As part of determining whether to perform automatic updates, WordPress checks if it is running within a version-controlled environment, recursively looking up the filesystem to the top of the drive, looking for a Subversion, Git, Mercurial, or Bazaar directory, erring on the side of detecting a VCS checkout somewhere.
This commit avoids a PHP warning if the `open_basedir` directive is in use and any of the directories checked in the process are not allowed:
{{{
is_dir(): open_basedir restriction in effect. File(/.git) is not within the allowed path(s)
}}}
Follow-up to [25421], [25700], [25764], [25835], [25859].
Props costdev, markjaquith, meyegui, dd32, arnolp, robin-labadie, hellofromTonya, afragen, pbiron, SergeyBiryukov.
Fixes#42619.
Built from https://develop.svn.wordpress.org/trunk@55425
git-svn-id: http://core.svn.wordpress.org/trunk@54958 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset fixes encoding issues in background update emails by applying `html_entity_decode()` on Plugin/Theme names in `send_plugin_theme_email()`.
Props paulschreiber, audrasjb, benjgrolleau, sanketchodavadiya, robinwpdeveloper, paulamit.
Fixes#56964.
Built from https://develop.svn.wordpress.org/trunk@55411
git-svn-id: http://core.svn.wordpress.org/trunk@54944 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This aims to avoid timeout in Imagick operations.
Previously, Imagick operations could silently error by timeout and produce unexpected results. The new `::set_imagick_time_limit()` method, now used in `::resize()` and `::crop()`, will better handle garbage collection in these cases as well as better align Imagick's timeout with PHP timeout, assuming it is set.
Props drzraf, audrasjb, costdev, antpb, SergeyBiryukov.
Fixes#52569.
Built from https://develop.svn.wordpress.org/trunk@55404
git-svn-id: http://core.svn.wordpress.org/trunk@54937 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The `$post_ID` variable is [546f59c678/WordPress/Sniffs/NamingConventions/ValidVariableNameSniff.php (L54) technically allowed in WPCS], as there is a global of the same name that needs to remain for backward compatibility. However, this name is mostly a remnant of legacy code, and switching to `$post_id` where appropriate brings more consistency with the rest of core.
Additionally, this commit resolves a few WPCS warnings in core:
{{{
Variable "$post_IDs" is not in valid snake_case format
}}}
This affects:
* Function parameters in:
* `add_meta()`
* `post_preview()`
* `WP_Embed::delete_oembed_caches()`
* `WP_Embed::cache_oembed()`
* `wp_get_post_cats()`
* `wp_set_post_cats()`
* `wp_unique_post_slug()`
* `wp_set_post_categories()`
* `wp_check_post_hierarchy_for_loops()`
* `wp_add_trashed_suffix_to_post_name_for_trashed_posts()`
* `wp_filter_wp_template_unique_post_slug()`
* `wp_xmlrpc_server::add_enclosure_if_new()`
* `wp_xmlrpc_server::attach_uploads()`
* `wp_xmlrpc_server::mt_getTrackbackPings()`
* Internal variables in:
* `wp_ajax_inline_save()`
* `wp_ajax_set_post_thumbnail()`
* `wp_ajax_get_post_thumbnail_html()`
* `edit_post()`
* `bulk_edit_posts()`
* `wp_write_post()`
* `WP_Embed::shortcode()`
* `wp_insert_post()`
* `wp_xmlrpc_server::_insert_post()`
* `wp_xmlrpc_server::blogger_getPost()`
* `wp_xmlrpc_server::blogger_newPost()`
* `wp_xmlrpc_server::blogger_editPost()`
* `wp_xmlrpc_server::blogger_deletePost()`
* `wp_xmlrpc_server::mw_getPost()`
* `wp_xmlrpc_server::mw_newPost()`
* `wp_xmlrpc_server::mw_editPost()`
* `wp_xmlrpc_server::mt_getPostCategories()`
* `wp_xmlrpc_server::mt_setPostCategories()`
* `wp_xmlrpc_server::mt_publishPost()`
* `wp_xmlrpc_server::pingback_ping()`
* Hook parameters in:
* `oembed_ttl`
* `embed_oembed_html`
* `wp_insert_post_parent`
* `add_trashed_suffix_to_trashed_posts`
* `pre_post_update`
* `edit_attachment`
* `attachment_updated`
* `add_attachment`
* `edit_post_{$post->post_type}`
* `edit_post`
* `post_updated`
* `save_post_{$post->post_type}`
* `save_post`
* `wp_insert_post`
* `pre_wp_unique_post_slug`
* `wp_unique_post_slug`
* `xmlrpc_call_success_blogger_newPost`
* `xmlrpc_call_success_blogger_editPost`
* `xmlrpc_call_success_blogger_deletePost`
* `xmlrpc_call_success_mw_newPost`
* `xmlrpc_call_success_mw_editPost`
Note: The name change only affects variable names and DocBlocks.
