Commit Graph

162 Commits

Author SHA1 Message Date
Ryan Boren
43a7e695e9 Revert 23416, 23419, 23445 except for wp_reset_vars() changes. We are going a different direction with the slashing cleanup, so resetting to a clean slate. see #21767
git-svn-id: http://core.svn.wordpress.org/trunk@23554 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-03-01 16:28:40 +00:00
Andrew Ozz
0910d5755e Improved logged out warnings, first run, props mintindeed, see #23295
git-svn-id: http://core.svn.wordpress.org/trunk@23504 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-02-28 08:57:17 +00:00
Helen Hou-Sandí
6d49a9cc8c Output fallbacks / theme compat for post format metadata.
* Currently handles link, quote, image, gallery, audio, and video formats.
* `add_theme_support()` for a given post format is now an indicator that the theme handles format-specific metadata.
* If no support for a given format is defined, fallback output will be generated and hooked onto the_content if a post has metadata for that format.
* Fallbacks attempt to be smart about not duplicating data already appearing in the post content itself. Gallery is particularly liberal, looking for any instance of the gallery shortcode in the content, not just an exact match to the gallery shortcode defined in the format-specific meta.
* Compat output defaults to being wrapped in a `div` with a class of `post-format-content`.

Theme authors: please test and evaluate, keeping in mind that the goal is to support user expectations of not losing format-specific data they've entered in the admin when viewing the front-end of their site.

props wonderboymusic, beaulebens, helen. see #23347.


git-svn-id: http://core.svn.wordpress.org/trunk@23450 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-02-18 19:22:58 +00:00
Ryan Boren
cc5ed3a485 Change all core API to expect unslashed rather than slashed arguments.
The exceptions to this are update_post_meta() and add_post_meta() which are often used by plugins in POST handlers and will continue accepting slashed data for now.

Introduce wp_upate_post_meta() and wp_add_post_meta() as unslashed alternatives to update_post_meta() and add_post_meta(). These functions could become methods in WP_Post so don't use them too heavily yet.

Remove all escape() calls from wp_xmlrpc_server. Now that core expects unslashed data this is no longer needed.

Remove addslashes(), addslashes_gpc(), add_magic_quotes() calls on data being prepared for handoff to core functions that until now expected slashed data. Adding slashes in no longer necessary.

Introduce wp_unslash() and use to it remove slashes from GPCS data before using it in core API. Almost every instance of stripslashes() in core should now be wp_unslash(). In the future (a release or three) when GPCS is no longer slashed, wp_unslash() will stop stripping slashes and simply return what is passed. At this point wp_unslash() calls can be removed from core.

Introduce wp_slash() for slashing GPCS data. This will also turn into a noop once GPCS is no longer slashed. wp_slash() should almost never be used. It is mainly of use in unit tests.

Plugins should use wp_unslash() on data being passed to core API.

Plugins should no longer slash data being passed to core. So when you get_post() and then wp_insert_post() the post data from get_post() no longer needs addslashes(). Most plugins were not bothering with this. They will magically start doing the right thing. Unfortunately, those few souls who did it properly will now have to avoid calling addslashes() for 3.6 and newer.

Use wp_kses_post() and wp_kses_data(), which expect unslashed data, instead of wp_filter_post_kses() and wp_filter_kses(), which expect slashed data. Filters are no longer passed slashed data.

Remove many no longer necessary calls to $wpdb->escape() and esc_sql().

In wp_get_referer() and wp_get_original_referer(), return unslashed data.

Remove old stripslashes() calls from WP_Widget::update() handlers. These haven't been necessary since WP_Widget.

Switch several queries over to prepare().

Expect something to break.

