Props: danielbachhuber, whyisjake, peterwilson, xknown.
Prevent stored XSS through wp_targeted_link_rel().
Props: vortfu, whyisjake, peterwilsoncc, xknown, SergeyBiryukov, flaviozavan.
Update wp_kses_bad_protocol() to recognize : on uri attributes,
wp_kses_bad_protocol() makes sure to validate that uri attributes don't contain invalid/or not allowed protocols. While this works fine in most cases, there's a risk that by using the colon html5 named entity, one is able to bypass this function.
Brings r46895 to the 5.3 branch.
Props: xknown, nickdaugherty, peterwilsoncc.
Prevent stored XSS in the block editor.
Brings r46896 to the 5.3 branch.
Prevent escaped unicode characters become unescaped in unsafe HTML during JSON decoding.
Props: aduth, epiqueras.
Built from https://develop.svn.wordpress.org/branches/5.0@46915
git-svn-id: http://core.svn.wordpress.org/branches/5.0@46715 1a063a9b-81f0-0310-95a4-ce76da25c4cd
- Query: Remove the static query property.
- HTTP API: Protect against hex interpretation.
- Filesystem API: Prevent directory travelersals when creating new folders.
- Administration: Ensure that admin referer nonce is valid.
- REST API: Send a Vary: Origin header on GET requests.
Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 5.0 branch.
Built from https://develop.svn.wordpress.org/branches/5.0@46492
git-svn-id: http://core.svn.wordpress.org/branches/5.0@46289 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This adds some special case handling in 'wp_check_filetype_and_ext()' that prevents some common file types from being blocked based on mismatched MIME checks, which were made more strict in WordPress 5.0.1.
Merges [44438], [44439], [44441], and [44442] to the 4.9 branch.
Props Kloon, birgire, tellyworth, joemcgill.
See #45615.
Built from https://develop.svn.wordpress.org/branches/5.0@44443
git-svn-id: http://core.svn.wordpress.org/branches/5.0@44274 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Currently, when viewing the block editor with JavaScript disabled, the user sees a blank admin page with the admin menu sidebar. This adds an admin notice informing the user that JavaScript is required for the new block editor.
Props mkaz, pento, azaozz, ocean90, desrosj.
Merges [44437] to the 5.0 branch.
Fixes#45453.
Built from https://develop.svn.wordpress.org/branches/5.0@44440
git-svn-id: http://core.svn.wordpress.org/branches/5.0@44271 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When existing scripts or styles are updated in default themes, the version numbers in the enqueues should also be bumped to make sure the old files don't cache. This update bumps version numbers for changes since version 5.0, for themes Twenty Eleven through Twenty Nineteen.
Props laurelfulford.
Merges [44382] to the 5.0 branch.
Fixes#45679.
Built from https://develop.svn.wordpress.org/branches/5.0@44434
git-svn-id: http://core.svn.wordpress.org/branches/5.0@44265 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When the original block editor styles were added to the existing default themes, the button blocks were styled to match how each theme styled the `button` tag.
However, the styles should respect the block editor's default style, "Rounded", and allow switching to the other styles, like "Outlined" and "Square".
Props laurelfulford.
Merges [44381] to the 5.0 branch.
Fixes#45541.
Built from https://develop.svn.wordpress.org/branches/5.0@44430
git-svn-id: http://core.svn.wordpress.org/branches/5.0@44260 1a063a9b-81f0-0310-95a4-ce76da25c4cd
On pages and posts with featured images, the top level menu items have a slight transparency on hover, which was being inherited by their submenus. This update removes that inheritance, improving readability and consistency in the menu's appearance.
Props kjellr.
Merges [44368] to the 5.0 branch.
Fixes#45689.
Built from https://develop.svn.wordpress.org/branches/5.0@44427
git-svn-id: http://core.svn.wordpress.org/branches/5.0@44257 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Twenty Seventeen's original styles for the block editor custom colors had some issues: they weren't being applied to the button blocks due to lack of specificity, and when applied to paragraph blocks, there was no padding in the editor. This update makes sure the colors and related styles work as expected.
Props laurelfulford.
Merges [44402] to the 5.0 branch.
Fixes#45426.
Built from https://develop.svn.wordpress.org/branches/5.0@44425
git-svn-id: http://core.svn.wordpress.org/branches/5.0@44255 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The "Continue Reading" link that's generated by the More block is styled to include an arrow next to the text; that arrow shouldn't inherit the text underline style. This update removes it.
Props littlebigthing, kjellr.
Merges [44369] to the 5.0 branch.
Fixes#45715.
Built from https://develop.svn.wordpress.org/branches/5.0@44422
git-svn-id: http://core.svn.wordpress.org/branches/5.0@44252 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Removes `file_exist()` checks before calling `load_script_translations()` to let the determined paths be passed to `load_script_translations()` which provides its own file check and the possibility to filter the path.
Merge of [44418] to the 5.0 branch.
Props swissspidy, johnbillion, ocean90.
Fixes#45769.
Built from https://develop.svn.wordpress.org/branches/5.0@44419
git-svn-id: http://core.svn.wordpress.org/branches/5.0@44249 1a063a9b-81f0-0310-95a4-ce76da25c4cd
A static variable contains an integer that is incremented with each call. This number is returned with the optional prefix.
As such the returned value is not universally unique, but it is unique across the life of the PHP process.
Props westonruter, dlh.
Merges [43658] and [44406] to the 5.0 branch.
See #44883.
Built from https://develop.svn.wordpress.org/branches/5.0@44407
git-svn-id: http://core.svn.wordpress.org/branches/5.0@44237 1a063a9b-81f0-0310-95a4-ce76da25c4cd
In [42523], `trunk` was updated to use explicit context instead of a trailing space for the Edit string in TinyMCE plugins. [43472] later backported this change, but the string in `class-wp-editor.php` was missed. This fixes the `Edit` string so not display as `Edit|button` in the 5.0 branch.
Props dimadin.
See #42543, #44134.
Fixes#44919.
Built from https://develop.svn.wordpress.org/branches/5.0@44401
git-svn-id: http://core.svn.wordpress.org/branches/5.0@44231 1a063a9b-81f0-0310-95a4-ce76da25c4cd
In the Classic Editor, the “Add Media” button was outside of the TinyMCE editor. In the Block Editor, the “Add Media” button was moved into the TinyMCE toolbar in the Classic block, but the tooltip was not added to the list of translatable strings. This adds “Add Media” to that list.
The corresponding keyboard shortcut is also specified for the “Add Media” button.
Props afercia.
Merges [44398-44399] to the 5.0 branch.
Fixes#45788.
Built from https://develop.svn.wordpress.org/branches/5.0@44400
git-svn-id: http://core.svn.wordpress.org/branches/5.0@44230 1a063a9b-81f0-0310-95a4-ce76da25c4cd
While the filter is documented to only support a `WP_Error`, it has been a common practice to return true in a validation function if no errors have occurred. This was already caught when the same filter was executed in `WP_Customize_Setting`, it was however missing in `WP_Customize_Manager::validate_setting_values()`.
Props flixos90.
Merges [43578] to the 5.0 branch.
Fixes#44809.
Built from https://develop.svn.wordpress.org/branches/5.0@44392
git-svn-id: http://core.svn.wordpress.org/branches/5.0@44222 1a063a9b-81f0-0310-95a4-ce76da25c4cd
