Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
34,975 Commits 48 Branches 718 Tags 891 MiB
Commit Graph

34975 Commits

Author SHA1 Message Date
Aaron Campbell 4f99911c22 Bump 4.6 branch to version 4.6.12 
Built from https://develop.svn.wordpress.org/branches/4.6@43410


git-svn-id: http://core.svn.wordpress.org/branches/4.6@43238 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-07-05 16:12:07 +00:00
John Blackbourn c656a7d373 Media: Limit thumbnail file deletions to the same directory as the original file. 
Merges [43393] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@43396


git-svn-id: http://core.svn.wordpress.org/branches/4.6@43224 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-07-05 14:53:26 +00:00
Aaron Campbell 5798a9e9ae Bump 4.6 branch to version 4.6.11 
Built from https://develop.svn.wordpress.org/branches/4.6@42936


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42766 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 20:28:04 +00:00
Dominik Schilling 1a13b0102b Template: Make sure the version string is correctly escaped for use in attributes. 
Merge of [42893] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42920


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42750 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 16:07:40 +00:00
Dominik Schilling c1af867a7c Meta: Simplify the delete all meta query in `delete_metadata()`. 
Merge of [42913] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42915


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42745 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 15:42:32 +00:00
Dominik Schilling 5a4e8a9b94 HTTP: Don't treat `localhost` as same host by default. 
Merge of [42894] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42911


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42741 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 15:37:22 +00:00
Dominik Schilling bf1163226c Login: Use `wp_safe_redirect()` when redirecting the login page if forced to use HTTPS. 
Merge of [42892] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42898


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42728 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 15:30:40 +00:00
Sergey Biryukov cf43545c07 General: Update copyright year to 2018 in license.txt. 
Props rachelbaker.
Merges [42424] to the 4.6 branch.
Fixes #43007.
Built from https://develop.svn.wordpress.org/branches/4.6@42555


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42384 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-23 11:27:13 +00:00
Dion Hulse daf7cc8b30 Bump the 4.6 branch to 4.6.10. 
Built from https://develop.svn.wordpress.org/branches/4.6@42497


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42326 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 21:41:36 +00:00
Dion Hulse ce6ffb6d25 External Libraries: Remove unnecessary / obsoleted MediaElement.js files. 
Merges [42478] to the 4.6 branch.
Fixes #42720 for 4.6.

Built from https://develop.svn.wordpress.org/branches/4.6@42480


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42309 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 08:06:35 +00:00
Dion Hulse cf61ff994d Upgrade: When deleting old files, if deletion fails attempt to empty the file instead. 
Props joemcgill, dd32.
Merges [42434] to the 4.6 branch.
Fixes #42963 for 4.6.

Built from https://develop.svn.wordpress.org/branches/4.6@42468


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42297 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 06:55:34 +00:00
John Blackbourn 8b0e75a650 Bump 4.6 branch to version 4.6.9. 
Built from https://develop.svn.wordpress.org/branches/4.6@42319


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42148 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 18:59:35 +00:00
John Blackbourn 969ac61dc4 Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability. 
Merges [42261] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42279


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42108 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:24:34 +00:00
John Blackbourn ed0c328547 Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds. 
Merges [42260] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42278


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42107 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:23:06 +00:00
John Blackbourn 22068f006c Hardening: Add escaping to the language attributes used on `html` elements. 
Merges [42259] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42277


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42106 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:22:33 +00:00
John Blackbourn 78c7ec883d Hardening: Use a properly generated hash for the `newbloguser` key instead of a determinate substring. 
Merges [42258] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42276


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42105 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:21:34 +00:00
Dion Hulse 551d27db59 WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined. 
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.6 branch.
Fixes #42431 and #42401 for 4.6.

Built from https://develop.svn.wordpress.org/branches/4.6@42232


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42061 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-27 01:09:36 +00:00
John Blackbourn 98161af28f General: Remove the version number from the readme file in the 4.6 branch. 
See #42386

Built from https://develop.svn.wordpress.org/branches/4.6@42101


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41930 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 18:07:35 +00:00
Gary Pendergast 9c29274681 Bump 4.6 branch to version 4.6.8. 
Built from https://develop.svn.wordpress.org/branches/4.6@42071


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41900 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 13:15:33 +00:00
Gary Pendergast e8617fb3a5 Database: Restore numbered placeholders in `wpdb::prepare()`. 
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.

This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.

Merges [41662], [42056] to the 4.6 branch.
See #41925.


Built from https://develop.svn.wordpress.org/branches/4.6@42059


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41888 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 12:41:33 +00:00
Dominik Schilling 8dc1cd00a1 Taxonomy/Users: Use correct escaping function for URLs. 
Merge of [41522] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41525


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41358 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 21:28:32 +00:00
Dominik Schilling 8d5d807270 Bump 4.6 branch to version 4.6.7. 
Built from https://develop.svn.wordpress.org/branches/4.6@41512


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41345 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 19:59:33 +00:00
Aaron Campbell 2fabb6d0e2 Database: Hardening to bring `wpdb::prepare()` inline with documentation. 
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.

Merges [41496] to 4.6 branch.


Built from https://develop.svn.wordpress.org/branches/4.6@41499


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41332 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 18:13:34 +00:00
Aaron Campbell ce78b2a4fb Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`. 
While `wpdb::prepare()` does not support null values (see #12819) they still appear in the wild like in the WordPress Importer and other plugins.

