embeds: URL encode YouTube video IDs for broader compatibility. 
Merge of [40160] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@40168


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40107 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 12:08:43 +00:00
Jeremy Felt 58440ac942 Validate video and audio metadata. 
Merge of [40148] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@40156


git-svn-id: http://core.svn.wordpress.org/branches/4.0@40095 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 08:11:19 +00:00
Aaron Campbell 25e87a205e Bump 4.0 branch to version 4.0.15. 
Built from https://develop.svn.wordpress.org/branches/4.0@40003


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39940 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-26 18:28:20 +00:00
John Blackbourn 18c516254c Posts, Post Types: When using Excerpt mode on the Posts list table, ensure the excerpt output matches what was manually entered into the Excerpt field. 
Merges [39956] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@39986


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39923 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-26 14:19:18 +00:00
Dominik Schilling 6c9f0e2e0f Press This: Do not show Categories & Tags UI for users who cannot assign terms to posts anyways. 
Merge of [39968] to the 4.0 branch.
Built from https://develop.svn.wordpress.org/branches/4.0@39978


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39915 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-26 14:14:44 +00:00
Dominik Schilling 98590a9c90 Query: Ensure that queries work correctly with post type names with special characters. 
Merge of [39952] to the 4.0 branch.
Built from https://develop.svn.wordpress.org/branches/4.0@39963


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39900 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-26 13:52:45 +00:00
Aaron Campbell 39566256f7 Bump 4.0 branch to version 4.0.14. 
Built from https://develop.svn.wordpress.org/branches/4.0@39867


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39804 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 16:59:18 +00:00
Joe McGill b236cbe16d Media: Fix exif_imagetype check in wp_get_image_mime 
This is a follow up to [39831].

Merges [39850] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@39858


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39795 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 16:44:41 +00:00
Joe McGill d94f5603fa Media: Improve image filetype checking. 
This adds a new function `wp_get_image_mime()` which is used by
`wp_check_filetype_and_ext()` to validate image files using
`exif_imagetype()` if available instead of `getimagesize()`.

`getimagesize()` is less performant than `exif_imagetype()` and is
dependent on GD. If `exif_imagetype()` is not available, it falls back to
`getimagesize()` as before.

If `wp_check_filetype_and_ext()` can't validate the filetype, we now return
`false` for ext/MIME values.

Merges [39831] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@39839


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39777 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 13:19:18 +00:00
Dominik Schilling 5fcb58d0cb Updates: Translate plugin data on the Updates screen. 
Merge of [39808] to the 4.0 branch.
Built from https://develop.svn.wordpress.org/branches/4.0@39827


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39765 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 11:43:08 +00:00
Dominik Schilling d8e0c202c5 Themes: Fix markup for theme name fallbacks. 
Merge of [39807] to the 4.0 branch.
Built from https://develop.svn.wordpress.org/branches/4.0@39816


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39754 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 11:12:39 +00:00
Jeremy Felt af786324a1 Multisite: Use `wp_rand()` in signup key creation. 
Merges [39795] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@39803


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39741 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 05:36:18 +00:00
Dion Hulse d04147c2d3 Update PHPMailer to 5.2.22. 
The full list of changes is available here:
https://github.com/PHPMailer/PHPMailer/compare/v5.2.21...v5.2.22

Merges [39759] to the 4.0 branch.
Fixes #37210 for 4.0.

Built from https://develop.svn.wordpress.org/branches/4.0@39791


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39729 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 05:26:18 +00:00
Jeremy Felt dbfc89db8e Mail: Disable wp-mail.php when `mailserver_url` is mail.example.com. 
Merges [39772] to the 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@39780


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39718 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 05:20:08 +00:00
Aaron Campbell 0f8124cdc6 Add nonce for widget accessibility mode. 
Props vortfu.

See #23328.

Merges [39765] to 4.0 branch.

Built from https://develop.svn.wordpress.org/branches/4.0@39768


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39706 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 01:51:19 +00:00
Dion Hulse 918f720050 Mail: Upgrade PHPMailer to 5.2.21. 
Merges [39645], [36083], [33142], [33124], [29783] to the 4.0 branch.
See #37210.

Built from https://develop.svn.wordpress.org/branches/4.0@39728


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39668 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-06 22:06:41 +00:00
Joe McGill e21c149861 Media: Improved media titles when created from filename. 
Preserves spaces and generally creates more accurate, cleaner titles from filenames of uploaded media.

Merge of [38615] to the 4.0 branch.

Fixes #37989.

Built from https://develop.svn.wordpress.org/branches/4.0@39716


git-svn-id: http://core.svn.wordpress.org/branches/4.0@39656 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-06 22:01:43 +00:00