Commit Graph

29818 Commits

Author SHA1 Message Date
Sergey Biryukov
0998a57991 Administration: Pass the result of set-screen-option filter to the new set_screen_option_{$option} filter to ensure backward compatibility.
Rename the `$keep` parameter of both filters to `$screen_option` for clarity, update the documentation to better reflect its purpose.

Follow-up to [47951].

Props Chouby, sswells, SergeyBiryukov.
Merges [48241] to the 4.2 branch.
Fixes #50392.
Built from https://develop.svn.wordpress.org/branches/4.2@48256


git-svn-id: http://core.svn.wordpress.org/branches/4.2@48025 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-07-01 09:53:39 +00:00
desrosj
370ecdfd1a WordPress 4.2.28.
Built from https://develop.svn.wordpress.org/branches/4.2@48001


git-svn-id: http://core.svn.wordpress.org/branches/4.2@47769 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-06-10 21:39:36 +00:00
whyisjake
426696ba21 General: Backport several commits for release.
- Embeds: Ensure that the title attribute is set correctly on embeds.
- Editor: Prevent HTML decoding on by setting the proper editor context.
- Formatting: Ensure that wp_validate_redirect() sanitizes a wider variety of characters.
- Themes: Ensure a broken theme name is returned properly.
- Administration: Add a new filter to extend set-screen-option.
Merges [47947-47951] to the 4.2 branch.
Props xknown, sstoqnov, vortfu, SergeyBiryukov, whyisjake.

Built from https://develop.svn.wordpress.org/branches/4.2@47970


git-svn-id: http://core.svn.wordpress.org/branches/4.2@47741 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-06-10 18:53:51 +00:00
desrosj
7fb64672ce Update the About page for WordPress 4.2.27
Built from https://develop.svn.wordpress.org/branches/4.2@47692


git-svn-id: http://core.svn.wordpress.org/branches/4.2@47469 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-04-29 18:23:21 +00:00
desrosj
08db0ad5a5 WordPress 4.2.27
Built from https://develop.svn.wordpress.org/branches/4.2@47678


git-svn-id: http://core.svn.wordpress.org/branches/4.2@47455 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-04-29 18:03:27 +00:00
whyisjake
7077580716 User: Invalidate user_activation_key on password update.
Query: Ensure that only a single post can be returned on date/time based queries.
Cache API: Ensure proper escaping around the stats method in the cache API.
Formatting: Expand `sanitize_file_name` to have better support for utf8 characters.

Brings the changes in [47634], [47635], [47637], and [47638] to the 4.2 branch.

Props: batmoo, ehti, nickdaugherty, peterwilsoncc, sergeybiryukov, sstoqnov, westi, whyisjake, whyisjake, xknown.

Built from https://develop.svn.wordpress.org/branches/4.2@47657


git-svn-id: http://core.svn.wordpress.org/branches/4.2@47434 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-04-29 16:52:22 +00:00
Sergey Biryukov
00ae10906e WordPress 4.2.26
Built from https://develop.svn.wordpress.org/branches/4.2@46931


git-svn-id: http://core.svn.wordpress.org/branches/4.2@46731 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-12-12 20:32:20 +00:00
Sergey Biryukov
7bfe4a912f Update wp_kses_bad_protocol() to recognize : on uri attributes,
`wp_kses_bad_protocol()` makes sure to validate that uri attributes don’t contain invalid/or not allowed protocols. While this works fine in most cases, there’s a risk that by using the colon html5 named entity, one is able to bypass this function.

Brings r46895 to the 4.2 branch.

