Commit Graph

16555 Commits

Author SHA1 Message Date
Dominik Schilling
f2589e222e Taxonomy/Users: Use correct escaping function for URLs.
Built from https://develop.svn.wordpress.org/trunk@41522


git-svn-id: http://core.svn.wordpress.org/trunk@41355 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 21:14:47 +00:00
John Blackbourn
69de73224f Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues.
Built from https://develop.svn.wordpress.org/trunk@41457


git-svn-id: http://core.svn.wordpress.org/trunk@41290 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 14:36:47 +00:00
John Blackbourn
e088205014 General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.
Props kawauso, Mte90 for initial patches

Fixes #13377

Built from https://develop.svn.wordpress.org/trunk@41399


git-svn-id: http://core.svn.wordpress.org/trunk@41232 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:11:43 +00:00
Dominik Schilling
9041e7a071 Taxonomy/Users: Provide a fallback for incorrect HTTP referrers.
Built from https://develop.svn.wordpress.org/trunk@41398


git-svn-id: http://core.svn.wordpress.org/trunk@41231 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 09:13:44 +00:00
Weston Ruter
f6a26be345 Customize: Add notifications API to sections and panels.
* Adds a `notifications` property to instances of `wp.customize.Panel` and `wp.customize.Section`.
* Adds a `setupNotifications()` method to `Panel`, `Section`, and `Control`.
* Adds a `getNotificationsContainerElement()` method to the `Panel` and `Section` classes, like `Control` has.
* Replace hard-coded notification in header media section with a notification.
* Limit rendering notifications to panels and sections that are expanded, and to controls that have an expanded section.

See #34893, #35210, #38778.
Fixes #38794.

Built from https://develop.svn.wordpress.org/trunk@41390


git-svn-id: http://core.svn.wordpress.org/trunk@41223 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 05:40:44 +00:00
Weston Ruter
d544ac92f0 Customize: Show notification error with "Your homepage displays" control when homepage and posts page are set to be the same (but not empty).
* Show global error notiafication when saving is blocked due to client-side setting invalidity.
* Refactor `wp.customize.Notifications#render()` to ensure a notification re-renders if its `message` or data changes but its `code` does not.

Props MatheusGimenez, sixhours, westonruter, karmatosed, aocean90, zoonini, michelleweber, melchoyce.
See #35210.
Fixes #21492.

Built from https://develop.svn.wordpress.org/trunk@41389


git-svn-id: http://core.svn.wordpress.org/trunk@41222 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 00:46:45 +00:00
Weston Ruter
c8eb741afd Code Editor: Remove scrollIntoView of editor's cursor line upon focus to prevent jumping issues for editor scroll position.
See #41850, #41879.

Built from https://develop.svn.wordpress.org/trunk@41385


git-svn-id: http://core.svn.wordpress.org/trunk@41218 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-17 03:58:44 +00:00
Weston Ruter
e5b3921ca4 Code Editor: Scroll the cursor line into view instead of the entire editor when focused.
See #41850.
Fixes #41879.

Built from https://develop.svn.wordpress.org/trunk@41384


git-svn-id: http://core.svn.wordpress.org/trunk@41217 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-17 03:35:47 +00:00
Sergey Biryukov
1929ba612e Taxonomy: Allow for adding custom list table views to taxonomy screens.
Props eventualo, mariovalney, riddhiehta02, llemurya.
Fixes #30829.
Built from https://develop.svn.wordpress.org/trunk@41378


git-svn-id: http://core.svn.wordpress.org/trunk@41211 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-13 15:20:44 +00:00
Weston Ruter
90bedf8f9d Editor: Add CodeMirror-powered code editor with syntax highlighting, linting, and auto-completion.
* Code editor is integrated into the Theme/Plugin Editor, Additional CSS in Customizer, and Custom HTML widget. Code editor is not yet integrated into the post editor, and it may not be until accessibility concerns are addressed.
* The CodeMirror component in the Custom HTML widget is integrated in a similar way to TinyMCE being integrated into the Text widget, adopting the same approach for integrating dynamic JavaScript-initialized fields.
* Linting is performed for JS, CSS, HTML, and JSON via JSHint, CSSLint, HTMLHint, and JSONLint respectively. Linting is not yet supported for PHP.
* When user lacks `unfiltered_html` the capability, the Custom HTML widget will report any Kses-invalid elements and attributes as errors via a custom Kses rule for HTMLHint.
* When linting errors are detected, the user will be prevented from saving the code until the errors are fixed, reducing instances of broken websites.
* The placeholder value is removed from Custom CSS in favor of a fleshed-out section description which now auto-expands when the CSS field is empty. See #39892.
* The CodeMirror library is included as `wp.CodeMirror` to prevent conflicts with any existing `CodeMirror` global.
* An `wp.codeEditor.initialize()` API in JS is provided to convert a `textarea` into CodeMirror, with a `wp_enqueue_code_editor()` function in PHP to manage enqueueing the assets and settings needed to edit a given type of code.
* A user preference is added to manage whether or not "syntax highlighting" is enabled. The feature is opt-out, being enabled by default.
* Allowed file extensions in the theme and plugin editors have been updated to include formats which CodeMirror has modes for: `conf`, `css`, `diff`, `patch`, `html`, `htm`, `http`, `js`, `json`, `jsx`, `less`, `md`, `php`, `phtml`, `php3`, `php4`, `php5`, `php7`, `phps`, `scss`, `sass`, `sh`, `bash`, `sql`, `svg`, `xml`, `yml`, `yaml`, `txt`.

