Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
34,157 Commits 48 Branches 718 Tags 891 MiB
Commit Graph

34157 Commits

Author SHA1 Message Date
Jeremy Felt 822cb35130 Media: Improve verification of MIME file types. 
Merges [43988] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@43993


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43825 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-12 23:11:21 +00:00
Aaron Campbell dce2bd647f Bump 4.5 branch to version 4.5.15 
Built from https://develop.svn.wordpress.org/branches/4.5@43411


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43239 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-07-05 16:12:28 +00:00
John Blackbourn cde3e1022a Media: Limit thumbnail file deletions to the same directory as the original file. 
Merges [43393] into the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@43397


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43225 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-07-05 14:55:23 +00:00
Aaron Campbell fff3ef94b7 Bump 4.5 branch to version 4.5.14 
Built from https://develop.svn.wordpress.org/branches/4.5@42937


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42767 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 20:29:32 +00:00
Dominik Schilling 3465fda2e7 Template: Make sure the version string is correctly escaped for use in attributes. 
Merge of [42893] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42921


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42751 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 16:08:10 +00:00
Dominik Schilling 52e15eb4d6 Meta: Simplify the delete all meta query in `delete_metadata()`. 
Merge of [42913] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42916


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42746 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 15:43:03 +00:00
Dominik Schilling 764b72595b HTTP: Don't treat `localhost` as same host by default. 
Merge of [42894] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42912


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42742 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 15:37:53 +00:00
Dominik Schilling f59a558d1f Login: Use `wp_safe_redirect()` when redirecting the login page if forced to use HTTPS. 
Merge of [42892] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42899


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42729 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 15:31:11 +00:00
Sergey Biryukov f3e648fc4b General: Update copyright year to 2018 in license.txt. 
Props rachelbaker.
Merges [42424] to the 4.5 branch.
Fixes #43007.
Built from https://develop.svn.wordpress.org/branches/4.5@42556


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42385 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-23 11:27:46 +00:00
Dion Hulse 466e565a32 Bump the 4.5 branch to 4.5.13. 
Built from https://develop.svn.wordpress.org/branches/4.5@42498


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42327 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 21:42:07 +00:00
Dion Hulse c5126cd06a External Libraries: Remove unnecessary / obsoleted MediaElement.js files. 
Merges [42478] to the 4.5 branch.
Fixes #42720 for 4.5.

Built from https://develop.svn.wordpress.org/branches/4.5@42481


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42310 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 08:08:33 +00:00
Dion Hulse fce8018006 Upgrade: When deleting old files, if deletion fails attempt to empty the file instead. 
Props joemcgill, dd32.
Merges [42434] to the 4.5 branch.
Fixes #42963 for 4.5.

Built from https://develop.svn.wordpress.org/branches/4.5@42469


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42298 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 06:56:04 +00:00
John Blackbourn c33337c395 Bump 4.5 branch to 4.5.12. 
Built from https://develop.svn.wordpress.org/branches/4.5@42320


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42149 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 19:00:32 +00:00
John Blackbourn db1e3afed0 Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability. 
Merges [42261] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42283


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42112 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:27:34 +00:00
John Blackbourn 8511c84d2c Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds. 
Merges [42260] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42282


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42111 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:27:01 +00:00
John Blackbourn cc28f09509 Hardening: Add escaping to the language attributes used on `html` elements. 
Merges [42259] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42281


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42110 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:26:31 +00:00
John Blackbourn f19b2b4635 Hardening: Use a properly generated hash for the `newbloguser` key instead of a determinate substring. 
Merges [42258] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42280


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42109 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:25:07 +00:00
Dion Hulse 4d65d6de5b WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined. 
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.5 branch.
Fixes #42431 and #42401 for 4.5.

Built from https://develop.svn.wordpress.org/branches/4.5@42233


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42062 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-27 01:10:32 +00:00
John Blackbourn 53e10c441b General: Remove the version number from the readme file in the 4.5 branch. 
See #42386

Built from https://develop.svn.wordpress.org/branches/4.5@42102


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41931 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 18:08:07 +00:00
Gary Pendergast 512427a740 Bump 4.5 branch to version 4.5.11. 
Built from https://develop.svn.wordpress.org/branches/4.5@42072


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41901 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 13:16:30 +00:00
Gary Pendergast 84b702009b Database: Restore numbered placeholders in `wpdb::prepare()`. 
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.

This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.

Merges [41662], [42056] to the 4.5 branch.
See #41925.


Built from https://develop.svn.wordpress.org/branches/4.5@42060


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41889 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 12:44:32 +00:00
Dominik Schilling df3d5cd1af Taxonomy/Users: Use correct escaping function for URLs. 
Merge of [41522] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41526


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41359 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 21:30:32 +00:00
Dominik Schilling 5047d9b8db Bump 4.5 branch to version 4.5.10. 
Built from https://develop.svn.wordpress.org/branches/4.5@41513


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41346 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 20:01:31 +00:00
Aaron Campbell 9007b3117b Database: Hardening to bring `wpdb::prepare()` inline with documentation. 
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.

Merges [41496] to 4.5 branch.


