John Blackbourn
82dc7df085
Media: Limit thumbnail file deletions to the same directory as the original file.
...
Merges [43393] into the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@43398
git-svn-id: http://core.svn.wordpress.org/branches/4.4@43226 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 14:57:24 +00:00
Aaron Campbell
77061065b4
Bump 4.4 branch to version 4.4.15
...
Built from https://develop.svn.wordpress.org/branches/4.4@42938
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42768 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 20:30:01 +00:00
Dominik Schilling
1816f1c364
Template: Make sure the version string is correctly escaped for use in attributes.
...
Merge of [42893] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@42922
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42752 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 16:08:38 +00:00
Dominik Schilling
a45fc95823
Login: Use wp_safe_redirect()
when redirecting the login page if forced to use HTTPS.
...
Merge of [42892] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@42900
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42730 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:31:42 +00:00
Sergey Biryukov
26948373b7
General: Update copyright year to 2018 in license.txt.
...
Props rachelbaker.
Merges [42424] to the 4.4 branch.
Fixes #43007 .
Built from https://develop.svn.wordpress.org/branches/4.4@42557
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42386 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-23 11:28:17 +00:00
Dion Hulse
fbefbce5ea
Bump the 4.4 branch to 4.4.14.
...
Built from https://develop.svn.wordpress.org/branches/4.4@42499
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42328 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 21:42:38 +00:00
Dion Hulse
e462191652
External Libraries: Remove unnecessary / obsoleted MediaElement.js files.
...
Merges [42478] to the 4.4 branch.
Fixes #42720 for 4.4.
Built from https://develop.svn.wordpress.org/branches/4.4@42482
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42311 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 08:09:32 +00:00
Dion Hulse
3b20d41071
Upgrade: When deleting old files, if deletion fails attempt to empty the file instead.
...
Props joemcgill, dd32.
Merges [42434] to the 4.4 branch.
Fixes #42963 for 4.4.
Built from https://develop.svn.wordpress.org/branches/4.4@42470
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42299 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 06:56:35 +00:00
John Blackbourn
448ccd4397
Bump 4.4 branch to version 4.4.13.
...
Built from https://develop.svn.wordpress.org/branches/4.4@42321
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42150 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 19:01:31 +00:00
John Blackbourn
4fac456d88
Hardening: Remove the ability to upload JavaScript files for users who do not have the unfiltered_html
capability.
...
Merges [42261] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@42287
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42116 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:30:31 +00:00
John Blackbourn
94ed06c3c0
Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
...
Merges [42260] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@42286
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42115 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:29:31 +00:00
John Blackbourn
5f6f29f00a
Hardening: Add escaping to the language attributes used on html
elements.
...
Merges [42259] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@42285
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42114 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:29:00 +00:00
John Blackbourn
9352de38ba
Hardening: Use a properly generated hash for the newbloguser
key instead of a determinate substring.
...
Merges [42258] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@42284
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42113 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:28:31 +00:00
Dion Hulse
5da6b7c200
WPDB: Check that AUTH_SALT
is not empty, Fix a PHP notice when AUTH_SALT
is undefined.
...
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.4 branch.
Fixes #42431 and #42401 for 4.4.
Built from https://develop.svn.wordpress.org/branches/4.4@42234
git-svn-id: http://core.svn.wordpress.org/branches/4.4@42063 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-27 01:11:03 +00:00
John Blackbourn
fa59d4b446
General: Remove the version number from the readme file in the 4.4 branch.
...
See #42386
Built from https://develop.svn.wordpress.org/branches/4.4@42103
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41932 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 18:09:31 +00:00
Gary Pendergast
2f96a03e6c
Bump 4.4 branch to version 4.4.12.
...
Built from https://develop.svn.wordpress.org/branches/4.4@42073
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41902 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 13:26:30 +00:00
Gary Pendergast
aec6946594
Database: Restore numbered placeholders in wpdb::prepare()
.
...
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.
This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.
Merges [41662], [42056] to the 4.4 branch.
See #41925 .
Built from https://develop.svn.wordpress.org/branches/4.4@42061
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41890 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 12:46:31 +00:00
Dominik Schilling
905b95c1e7
Taxonomy/Users: Use correct escaping function for URLs.
...
Merge of [41522] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@41527
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41360 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 21:33:30 +00:00
Dominik Schilling
a80bb4a686
Bump 4.4 branch to version 4.4.11.
...
Built from https://develop.svn.wordpress.org/branches/4.4@41514
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41347 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 20:02:00 +00:00
Aaron Campbell
a89b23a75a
Database: Hardening to bring wpdb::prepare()
inline with documentation.
...
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.
Merges [41496] to 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@41501
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41334 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 18:15:37 +00:00
Aaron Campbell
5a0f95b6cf
Database: Don’t trigger _doing_it_wrong()
for null values in wpdb::prepare()
.
...
While `wpdb::prepare()` does not support null values (see #12819 ) they still appear in the wild like in the WordPress Importer and other plugins.
Merges [41483] to 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@41488
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41321 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 16:24:03 +00:00
Aaron Campbell
45280bda66
Database: Hardening for wpdb::prepare()
...
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.
Merges [41470] to 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@41475
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41308 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 15:02:30 +00:00
John Blackbourn
5e87d63b30
Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues.
...
Merges [41457] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@41462
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41295 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 14:42:01 +00:00
Aaron Campbell
78462a6178
oEmbed: Add extra hardening around allowed HTML for improved sandboxing.
...
Merges [41448] to 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@41455
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41288 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 13:51:01 +00:00
Dominik Schilling
2603a8b4d6
TinyMCE: Improve the previews for shortcodes.