Merges [41483] to 4.6 branch.


Built from https://develop.svn.wordpress.org/branches/4.6@41486


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41319 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 16:21:34 +00:00
Aaron Campbell 22f3d4e600 Database: Hardening for `wpdb::prepare()` 
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

Merges [41470] to 4.6 branch.


Built from https://develop.svn.wordpress.org/branches/4.6@41473


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41306 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 15:00:35 +00:00
John Blackbourn 4733856aee Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues. 
Merges [41457] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@41460


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41293 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 14:39:34 +00:00
Aaron Campbell 77b60a60a0 oEmbed: Add extra hardening around allowed HTML for improved sandboxing. 
Merges [41448] to 4.6 branch.



Built from https://develop.svn.wordpress.org/branches/4.6@41453


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41286 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 13:49:46 +00:00
Dominik Schilling 441a970ecd TinyMCE: Improve the previews for shortcodes. 
Merge of [41395] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@41437


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41270 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 12:42:38 +00:00
Dominik Schilling e684cc66cd Customize: Ensure valid themes in the preview. 
Merge of [41397] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@41431


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41264 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 11:51:38 +00:00
Dominik Schilling acd952f9c7 Taxonomy/Users: Provide a fallback for incorrect HTTP referrers. 
Merge of [41398] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@41419


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41252 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 11:12:41 +00:00
John Blackbourn f12b16a291 General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area. 
Merges [41413] to the 4.6 branch

See #13377

Built from https://develop.svn.wordpress.org/branches/4.6@41414


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41247 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 10:22:34 +00:00
Dominik Schilling 7e0de7a0e3 Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog. 
Merge of [41393] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@41402


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41235 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 10:16:42 +00:00
Konstantin Obenland f5fff9f3f9 Import Twenty Sixteen for the 4.6 branch. 
See #36497.

Built from https://develop.svn.wordpress.org/branches/4.6@40857


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40708 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-31 01:13:37 +00:00
Aaron Campbell bacf919c26 Bump 4.7 branch to version 4.6.6. 
Built from https://develop.svn.wordpress.org/branches/4.6@40749


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40607 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 21:49:33 +00:00
Pascal Birchler 600e9f1b49 Media: Simplify upload error message construction. 
Merges [40736] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40738


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40596 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 18:01:08 +00:00
Aaron Campbell e07088f06e Add nonce for updating file system credentials. 
Merges [40723] to 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40725


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40583 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 14:53:33 +00:00
Dominik Schilling f2f9b5e493 Customize: Ignore invalid customization sessions. 
Merge of [40704] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40706


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40569 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 12:15:34 +00:00
Pascal Birchler 687f87a4e6 Adjust post meta checks 
Merges [40692] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40694


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40557 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:49:34 +00:00
Pascal Birchler 81a5ef373a Improve redirect handling 
Merges[40689] to the 4.7 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40691


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40554 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:41:33 +00:00
Pascal Birchler 5c4b703f38 Whitelist post arguments in XML-RPC 
Merges [40677] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40679


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40542 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:19:35 +00:00
Pascal Birchler 43c3b11cee Bump 4.6 branch to version 4.6.5. 
Built from https://develop.svn.wordpress.org/branches/4.6@40488


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40364 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-04-20 16:22:35 +00:00
Pascal Birchler 98c13fefb2 Fix broken audio/video functions when sanitizing ID3 data 
This fixes a bug where running `wp_kses_post_deep()` on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40461


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40337 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-04-17 13:07:36 +00:00
James Nylen 299bfe429c Bump 4.6 branch to version 4.6.4. 
Built from https://develop.svn.wordpress.org/branches/4.6@40203


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40142 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 16:08:34 +00:00
John Blackbourn 70a97d6789 Press This: Verify intent before fetching in-page resources using Press This. 
Props vortfu

Merges [40195] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40197


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40136 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 13:58:33 +00:00
Aaron Campbell 0e1bc61b1f Strip control characters before validating redirect. 
Merges [40183] to 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40185


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40124 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 13:41:33 +00:00
Aaron Campbell b67b8d56d9 Plugins: Add file check to plugin deletions. 
Merges [40169] to 4.6 branch.


Built from https://develop.svn.wordpress.org/branches/4.6@40171


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40110 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 12:59:34 +00:00
Dominik Schilling e61cac5d13 Embeds: URL encode YouTube video IDs for broader compatibility. 
Merge of [40160] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40162


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40101 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 12:05:34 +00:00
Jeremy Felt fe1162e5f1 Validate video and audio metadata. 
Merge of [40148] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40150


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40089 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 08:04:35 +00:00
Aaron Campbell baf66f786a Bump 4.6 branch to version 4.6.3. 
Built from https://develop.svn.wordpress.org/branches/4.6@39996


git-svn-id: http://core.svn.wordpress.org/branches/4.6@39933 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-26 18:16:33 +00:00
Dominik Schilling 88e92019c3 Press This: Do not show Categories & Tags UI for users who cannot assign terms to posts anyways. 
Merge of [39968] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@39971


git-svn-id: http://core.svn.wordpress.org/branches/4.6@39908 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-26 14:10:33 +00:00