The change does not affect the `$post_ID` global still used in a few places.
Follow-up to [51399], [52958], [53723], [53729], [55190], [55308], [55334].
Props mahekkalola, tanjimtc71, SergeyBiryukov.
Fixes#57692.
Built from https://develop.svn.wordpress.org/trunk@55365
git-svn-id: http://core.svn.wordpress.org/trunk@54898 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Skip preloading Requests files in `_preload_old_requests_classes_and_interfaces()` when updating from a WordPress version older than 4.6.
Why?
Requests library was first introduced into WordPress 4.6 via #33055 / [37428]. If a user is upgrading from a version older than 4.6, this changeset prevents the Requests preloading to prevent a fatal error of attempting to load files that do not exist in their current WordPress version.
Follow-up to [54997], [37428].
Props afragen, costdev, ironprogrammer, antonvlasenko.
Fixes#57662.
Built from https://develop.svn.wordpress.org/trunk@55296
git-svn-id: http://core.svn.wordpress.org/trunk@54829 1a063a9b-81f0-0310-95a4-ce76da25c4cd
It's not uncommon for local environments to run over HTTP due to the relative complexity of configuring HTTPS for a local environment. This change allows HTTP URLs for application password responses when that is the case.
Props peterwilsoncc, wppunk, cadic, viralsampat
Fixes#52617
Built from https://develop.svn.wordpress.org/trunk@55283
git-svn-id: http://core.svn.wordpress.org/trunk@54816 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This aims to provide better context for translators and make it easier to determine that some strings contain hidden accessibility text and are not displayed in the UI.
Props kebbet, mercime, pavelevap, ocean90, swissspidy, Chouby, jipmoors, afercia, desrosj, costdev, audrasjb, SergeyBiryukov.
Fixes#29748.
Built from https://develop.svn.wordpress.org/trunk@55276
git-svn-id: http://core.svn.wordpress.org/trunk@54809 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This reverts [55108] pending confirmation that this hook is still needed, that the right variable is passed, and that the docs are correct.
The necessity and implementation of this hook will be reconsidered in a future release.
See #28112.
Built from https://develop.svn.wordpress.org/trunk@55265
git-svn-id: http://core.svn.wordpress.org/trunk@54798 1a063a9b-81f0-0310-95a4-ce76da25c4cd
If the `clear_working` flag in `WP_Upgrader::install_package()` is false, the source should not be removed, so `copy_dir()` should be used instead.
Partial updates, like language packs, may want to retain the destination. If the destination exists or has contents, this may be a partial update, and the destination should not be removed, so `copy_dir()` should be used instead.
Follow-up to [55204], [55219], [55220], [55223], [55226].
Props afragen, costdev, swissspidy.
See #57557.
Built from https://develop.svn.wordpress.org/trunk@55229
git-svn-id: http://core.svn.wordpress.org/trunk@54762 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Correctly instantiate `WP_Error()` within `move_dir()` to prevent a fatal error when unable to delete an existing directory that is intended to be replaced.
Follow-up to [55204], [55219], [55220], [55223].
Props swissspidy, costdev, afragen.
Fixes#57375.
