`str_starts_with()` was introduced in PHP 8.0 to perform a case-sensitive check indicating if the string to search in (haystack) begins with the given substring (needle).
WordPress core includes a polyfill for `str_starts_with()` on PHP < 8.0 as of WordPress 5.9.
This commit replaces `0 === strpos( ... )` with `str_starts_with()` in core files, making the code more readable and consistent, as well as improving performance.
While `strpos()` is slightly faster than the polyfill on PHP < 8.0, `str_starts_with()` is noticeably faster on PHP 8.0+, as it is optimized to avoid unnecessarily searching along the whole haystack if it does not find the needle.
Follow-up to [52039], [52040], [52326].
Props spacedmonkey, costdev, sabernhardt, mukesh27, desrosj, jorbin, TobiasBg, ayeshrajans, lgadzhev, SergeyBiryukov.
Fixes#58012.
Built from https://develop.svn.wordpress.org/trunk@55703
git-svn-id: http://core.svn.wordpress.org/trunk@55215 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This aims to provide better context for translators and make it easier to determine that some strings contain hidden accessibility text and are not displayed in the UI.
Props kebbet, mercime, pavelevap, ocean90, swissspidy, Chouby, jipmoors, afercia, desrosj, costdev, audrasjb, SergeyBiryukov.
Fixes#29748.
Built from https://develop.svn.wordpress.org/trunk@55276
git-svn-id: http://core.svn.wordpress.org/trunk@54809 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset adds `spellcheck="false"` attribute to various password fields.
The spellcheck global attribute defines whether the element may be checked for spelling errors. The `false` value indicates that the element should not be checked for spelling errors, which is relevant for a password field.
Furthermore, and as per MDN specs, using spellchecking can have consequences for users' security and privacy. The specification does not regulate how spellchecking is done and the content of the element may be sent to a third party for spellchecking results. Thus, it is recommended to set `spellcheck` attribute to `false` for elements that can contain sensitive information. Which is the case for password fields.
Props dziudek, audrasjb, gainesm, fosuahmed.
Fixes#56763.
Built from https://develop.svn.wordpress.org/trunk@55094
git-svn-id: http://core.svn.wordpress.org/trunk@54627 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This updates some inline comments to better match the guidelines and recommendations set forth in the make/core and make/docs handbooks:
> In general, use second person in your documentation. Second person depicts a friendly tone, with a perfect focus on the reader. In addition to this, directly addressing the reader helps avoid passive voice; thereby preventing unwanted confusion.
> ...
> the word “we” should be avoided (...) unless its made very clear which group is speaking.
Includes:
* Replacing first-person usage of "we" with second person point of view.
* Making small clarification adjustments where the voice is much too casual or lacks clear context, especially for non-native English speakers.
References:
* [https://make.wordpress.org/docs/style-guide/language-grammar/grammatical-person/ Style Guide: Grammatical person]
* [https://make.wordpress.org/docs/handbook/documentation-team-handbook/handbooks-style-and-formatting-guide/ Handbooks & HelpHub Style and Formatting Guide]
* [https://make.wordpress.org/core/handbook/best-practices/post-comment-guidelines/#style-and-substance Post & Comment Guidelines: Style and Substance]
Follow-up to [2176], [3430], [4676], [6009], [7991], [12688], [12762], [26008], [28978], [44488], [44962], [51979], [53131], [53132], [53156], [53131], [54200].
Props ironprogrammer, costdev, jorbin, SergeyBiryukov.
See #57052.
Built from https://develop.svn.wordpress.org/trunk@54866
git-svn-id: http://core.svn.wordpress.org/trunk@54418 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This affects:
* The `wp_lostpassword_url()` function.
* The `lost_password_html_link` filter.
The filter description was copied from the function, which appears to be not quite accurate, as the lost password can only be reset, not retrieved.
Follow-up to [11448], [54206].
See #55646.
Built from https://develop.svn.wordpress.org/trunk@54224
git-svn-id: http://core.svn.wordpress.org/trunk@53783 1a063a9b-81f0-0310-95a4-ce76da25c4cd
On the login page, the "Register" link for new users has been filterable for some time. This change adds the ability to filter the "Lost your password?" link as well.
Props wparslan, audrasjb, rafiahmedd, SergeyBiryukov, antonvlasenko, hellofromTonya.
Fixes#55388.
Built from https://develop.svn.wordpress.org/trunk@54206
git-svn-id: http://core.svn.wordpress.org/trunk@53765 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This aims to improve performance by calling `sanitize_url()` directly, instead of the `esc_url_raw()` wrapper. As of WordPress 6.1, `sanitize_url()` is the recommended function for sanitizing a URL for database or redirect usage.
Follow-up to [11383], [13096], [51597], [53452].
Props benjgrolleau, peterwilsoncc, SergeyBiryukov.