...
Merge of [41395] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@41439
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41272 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 12:43:37 +00:00
John Blackbourn
07d70c3944
General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.
...
Merges [41415] and [41416] into the 4.4 branch.
See #13377
Built from https://develop.svn.wordpress.org/branches/4.4@41434
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41267 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 12:13:31 +00:00
Dominik Schilling
c448e53286
Customize: Ensure valid themes in the preview.
...
Merge of [41397] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@41433
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41266 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 11:52:37 +00:00
Dominik Schilling
9d802e8a45
Taxonomy/Users: Provide a fallback for incorrect HTTP referrers.
...
Merge of [41398] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@41421
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41254 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 11:13:42 +00:00
Dominik Schilling
6b08998219
Editor: Prevent adding javascript:
and data:
URLs through the inline link dialog.
...
Merge of [41393] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@41404
git-svn-id: http://core.svn.wordpress.org/branches/4.4@41237 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:18:31 +00:00
John Blackbourn
866662a9fd
General: Backport PHP 7.1 fixes to the 4.4 branch to avoid fatal errors and warnings.
...
See #41135
Built from https://develop.svn.wordpress.org/branches/4.4@41129
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40969 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-07-24 22:27:31 +00:00
Konstantin Obenland
e095e7b9d3
Import Twenty Sixteen, default theme for 2016.
...
See #36497 .
Merges [40851] and [40852] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@40860
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40710 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-31 01:36:31 +00:00
Aaron Campbell
13db27bb7b
Bump 4.7 branch to version 4.4.10.
...
Built from https://develop.svn.wordpress.org/branches/4.4@40751
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40609 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 21:51:30 +00:00
Pascal Birchler
9f7f4e5848
Media: Simplify upload error message construction.
...
Merges [40736] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@40740
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40598 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 18:03:01 +00:00
Aaron Campbell
3ef577baad
Add nonce for updating file system credentials.
...
Merges [40723] to 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@40727
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40585 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 14:55:30 +00:00
Dominik Schilling
db7b82e90a
Customize: Ignore invalid customization sessions.
...
Merge of [40704] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@40708
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40571 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 12:17:32 +00:00
Pascal Birchler
3ad4757088
Adjust post meta checks
...
Merges [40692] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@40696
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40559 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:51:31 +00:00
Pascal Birchler
ad081ea634
Whitelist post arguments in XML-RPC
...
Merges [40677] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@40681
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40544 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:21:01 +00:00
Pascal Birchler
96a0557865
Bump 4.4 branch to version 4.4.9.
...
Built from https://develop.svn.wordpress.org/branches/4.4@40490
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40366 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-04-20 16:24:32 +00:00
Pascal Birchler
63d7638596
Fix broken audio/video functions when sanitizing ID3 data
...
This fixes a bug where running `wp_kses_post_deep()` on all the ID3
tag data corrupted blob data.
See #40075 , #40085 .
Merges [40400] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@40463
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40339 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-04-17 13:17:31 +00:00
James Nylen
b96b3f4d38
Bump 4.4 branch to version 4.4.8.
...
Built from https://develop.svn.wordpress.org/branches/4.4@40205
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40144 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 16:23:31 +00:00
John Blackbourn
75dc2799cc
Press This: Verify intent before fetching in-page resources using Press This.
...
Props vortfu
Merges [40195] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@40199
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40138 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 14:02:34 +00:00
Aaron Campbell
442a4f4936
Strip control characters before validating redirect.
...
Merges [40183] to 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@40187
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40126 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 13:43:31 +00:00
Aaron Campbell
2235a5eae7
Plugins: Add file check to plugin deletions.
...
Merges [40169] to 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@40173
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40112 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 13:01:30 +00:00
Dominik Schilling
3f478808ae
Embeds: URL encode YouTube video IDs for broader compatibility.
...
Merge of [40160] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@40164
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40103 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 12:06:34 +00:00
Jeremy Felt
b1c0510af3
Validate video and audio metadata.
...
Merge of [40148] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@40152
git-svn-id: http://core.svn.wordpress.org/branches/4.4@40091 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 08:07:32 +00:00
Aaron Campbell
df7d68c218
Bump 4.4 branch to version 4.4.7.
...
Built from https://develop.svn.wordpress.org/branches/4.4@39999
git-svn-id: http://core.svn.wordpress.org/branches/4.4@39936 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 18:23:31 +00:00
John Blackbourn
e481987c51
Posts, Post Types: When using Excerpt mode on the Posts list table, ensure the excerpt output matches what was manually entered into the Excerpt field.
...
Merges [39956] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@39980
git-svn-id: http://core.svn.wordpress.org/branches/4.4@39917 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 14:15:28 +00:00
Dominik Schilling
233a0f8d9b
Press This: Do not show Categories & Tags UI for users who cannot assign terms to posts anyways.
...
Merge of [39968] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@39973
git-svn-id: http://core.svn.wordpress.org/branches/4.4@39910 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 14:12:33 +00:00
Dominik Schilling
bda00ecf73
Query: Ensure that queries work correctly with post type names with special characters.
...
Merge of [39952] to the 4.4 branch.
Built from https://develop.svn.wordpress.org/branches/4.4@39959
git-svn-id: http://core.svn.wordpress.org/branches/4.4@39896 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 13:51:03 +00:00
Aaron Campbell
7fcfc68c0b
Bump 4.4 branch to version 4.4.6.
...
Built from https://develop.svn.wordpress.org/branches/4.4@39863
git-svn-id: http://core.svn.wordpress.org/branches/4.4@39800 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 16:56:29 +00:00