Built from https://develop.svn.wordpress.org/trunk@55226
git-svn-id: http://core.svn.wordpress.org/trunk@54759 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Intentional preloading of Requests 2.x classes and interfaces using their old (Requests 1.x) names should not produce deprecation notices.
This commit defines `REQUESTS_SILENCE_PSR0_DEPRECATIONS` as `true` in `_preload_old_requests_classes_and_interfaces()`.
Follow-up to [54997], [55007], [55046].
Props costdev, afragen, jrf.
Fixes#54504.
Built from https://develop.svn.wordpress.org/trunk@55225
git-svn-id: http://core.svn.wordpress.org/trunk@54758 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset improves the consistency in capitalization of fetching and outputting of request headers. It also updates occurrences found in some docblocks.
Props johnjamesjacoby, costdev, audrasjb, petitphp, mhkuu, SergeyBiryukov.
Fixes#54225.
Built from https://develop.svn.wordpress.org/trunk@55210
git-svn-id: http://core.svn.wordpress.org/trunk@54743 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Introduces:
- New function: `wp_opcache_invalidate_directory()`, to recursively call `wp_opcache_invalidate()` after overwriting .php files.
- New function: `move_dir()`, similar to `copy_dir()` that uses `WP_Filesystem::move()` followed by `wp_opcache_invalidate_directory()`, and has a fallback to `copy_dir()`.
Props: costdev, afragen, peterwilsoncc, sergeybiryukov, ironprogrammer, flixos90, bronsonquick, mukesh27, azaozz.
Fixes#57375.
Built from https://develop.svn.wordpress.org/trunk@55204
git-svn-id: http://core.svn.wordpress.org/trunk@54737 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset makes it easier for users to download their uploaded media by providing a Download row action to the Media List Table. It also rephrases the Copy URL row action for better consistency and to give room for the new Download action.
Follow-up to [55156].
Props pbiron, joedolson, kebbet, Mista-Flo, costdev, amin7, mukesh27.
Fixes#57574.
Built from https://develop.svn.wordpress.org/trunk@55198
git-svn-id: http://core.svn.wordpress.org/trunk@54731 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset rephrases the Add Plugins screen description to clarify the purpose of the two available options for installing plugins.
Props tahmidulkarim, audrasjb, costdev, ryokuhi, krupalpanchal, SergeyBiryukov.
Fixes#57155.
Built from https://develop.svn.wordpress.org/trunk@55197
git-svn-id: http://core.svn.wordpress.org/trunk@54730 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This resolves a few WPCS warnings:
{{{
Variable "$cat_ID" is not in valid snake_case format, try "$cat_i_d"
}}}
Follow-up to [2695], [4490], [52958].
Props hilayt24, viralsampat, desrosj, robinwpdeveloper, tanazmasaba, costdev, SergeyBiryukov.
See #56754.
Built from https://develop.svn.wordpress.org/trunk@55190
git-svn-id: http://core.svn.wordpress.org/trunk@54723 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset modifies the HTTP request in `themes_api()` to use the same HTTP request timeout as in `plugins_api()`, which is 15 seconds, instead of a default value of 5 seconds.
Props ahortin, peterwilsoncc, dd32, costdev.
Fixes#57315.
Built from https://develop.svn.wordpress.org/trunk@55188
git-svn-id: http://core.svn.wordpress.org/trunk@54721 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This new function makes it easier to switch to a specific user’s locale by reducing duplicate code and storing the user’s ID as additional context for plugins to consume. Existing usage of `switch_to_locale()` in core has been replaced with `switch_to_user_locale()` where appropriate.
Also, this change ensures `WP_Locale_Switcher` properly filters `determine_locale` so that anyyone using the `determine_locale()` function will get the correct locale information when switching is in effect.
Props costdev.
Fixes#57123.
See #26511.
Built from https://develop.svn.wordpress.org/trunk@55161
git-svn-id: http://core.svn.wordpress.org/trunk@54694 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset adds a `large-text` attribute and removes the `size` attribute of the text input field located in the Slug metabox. It improves its usability, at least for as long as the Slug metabox is available in the Classic Editor.