Fixes#55852.
Built from https://develop.svn.wordpress.org/trunk@53455
git-svn-id: http://core.svn.wordpress.org/trunk@53044 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Prevent users from using the password reset form to set their password to whitespace alone (tabs, spaces). This matches the processing used during the authentication flow, ensuring users do not inadvertently get locked out of their account.
Props antonrinas, swissspidy, voldemortensen, hellofromTonya, henry.wright, costdev.
Fixes#35500.
Built from https://develop.svn.wordpress.org/trunk@53067
git-svn-id: http://core.svn.wordpress.org/trunk@52656 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Set valid autocomplete attributes for registration and login fields for username, email, and current password. Autocomplete values are required in WCAG 2.1 at level AA for login forms.
Props johnjamesjacoby, dhanendran, rianrietveld, joedolson, peterwilsoncc.
Fixes#41136.
Built from https://develop.svn.wordpress.org/trunk@53041
git-svn-id: http://core.svn.wordpress.org/trunk@52630 1a063a9b-81f0-0310-95a4-ce76da25c4cd
During password resets, the 'Generate Password" button has a `aria-expanded="true"` attribute, but the button itself does not expand or collapse anything. This change adds a `skip-aria-expanded` class to the button which is referenced in JavaScript to skip updating the `aria-expanded` attribute on the button itself when clicked.
This change also resets the `aria-expanded` attribute to `false` for the parent form after it's submitted.
Props alexstine, johnjamesjacoby, sabernhardt.
Fixes#54538.
Built from https://develop.svn.wordpress.org/trunk@52450
git-svn-id: http://core.svn.wordpress.org/trunk@52042 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This change adds better consistency with the other `*_dropdown_args` filters, like `taxonomy_parent_dropdown_args` or `widget_archives_dropdown_args`. It is also more consistent with the new `login_display_language_dropdown` filter.
Props SergeyBiryukov, faisal03.
Fixes#54696.
Built from https://develop.svn.wordpress.org/trunk@52435
git-svn-id: http://core.svn.wordpress.org/trunk@52027 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This change renames two filters introduced in WP 5.9 development cycle. It replaces `display_login_language_dropdown` with `login_display_language_dropdown` and `wp_login_language_switcher_args` with `login_language_switcher_args`, for better consistency with the other existing `login_*` filters.
Props kebbet, mukesh27, audrasjb, Clorith, hellofromTonya.
Fixes#54696.
Built from https://develop.svn.wordpress.org/trunk@52432
git-svn-id: http://core.svn.wordpress.org/trunk@52024 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This change introduces the `display_login_language_dropdown` filter which allows to disable the Login screen language dropdown.
Follow-up to [52058].
Props rickcurran, audrasjb, ocean90, hellofromtonya, costdev, johnbillion.
Fixes#54675.
Built from https://develop.svn.wordpress.org/trunk@52404
git-svn-id: http://core.svn.wordpress.org/trunk@51996 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Although auto-focusing form fields can be arguable in some cases, it makes sense when there is a very specific task to accomplish and when there is no relevant content before the auto-focused field.
This change brings consistency between various forms generated by `wp-login.php`.
Props afercia, donmhico, sabernhardt.
Fixes#40302.
Built from https://develop.svn.wordpress.org/trunk@52193
git-svn-id: http://core.svn.wordpress.org/trunk@51785 1a063a9b-81f0-0310-95a4-ce76da25c4cd
On user registration, the `$errors` variable is the result of `register_new_user` which contains either the newly registered user's ID on success or a `WP_Error` object on failure. This change passes that context to the `registration_redirect` filter.
Props Collizo4sky, aadilali, mukesh27, audrasjb.
Fixes#53992.
Built from https://develop.svn.wordpress.org/trunk@52091
git-svn-id: http://core.svn.wordpress.org/trunk@51683 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Load a language switcher on the login and registration screens that allows users to choose any already-installed language. Set user locale on registration.
Props johnbillion, Nikschavan, afercia, sabernhardt, garrett-eclipse, keyur5, paaljoachim, Clorith, tobifjellner.
Fixes#43700.
Built from https://develop.svn.wordpress.org/trunk@52058
git-svn-id: http://core.svn.wordpress.org/trunk@51650 1a063a9b-81f0-0310-95a4-ce76da25c4cd
If there is no URL query in the `$_GET['redirect_to'], `wp_parse_url()` will return `null`. Passing `null` to `parse_str()` results in a PHP 8.1 deprecation notice
{{{
Deprecated: parse_str(): Passing null to parameter #1 ($string) of type string is deprecated
}}}
This commit:
- Fixes the deprecation notice.
- Skips doing the `parse_str()` when there's no URL query.
- Provides a micro-optimization performance boost.
Follow-up to [49109].
Props jrf, hellofromTonya, BinaryKitten.
See #53635.