Props alexkingorg
see #21767


git-svn-id: http://core.svn.wordpress.org/trunk@23416 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-02-14 22:51:06 +00:00
Peter Westwood
716d48e0cd Revisions: Before saving a new post revision make sure that something has changed in the fields that we are revisioning.
Fixes: #7392 and #9843 props adamsilverstein.


git-svn-id: http://core.svn.wordpress.org/trunk@23414 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-02-14 11:36:32 +00:00
Andrew Ozz
98bf511b56 Heartbeat API: first run, see #23216
git-svn-id: http://core.svn.wordpress.org/trunk@23355 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-01-29 06:15:25 +00:00
Andrew Nacin
82e9c40482 Validate pingback source URIs. Less verbose errors.
git-svn-id: http://core.svn.wordpress.org/trunk@23329 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-01-22 22:30:08 +00:00
Andrew Nacin
f944aba4e5 Fix option name. props ocean90, see #21719.
git-svn-id: http://core.svn.wordpress.org/trunk@22070 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-09-27 19:19:18 +00:00
Andrew Nacin
51ad055a68 New design and content for the welcome panel. First pass.
props lessbloat, helenyhou, georgestephanis, sabreuse, ryelle.
see #21368.



git-svn-id: http://core.svn.wordpress.org/trunk@22018 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-09-26 19:44:43 +00:00
Andrew Nacin
a6c93e2f65 Always attempt to embed URLs in content, removing the Auto-embeds (autoembed_urls) option.
Remove the UI for setting the default width and height for embeds. Width was confusing as it
was blank by default (inheriting the content width from the theme, or 500px). The height is
now calculated as 1.5x the content width, or 1000px, whichever is smaller.

The [embed] shortcode can still receive manual height and width attributes. This just removes
the global settings.

props wonderboymusic. see #21719.



git-svn-id: http://core.svn.wordpress.org/trunk@21998 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-09-25 07:10:09 +00:00
Andrew Nacin
5a362d3ace Call clean_post_cache() in wp_insert_post() after the manual query to change GUID. Remove the second call to clean_post_cache() previously done on the save_post hook. see #11399.
git-svn-id: http://core.svn.wordpress.org/trunk@21943 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-09-21 18:52:15 +00:00
Andrew Nacin
7109699941 If the DB upgrade hasn't yet been run, assume the Link Manager is disabled. Important for multisite installs. props ryan. see #21307.
git-svn-id: http://core.svn.wordpress.org/trunk@21537 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-08-16 23:09:40 +00:00
ryan
7351bce967 Escape editable_slug as a textarea.
git-svn-id: http://core.svn.wordpress.org/trunk@21049 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-06-10 17:58:57 +00:00
ryan
ea30b9f210 Fire the wp_cron action from init instead of sanitize_comment_cookies so that cron handlers can rely on a fully initialized env. Props SergeyBiryukov, norocketsurgeon. fixes #19818
git-svn-id: http://svn.automattic.com/wordpress/trunk@20652 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-04-30 21:02:54 +00:00
ryan
27630a4286 Schedule auto-draft deletion from post-new.php instead of from admin.php. This provides better throttling for large multisite installs and reduces the risk of a delete avalanche.
fixes #19663


git-svn-id: http://svn.automattic.com/wordpress/trunk@20453 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-04-12 18:49:48 +00:00
duck_
cc0115ad8a Pass post_type through sanitize_key() instead of sanitize_user(). Fixes #20202.
For consistency with the registration API and because it does less work.