Props: xknown, nickdaugherty, peterwilsoncc.
Built from https://develop.svn.wordpress.org/branches/4.2@46910


git-svn-id: http://core.svn.wordpress.org/branches/4.2@46710 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-12-12 18:41:21 +00:00
desrosj
229d71e0f8 WordPress 4.2.25.
Built from https://develop.svn.wordpress.org/branches/4.2@46518


git-svn-id: http://core.svn.wordpress.org/branches/4.2@46315 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-10-14 20:15:21 +00:00
whyisjake
1fcbdb46e6 Backporting several bug fixes.
- Query: Remove the static query property.
- HTTP API: Protect against hex interpretation.
- Filesystem API: Prevent directory travelersals when creating new folders.
- Administration: Ensure that admin referer nonce is valid.
- REST API: Send a Vary: Origin header on GET requests.
- Customizer: Properly sanitize background images.

Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@46500


git-svn-id: http://core.svn.wordpress.org/branches/4.2@46297 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-10-14 19:15:22 +00:00
desrosj
de854c38b5 WordPress 4.2.24.
Built from https://develop.svn.wordpress.org/branches/4.2@46036


git-svn-id: http://core.svn.wordpress.org/branches/4.2@45848 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 22:03:21 +00:00
desrosj
43cac2c9d4 Fix for URL sanitization in wp_kses_bad_protocol_once().
Merges [45997] to the 4.2 branch.

Props irsdl, sstoqnov, whyisjake.
Built from https://develop.svn.wordpress.org/branches/4.2@46012


git-svn-id: http://core.svn.wordpress.org/branches/4.2@45823 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 21:41:35 +00:00
Sergey Biryukov
561924df40 Improve URL validation in wp_validate_redirect().
Merges [45971] to the 4.2 branch.
Props vortfu, whyisjake, peterwilsoncc.
Built from https://develop.svn.wordpress.org/branches/4.2@45983


git-svn-id: http://core.svn.wordpress.org/branches/4.2@45794 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 17:14:58 +00:00
whyisjake
ca92ecbe61 Remove _convert_urlencoded_to_entities() from the get_the_content() callback.
Merges [45937] to the 4.2 branch.

Props vortfu, whyisjake, peterwilsoncc

Built from https://develop.svn.wordpress.org/branches/4.2@45961


git-svn-id: http://core.svn.wordpress.org/branches/4.2@45772 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 16:43:20 +00:00
Sergey Biryukov
9807e138d3 Escape the output in wp_ajax_upload_attachment().
Merges [45936] to the 4.2 branch.
Props whyisjake, sstoqnov.
Built from https://develop.svn.wordpress.org/branches/4.2@45953


git-svn-id: http://core.svn.wordpress.org/branches/4.2@45764 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 16:39:00 +00:00
Gary Pendergast
ebbc9ff12e WordPress 4.2.23
Built from https://develop.svn.wordpress.org/branches/4.2@44882


git-svn-id: http://core.svn.wordpress.org/branches/4.2@44713 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-13 01:43:20 +00:00
Sergey Biryukov
bc4ed1a93e Comments: Improve comment content filtering.
Merges [44842] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@44852


git-svn-id: http://core.svn.wordpress.org/branches/4.2@44684 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-12 22:42:20 +00:00
Jeremy Felt
3efe9a5fdb Bump 4.2 branch to version 4.2.22.
Built from https://develop.svn.wordpress.org/branches/4.2@44085


git-svn-id: http://core.svn.wordpress.org/branches/4.2@43915 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 02:15:37 +00:00
Gary Pendergast
aab268600a Editor: Remove unwanted fields before saving posts.
The `meta_input`, `file`, and `guid` fields are not intended to be updated through user input.

Merges [44047] to the 4.2 branch.


Built from https://develop.svn.wordpress.org/branches/4.2@44066


git-svn-id: http://core.svn.wordpress.org/branches/4.2@43896 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:52:19 +00:00
Peter Wilson
303bd241f3 Multisite: Validate activation links.
Merges [44048] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@44065


git-svn-id: http://core.svn.wordpress.org/branches/4.2@43895 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:51:37 +00:00
iandunn
2d9f6ab9dd KSES: Make the URI attributes DRY.
This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.