Built from https://develop.svn.wordpress.org/trunk@51829
git-svn-id: http://core.svn.wordpress.org/trunk@51436 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Previously, it was unclear that the displayed password is only being suggested and should be saved by clicking the Reset Password button.
This adds separate Generate Password and Save Password buttons, for clarity.
Props xkon, estelaris, jaymanpandya, hedgefield, audrasjb, erichmond, magicroundabout, lukecavanagh, knutsp, tinodidriksen, nico_martin, markhowellsmead, kara.mcnair, e_baker, pixelverbieger, souri_wpaustria, megabyterose, poena, whyisjake.
Fixes#39638.
Built from https://develop.svn.wordpress.org/trunk@50153
git-svn-id: http://core.svn.wordpress.org/trunk@49832 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Add a feature so Admins can send users a 'password reset' email. This doesn't change the password or force a password change. It only emails the user the password reset link.
The feature appears in several places:
* A "Send Reset Link" button on user profile screen.
* A "Send password reset" option in the user list bulk action dropdown.
* A "Send password reset" quick action when hovering over a username in the user list.
Props Ipstenu, DrewAPicture, eventualo, wonderboymusic, knutsp, ericlewis, afercia, JoshuaWold, johnbillion, paaljoachim, hedgefield.
Fixes#34281.
Built from https://develop.svn.wordpress.org/trunk@50129
git-svn-id: http://core.svn.wordpress.org/trunk@49808 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset introduces a filter-based Robots API, providing central control over the `robots` meta tag.
* Introduces `wp_robots()` function which should be called anywhere a `robots` meta tag should be included.
* Introduces `wp_robots` filter which allows adding or modifying directives for the `robots` meta tag. The `wp_robots()` function is entirely filter-based, i.e. if no filter is added to `wp_robots`, no directives will be present, and therefore the entire `robots` meta tag will be omitted.
* Introduces the following `wp_robots` filter functions which replace similar existing functions that were manually rendering a `robots` meta tag:
* `wp_robots_noindex()` replaces `noindex()`, which has been deprecated.
* `wp_robots_no_robots()` replaces `wp_no_robots()`, which has been deprecated.
* `wp_robots_sensitive_page()` replaces `wp_sensitive_page_meta()`, which has been deprecated. Its rendering of the `referrer` meta tag has been moved to another new function `wp_strict_cross_origin_referrer()`.
Migration to the new functions is straightforward. For example, a call to `add_action( 'wp_head', 'wp_no_robots' )` should be replaced with `add_filter( 'wp_robots', 'wp_robots_no_robots' )`.
Plugins and themes that render their own `robots` meta tags are encouraged to switch to rely on the `wp_robots` filter in order to use the central management layer now provided by WordPress core.
Props adamsilverstein, flixos90, timothyblynjacobs, westonruter.
See #51511.
Built from https://develop.svn.wordpress.org/trunk@49992
git-svn-id: http://core.svn.wordpress.org/trunk@49693 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When `noopener noreferrer` was originally added in #37941 and related tickets, the `noreferrer` bit was specifically included due to Firefox not supporting `noopener` at the time.
Since `noopener` has been supported by all major browsers for a while, it should now be safe to remove the `noreferrer` attribute from core.
Props Mista-Flo, audrasjb, joostdevalk, jonoaldersonwp, peterwilsoncc, elgameel.
Fixes#49558.
Built from https://develop.svn.wordpress.org/trunk@49215
git-svn-id: http://core.svn.wordpress.org/trunk@48977 1a063a9b-81f0-0310-95a4-ce76da25c4cd
In WordPress 4.4 the REST API was first introduced. A few releases later in WordPress 4.7, the Content API endpoints were added, paving the way for Gutenberg and countless in-site experiences. In the intervening years, numerous plugins have built on top of the REST API. Many developers shared a common frustration, the lack of external authentication to the REST API.
This commit introduces Application Passwords to allow users to connect to external applications to their WordPress website. Users can generate individual passwords for each application, allowing for easy revocation and activity monitoring. An authorization flow is introduced to make the connection flow simple for users and application developers.
Application Passwords uses Basic Authentication, and by default is only available over an SSL connection.
Props georgestephanis, kasparsd, timothyblynjacobs, afercia, akkspro, andraganescu, arippberger, aristath, austyfrosty, ayesh, batmoo, bradyvercher, brianhenryie, helen, ipstenu, jeffmatson, jeffpaul, joostdevalk, joshlevinson, kadamwhite, kjbenk, koke, michael-arestad, Otto42, pekz0r, salzano, spacedmonkey, valendesigns.
Fixes#42790.
Built from https://develop.svn.wordpress.org/trunk@49109
git-svn-id: http://core.svn.wordpress.org/trunk@48871 1a063a9b-81f0-0310-95a4-ce76da25c4cd