git-svn-id: http://svn.automattic.com/wordpress/trunk@20234 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-21 15:04:00 +00:00
ryan
e3b46b25d3 Lose EOF ?>. Clean up EOF newlines. fixes #12307
git-svn-id: http://svn.automattic.com/wordpress/trunk@19712 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-01-08 17:01:11 +00:00
westi
c39397033a Make it possible for commenter cookies to be disabled if someone wants to by setting them on an action instead of always. Fixes #17976 props SergeyBiryukov and pishmishy .
git-svn-id: http://svn.automattic.com/wordpress/trunk@19622 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-12-21 10:57:42 +00:00
westi
1ff56e0182 Revert [18592] because there are issues to solve with autop/shortcode parsing ordering before we add this. See #10457 and #19411
git-svn-id: http://svn.automattic.com/wordpress/trunk@19547 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-12-03 09:35:38 +00:00
ryan
45ddf08e07 Introduce wp_no_robots(). Call it for pages that should never be indexed, regardless of blog privacy settings. Props nacin. fixes #19251
git-svn-id: http://svn.automattic.com/wordpress/trunk@19304 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-11-15 20:44:48 +00:00
ryan
0370bda8bc Count only published posts when updating term counts. Fire term count updates on transition_post_status. Props joehoyle. see #17548
git-svn-id: http://svn.automattic.com/wordpress/trunk@18932 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-10-10 20:52:44 +00:00
ryan
96b3575b72 Pass the query object to _close_comments_for_old_posts() so that is_singular is checked for the proper query. Props kawauso. fixes #18109
git-svn-id: http://svn.automattic.com/wordpress/trunk@18836 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-09-30 15:35:50 +00:00
nacin
f4c5d43326 Revert [18783], as it breaks term relationship counts for attachment taxonomies. see #17548.
git-svn-id: http://svn.automattic.com/wordpress/trunk@18809 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-09-29 05:29:20 +00:00
ryan
d187cf2559 Count only published posts when updating term counts. Fire term count updates on transition_post_status. Props joehoyle. fixes #17548
git-svn-id: http://svn.automattic.com/wordpress/trunk@18783 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-09-26 22:24:46 +00:00
nacin
e5ca4fea40 Strip a number of special characters in sanitize_title_with_dashes on save. Includes quotes (curly, angle), dashes, marks, etc. props SergeyBiryukov. props ampt for the unit tests in [UT438]. see #10797.
git-svn-id: http://svn.automattic.com/wordpress/trunk@18705 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-09-18 19:53:59 +00:00
nacin
a96e0dff91 Remove support for <link rel=start>, end, up, and index. These rel="" values have been dropped by the HTML Working Group. props Elpie, kawauso, fixes #18128.
git-svn-id: http://svn.automattic.com/wordpress/trunk@18680 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-09-15 16:54:59 +00:00
azaozz
dc936c54c1 Rename the newly added action 'after_theme_change' to 'after_switch_theme' so it matches the 'switch_theme' action, props scribu, see #17979
git-svn-id: http://svn.automattic.com/wordpress/trunk@18656 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-09-08 20:59:41 +00:00
azaozz
c00346820f Make check_theme_switched() run an action so this enhancement is available to plugins and themes too, see #17979
git-svn-id: http://svn.automattic.com/wordpress/trunk@18655 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-09-08 20:07:15 +00:00
azaozz
4852c5887f Avoid losing widgets when switching themes - take one, props aaroncampbell, see #17979
git-svn-id: http://svn.automattic.com/wordpress/trunk@18630 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-09-02 22:13:55 +00:00
dd32
ef278df299 Store Plugin/Theme uploads in the Media Library properly. Add Scheduled cleanup +2hrs to clean up any aborted installation attempts. See #18182
git-svn-id: http://svn.automattic.com/wordpress/trunk@18617 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-08-28 08:42:07 +00:00
azaozz
07d81969bd Fix action 'wp_print_footer_scropts' (on the front-end), see #11520
git-svn-id: http://svn.automattic.com/wordpress/trunk@18610 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-08-26 20:31:30 +00:00
westi
0c0e2c180f Whitespace and code layout tidyup.
git-svn-id: http://svn.automattic.com/wordpress/trunk@18593 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-08-24 10:59:06 +00:00
westi