Props ABTOP, nacin, helen, sabernhardt, abitofmind, tyxla, audrasjb.
Fixes#16346.
Built from https://develop.svn.wordpress.org/trunk@55113
git-svn-id: http://core.svn.wordpress.org/trunk@54646 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset introduces the `bulk_edit_posts` action hook, triggered after processing the post data for bulk edit and before it returns its results. For example, it allows developers to save additional data without having to perform any `.ajax()` call.
Props helgatheviking, helen, Mte90, afercia, mrasharirfan, desrosj, itowhid06, pento, mensmaximus, audrasjb, costdev.
Fixes#28112.
Built from https://develop.svn.wordpress.org/trunk@55108
git-svn-id: http://core.svn.wordpress.org/trunk@54641 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset introduces the `wp_ajax_save_attachment` action hook, triggered after an attachment has been updated and before the JSON response is sent. For example, it allows developers to update any additional attachment fields that have been rendered by extending the `media.view.Attachment.Details` subview.
Props griffinjt, bradyvercher, pputzer, antpb, sc0ttkclark, audrasjb, costdev, hellofromTonya.
Fixes#23148.
Built from https://develop.svn.wordpress.org/trunk@55106
git-svn-id: http://core.svn.wordpress.org/trunk@54639 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Up until now, new translations could only be installed via Settings -> General.
When editing the user profile, one could only select locales that were already installed.
This change allows also installing new translations if the editing user has the necessary capabilities.
Props barryceelen, johnbillion, ocean90, swissspidy.
Fixes#38664.
Built from https://develop.svn.wordpress.org/trunk@55099
git-svn-id: http://core.svn.wordpress.org/trunk@54632 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset adds `spellcheck="false"` attribute to various password fields.
The spellcheck global attribute defines whether the element may be checked for spelling errors. The `false` value indicates that the element should not be checked for spelling errors, which is relevant for a password field.
Furthermore, and as per MDN specs, using spellchecking can have consequences for users' security and privacy. The specification does not regulate how spellchecking is done and the content of the element may be sent to a third party for spellchecking results. Thus, it is recommended to set `spellcheck` attribute to `false` for elements that can contain sensitive information. Which is the case for password fields.
Props dziudek, audrasjb, gainesm, fosuahmed.
Fixes#56763.
Built from https://develop.svn.wordpress.org/trunk@55094
git-svn-id: http://core.svn.wordpress.org/trunk@54627 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The [https://make.wordpress.org/core/2021/02/19/feature-plugin-rollback-update-failure/ Rollback Update Failure feature project] has been split into two plugins for testing:
* [https://github.com/afragen/faster-updates Faster Updates] speeds up plugin or theme updates by moving files rather than copying them, thus decreasing the memory usage and reducing the chance of timeouts or running out of disk space during updates.
* [https://wordpress.org/plugins/rollback-update-failure/ Rollback Update Failure] creates a temporary backup of plugins and themes before updating. This aims to make the update process more reliable and ensure that if a plugin or theme update fails, the previous version can be safely restored.
The current priority of the feature project is to test the new `move_dir()` function, which offers better performance than `copy_dir()`. Instead of copying a directory in a recursive manner file by file from one location to another, `move_dir()` uses the `rename()` PHP function to speed up the process, which is instrumental in updating large plugins without a delay. If the renaming failed, it falls back to the `copy_dir()` WP function.
The `move_dir()` function is self-contained in the Faster Updates plugin and does not require any special hooks in core, so the conditional previously added to `WP_Upgrader::install_package()` to facilitate testing is no longer needed and can be removed.
Follow-up to [53578], [54484], [54643].
Props afragen, costdev, peterwilsoncc.
See #56057, #57375, #57386.
Built from https://develop.svn.wordpress.org/trunk@55055
git-svn-id: http://core.svn.wordpress.org/trunk@54588 1a063a9b-81f0-0310-95a4-ce76da25c4cd