Merges [44014] and [44017] to the `4.2` branch.

Built from https://develop.svn.wordpress.org/branches/4.2@44042


git-svn-id: http://core.svn.wordpress.org/branches/4.2@43872 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:16:20 +00:00
Peter Wilson
7000d8a45f Multisite: Improve messaging for previously activated users.
Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time.

Merges [44021] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@44034


git-svn-id: http://core.svn.wordpress.org/branches/4.2@43864 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 00:56:19 +00:00
Gary Pendergast
0e98d850b9 KSES: Conditionally remove the <form> element from $allowedposttags.
To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.

Merges [43994] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@44008


git-svn-id: http://core.svn.wordpress.org/branches/4.2@43838 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:40:39 +00:00
Jeremy Felt
f91b78ec58 Media: Improve verification of MIME file types.
Merges [43988] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@43998


git-svn-id: http://core.svn.wordpress.org/branches/4.2@43830 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:18:20 +00:00
Aaron Campbell
61881c7156 Bump 4.2 branch to version 4.2.21
Built from https://develop.svn.wordpress.org/branches/4.2@43414


git-svn-id: http://core.svn.wordpress.org/branches/4.2@43242 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 16:13:28 +00:00
John Blackbourn
ef0bb8bab1 Media: Limit thumbnail file deletions to the same directory as the original file.
Merges [43393] into the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@43400


git-svn-id: http://core.svn.wordpress.org/branches/4.2@43228 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 15:06:23 +00:00
Aaron Campbell
dac39608a3 Bump 4.2 branch to version 4.2.20
Built from https://develop.svn.wordpress.org/branches/4.2@42940


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42770 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 20:31:29 +00:00
Dominik Schilling
93cae5c2ab Template: Make sure the version string is correctly escaped for use in attributes.
Merge of [42893] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@42924


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42754 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 16:10:29 +00:00
Dominik Schilling
581a8a01c7 Login: Use wp_safe_redirect() when redirecting the login page if forced to use HTTPS.
Merge of [42892] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@42902


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42732 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:33:31 +00:00
Sergey Biryukov
04d983d6c1 General: Update copyright year to 2018 in license.txt.
Props rachelbaker.
Merges [42424] to the 4.2 branch.
Fixes #43007.
Built from https://develop.svn.wordpress.org/branches/4.2@42559


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42388 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-23 11:29:31 +00:00
Dion Hulse
e74c55ff6d Bump the 4.2 branch to 4.2.19.
Built from https://develop.svn.wordpress.org/branches/4.2@42501


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42330 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 21:45:31 +00:00
Dion Hulse
507c958ab6 External Libraries: Remove unnecessary / obsoleted MediaElement.js files.
Merges [42478] to the 4.2 branch.
Fixes #42720 for 4.2.

Built from https://develop.svn.wordpress.org/branches/4.2@42484


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42313 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 08:12:32 +00:00
Dion Hulse
4b860b51ae Upgrade: When deleting old files, if deletion fails attempt to empty the file instead.
Props joemcgill, dd32.
Merges [42434] to the 4.2 branch.
Fixes #42963 for 4.2.

Built from https://develop.svn.wordpress.org/branches/4.2@42472


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42301 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 06:57:57 +00:00
John Blackbourn
ec85529fb7 Bump 4.2 branch to version 4.2.18.
Built from https://develop.svn.wordpress.org/branches/4.2@42323


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42152 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 19:02:31 +00:00
John Blackbourn
64c1ec2877 Hardening: Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.
Merges [42261] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@42295


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42124 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:35:01 +00:00
John Blackbourn
a8df162eea Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
Merges [42260] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@42294


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42123 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:34:32 +00:00
John Blackbourn
63cc2673a1 Hardening: Add escaping to the language attributes used on html elements.
Merges [42259] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@42293


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42122 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:33:54 +00:00
John Blackbourn
f345c93563 Hardening: Use a properly generated hash for the newbloguser key instead of a determinate substring.
Merges [42258] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@42292


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42121 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:33:25 +00:00
Dion Hulse
9dadfcb012 WPDB: Check that AUTH_SALT is not empty, Fix a PHP notice when AUTH_SALT is undefined.
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.2 branch.
Fixes #42431 and #42401 for 4.2.