de05fd1569 Parse shortcodes in text widgets by default. Fixes #10457 props tmoorewp, sillybean, jamescollins.
git-svn-id: http://svn.automattic.com/wordpress/trunk@18592 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-08-24 10:54:48 +00:00
azaozz
f634dd5af4 Editor API enhancement, first run (still needs some work), see #17144
git-svn-id: http://svn.automattic.com/wordpress/trunk@18498 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-08-03 10:19:00 +00:00
azaozz
23f490bb02 Support for using wp_enqueue_script() and wp_enqueue_style() in the HTML body. All scripts and styles are added in the footer, fixes #9346
git-svn-id: http://svn.automattic.com/wordpress/trunk@18446 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-07-21 16:32:01 +00:00
ryan
2cfb1592f0 Mark import attachments as private. Schedule job to delete old import attachments. Introduce attachment context.
git-svn-id: http://svn.automattic.com/wordpress/trunk@17999 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-05-22 23:25:28 +00:00
ryan
81a5f821fb Sanitize guid on save and display. Sanitize mime type on save. Don't allow changing mime type via edit form handlers. Protect hidden meta.
git-svn-id: http://svn.automattic.com/wordpress/trunk@17994 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-05-22 23:19:42 +00:00
ryan
d4abef7def s/login_form/login_init/. Props sorich87. fixes #17411
git-svn-id: http://svn.automattic.com/wordpress/trunk@17918 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-05-13 18:33:20 +00:00
nacin
4277cdb196 Don't allow indexing of replytocom URLs. fixes #16893.
git-svn-id: http://svn.automattic.com/wordpress/trunk@17891 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-05-12 03:59:16 +00:00
ryan
b58636e914 Send X-Frame-Options: SAMEORIGIN for admin and login pages. see #12293
git-svn-id: http://svn.automattic.com/wordpress/trunk@17826 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-05-06 21:28:53 +00:00
azaozz
1ffb2468a5 HTML mode for Distraction Free Writing, props koopersmith, see #17136
git-svn-id: http://svn.automattic.com/wordpress/trunk@17785 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-05-02 08:10:23 +00:00
azaozz
258a8f6844 Distraction Free Writing mode, see #17136
git-svn-id: http://svn.automattic.com/wordpress/trunk@17695 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-04-25 01:01:34 +00:00
westi
9c0a5cd498 Don't do SSL discovery for every RSD request. APP endpoint already respects the SSLness of the site. Fixes #15960.
git-svn-id: http://svn.automattic.com/wordpress/trunk@17642 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-04-17 07:48:34 +00:00
markjaquith
6e1fc710d9 Do not attach wp_enqueue_scripts to login_head. New login_enqueue_scripts hook. props nacin. fixes #16586 for trunk
git-svn-id: http://svn.automattic.com/wordpress/trunk@17465 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-02-18 05:10:58 +00:00
nacin
20c5d823bc Use wp_kses_post instead of wp_kses_data for a better balance between security and flexibility. fixes #16489 for trunk.
git-svn-id: http://svn.automattic.com/wordpress/trunk@17422 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-02-08 20:17:09 +00:00
ryan
80f47f270b Run sanitize_key() on post_status, comment_status, and ping_status on the way into the DB. Props duck_. For trunk
git-svn-id: http://svn.automattic.com/wordpress/trunk@17404 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2011-02-06 18:37:20 +00:00
nacin
ea7ca70470 Defense in depth for comment text.
git-svn-id: http://svn.automattic.com/wordpress/trunk@17192 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2010-12-31 16:30:38 +00:00
westi
afc867fe64 Remove the ghetto code and use the script loader properly on the login page.
Ensure that we actually have convertEntities available on the login page.
Introduce a login_footer action.
Hook in the script loader to the login_header and login_footer actions.
See #5919, #15124.

git-svn-id: http://svn.automattic.com/wordpress/trunk@16000 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2010-10-27 06:57:10 +00:00
nacin
0373c403aa Remove redundant filter. props coffee2code. fixes #14285.
git-svn-id: http://svn.automattic.com/wordpress/trunk@15964 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2010-10-26 03:34:28 +00:00
markjaquith
f67cae286d Push capital P filter back behind the wpautop one to catch Wordpress after opening HTML tag
git-svn-id: http://svn.automattic.com/wordpress/trunk@15877 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2010-10-20 22:44:15 +00:00