Built from https://develop.svn.wordpress.org/branches/4.5@41500


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41333 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 18:14:31 +00:00
Aaron Campbell 4b09915583 Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`. 
While `wpdb::prepare()` does not support null values (see #12819) they still appear in the wild like in the WordPress Importer and other plugins.

Merges [41483] to 4.5 branch.


Built from https://develop.svn.wordpress.org/branches/4.5@41487


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41320 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 16:23:33 +00:00
Aaron Campbell 644434666e Database: Hardening for `wpdb::prepare()` 
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

Merges [41470] to 4.5 branch.


Built from https://develop.svn.wordpress.org/branches/4.5@41474


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41307 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 15:01:07 +00:00
John Blackbourn 6208a0780c Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues. 
Merges [41457] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@41461


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41294 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 14:41:31 +00:00
Aaron Campbell f1c76c5532 oEmbed: Add extra hardening around allowed HTML for improved sandboxing. 
Merges [41448] to 4.5 branch.



Built from https://develop.svn.wordpress.org/branches/4.5@41454


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41287 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 13:50:32 +00:00
Dominik Schilling c3844666a2 TinyMCE: Improve the previews for shortcodes. 
Merge of [41395] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@41438


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41271 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 12:43:08 +00:00
Dominik Schilling cda7d5bac0 Customize: Ensure valid themes in the preview. 
Merge of [41397] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@41432


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41265 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 11:52:08 +00:00
Dominik Schilling b38f64fe94 Taxonomy/Users: Provide a fallback for incorrect HTTP referrers. 
Merge of [41398] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@41420


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41253 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 11:13:13 +00:00
John Blackbourn 367007e79a General: Remove context added in [41414] in order to avoid a string change in a point release. 
See #13377

Built from https://develop.svn.wordpress.org/branches/4.5@41416


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41249 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 10:46:31 +00:00
John Blackbourn 9d2e40d699 General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area. 
Merges [41414] into the 4.5. branch

See #13377

Built from https://develop.svn.wordpress.org/branches/4.5@41415


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41248 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 10:32:31 +00:00
Dominik Schilling 0d5353afbc Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog. 
Merge of [41393] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@41403


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41236 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 10:17:14 +00:00
John Blackbourn 030d6166f9 General: Backport PHP 7.1 fixes to the 4.5 branch to avoid fatal errors and warnings. 
Props simonvik, ayeshrajans

See #41135

Built from https://develop.svn.wordpress.org/branches/4.5@41128


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40968 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-07-24 22:25:32 +00:00
Konstantin Obenland 668efc78c0 Import Twenty Sixteen, default theme for 2016. 
See #36497.

Merges [40851] and [40852] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40858


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40709 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-31 01:29:32 +00:00
Aaron Campbell 9ab481b9e5 Bump 4.7 branch to version 4.5.9. 
Built from https://develop.svn.wordpress.org/branches/4.5@40750


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40608 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 21:50:02 +00:00
Pascal Birchler c2adcb9aec Media: Simplify upload error message construction. 
Merges [40736] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40739


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40597 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 18:02:32 +00:00
Aaron Campbell a6878209f8 Add nonce for updating file system credentials. 
Merges [40723] to 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40726


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40584 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 14:54:03 +00:00
Dominik Schilling 5046262be3 Customize: Ignore invalid customization sessions. 
Merge of [40704] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40707


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40570 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 12:16:31 +00:00
Pascal Birchler 62983e1dd2 Adjust post meta checks 
Merges [40692] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40695


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40558 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:50:31 +00:00
Pascal Birchler 8ce7f49c8d Whitelist post arguments in XML-RPC 
Merges [40677] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40680


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40543 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:20:31 +00:00
Pascal Birchler 26c585efa7 Bump 4.5 branch to version 4.5.8. 
Built from https://develop.svn.wordpress.org/branches/4.5@40489


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40365 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-04-20 16:23:33 +00:00
Pascal Birchler 4e293bfa45 Fix broken audio/video functions when sanitizing ID3 data 
This fixes a bug where running `wp_kses_post_deep()` on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40462


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40338 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-04-17 13:14:34 +00:00
James Nylen 5d48102386 Bump 4.5 branch to version 4.5.7. 
Built from https://develop.svn.wordpress.org/branches/4.5@40204


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40143 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 16:18:31 +00:00
John Blackbourn 806d303a20 Press This: Verify intent before fetching in-page resources using Press This. 
Props vortfu

Merges [40195] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40198


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40137 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 13:59:30 +00:00
Aaron Campbell a9f9235d88 Strip control characters before validating redirect. 
Merges [40183] to 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40186


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40125 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 13:42:04 +00:00
Aaron Campbell 10a2dd32cf Plugins: Add file check to plugin deletions. 
Merges [40169] to 4.5 branch.


Built from https://develop.svn.wordpress.org/branches/4.5@40172


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40111 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 13:00:33 +00:00
Dominik Schilling 4c805032cb Embeds: URL encode YouTube video IDs for broader compatibility. 
Merge of [40160] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40163


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40102 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 12:06:05 +00:00
Jeremy Felt d3d39735ce Validate video and audio metadata. 
Merge of [40148] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40151


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40090 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 08:05:33 +00:00