Built from https://develop.svn.wordpress.org/branches/4.2@42236


git-svn-id: http://core.svn.wordpress.org/branches/4.2@42065 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-27 01:12:56 +00:00
John Blackbourn
58880cb8c1 General: Remove the version number from the readme file in the 4.2 branch.
See #42386

Built from https://develop.svn.wordpress.org/branches/4.2@42094


git-svn-id: http://core.svn.wordpress.org/branches/4.2@41923 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 17:46:31 +00:00
Gary Pendergast
eb5a635d04 Bump 4.2 branch to version 4.3.17.
Built from https://develop.svn.wordpress.org/branches/4.2@42075


git-svn-id: http://core.svn.wordpress.org/branches/4.2@41904 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 13:42:30 +00:00
Gary Pendergast
86acf8b033 Database: Restore numbered placeholders in wpdb::prepare().
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.

This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.

Merges [41662], [42056] to the 4.2 branch.
See #41925.


Built from https://develop.svn.wordpress.org/branches/4.2@42063


git-svn-id: http://core.svn.wordpress.org/branches/4.2@41892 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 12:51:31 +00:00
Dominik Schilling
7a5426f3fe Users: Use correct escaping function for URLs.
Merge of [41522] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@41529


git-svn-id: http://core.svn.wordpress.org/branches/4.2@41362 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 21:38:56 +00:00
Dominik Schilling
c4fb8dfbf1 Bump 4.2 branch to version 4.2.16.
Built from https://develop.svn.wordpress.org/branches/4.2@41516


git-svn-id: http://core.svn.wordpress.org/branches/4.2@41349 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 20:03:31 +00:00
Aaron Campbell
a964c2ba2e Database: Hardening to bring wpdb::prepare() inline with documentation.
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.

Merges [41496] to 4.2 branch.


Built from https://develop.svn.wordpress.org/branches/4.2@41503


git-svn-id: http://core.svn.wordpress.org/branches/4.2@41336 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 18:31:29 +00:00
Aaron Campbell
79e0bb13d4 Database: Don’t trigger _doing_it_wrong() for null values in wpdb::prepare().
While `wpdb::prepare()` does not support null values (see #12819) they still appear in the wild like in the WordPress Importer and other plugins.

Merges [41483] to 4.2 branch.


Built from https://develop.svn.wordpress.org/branches/4.2@41490


git-svn-id: http://core.svn.wordpress.org/branches/4.2@41323 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 16:25:54 +00:00
Aaron Campbell
be9edc6bc3 Database: Hardening for wpdb::prepare()
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

Merges [41470] to 4.2 branch.


Built from https://develop.svn.wordpress.org/branches/4.2@41477


git-svn-id: http://core.svn.wordpress.org/branches/4.2@41310 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 15:03:30 +00:00
John Blackbourn
a59dfc257f Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues.
Merges [41457] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@41464


git-svn-id: http://core.svn.wordpress.org/branches/4.2@41297 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 14:43:56 +00:00
John Blackbourn
6ddef3f8ab General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.
Merges [41434] with changes to the 4.2 branch.

See #13377

Built from https://develop.svn.wordpress.org/branches/4.2@41445


git-svn-id: http://core.svn.wordpress.org/branches/4.2@41278 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 13:32:30 +00:00
Dominik Schilling
74df39530d TinyMCE: Improve the previews for shortcodes.
Merge of [41395] to the 4.2 branch.

Built from https://develop.svn.wordpress.org/branches/4.2@41441


git-svn-id: http://core.svn.wordpress.org/branches/4.2@41274 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 12:44:31 +00:00