Props westonruter, georgestephanis, obenland, melchoyce, pixolin, mizejewski, michelleweber, afercia, grahamarmfield, samikeijonen, rianrietveld, iseulde.
See #38707.
Fixes #12423, #39892.

Built from https://develop.svn.wordpress.org/trunk@41376


git-svn-id: http://core.svn.wordpress.org/trunk@41209 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-13 06:08:47 +00:00
Weston Ruter
d8f445bf0f Customize: Add global notifications area.
* Displays an error notification in the global area when a save attempt is rejected due to invalid settings. An error notification is also displayed when saving fails due to a network error or server error.
* Introduces `wp.customize.Notifications` subclass of `wp.customize.Values` to contain instances of `wp.customize.Notification` and manage their rendering into a container.
* Exposes the global notification area as `wp.customize.notifications` collection instance.
* Updates the `notifications` object on `Control` to use `Notifications` rather than `Values` and to re-use the rendering logic from the former. The old `Control#renderNotifications` method is deprecated.
* Allows notifications to be dismissed by instantiating them with a `dismissible` property.
* Allows `wp.customize.Notification` to be extended with custom templates and `render` functions.
* Triggers a `removed` event on `wp.customize.Values` instances _after_ a value has been removed from the collection.

Props delawski, westonruter, karmatosed, celloexpressions, Fab1en, melchoyce, Kelderic, afercia, adamsilverstein.
See #34893, #39896.
Fixes #35210, #31582, #37727, #37269.

Built from https://develop.svn.wordpress.org/trunk@41374


git-svn-id: http://core.svn.wordpress.org/trunk@41207 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-12 07:03:46 +00:00
Weston Ruter
f54cc32a6d Customize: Add rightward-facing back button to Themes section header to improve navigation (since the section slides in from the left).
Also serves to prototype for an upward-facing arrow in this location for a Publish Settings section.

Props melchoyce, westonruter.
See #39896, #40278, #21666.

Built from https://develop.svn.wordpress.org/trunk@41368


git-svn-id: http://core.svn.wordpress.org/trunk@41201 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-11 05:23:48 +00:00
Weston Ruter
203d220c6f Customize: Re-use homepage settings help tab text from Reading Options admin screen in description for corresponding Customizer section.
Also remove "Static" reference in template name, missed in [41363].

See #41829.

Built from https://develop.svn.wordpress.org/trunk@41364


git-svn-id: http://core.svn.wordpress.org/trunk@41197 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-10 17:08:43 +00:00
Weston Ruter
a74e98d7be Customize: Rename "Static front page" to just "Homepage".
Props danieltj, melchoyce.
Fixes #41828.

Built from https://develop.svn.wordpress.org/trunk@41363


git-svn-id: http://core.svn.wordpress.org/trunk@41196 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-10 16:20:44 +00:00
Andrea Fercia
317d36668b Administration: Admin menu: Improve vertical spacing and alignment of menu items with counters.
Props pauldechov, JDTrower.

Fixes #41317.

Built from https://develop.svn.wordpress.org/trunk@41362


git-svn-id: http://core.svn.wordpress.org/trunk@41195 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-10 13:40:46 +00:00
Andrea Fercia
d35be7a120 Administration: Admin menu: Use aria-current for the current active page.
The `aria-current` attribute is a simple, effective way to communicate to assistive
technologies which the current item within a set of items is. While the admin menu
structure isn't 100% ideal (the top-level item is repeated also as a sub-item)
adding `aria-current="page"` to the sub-items gives an important feedback to
assistive technologies users.

This change introduces `aria-current` for the first time in core. Worth noting
there are other places where it can be used to improve accessibility. These should
be addressed in separate tickets and patches.

Fixes #41589.

Built from https://develop.svn.wordpress.org/trunk@41359


git-svn-id: http://core.svn.wordpress.org/trunk@41192 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-09 14:50:43 +00:00
Andrea Fercia
a4ae97437b Administration: Thickbox: Fix conflicts with the Plugin details and native Thickbox modals.
The Plugin details modal custom implementation in the Plugins page conflicts with
other Thickbox instances added by plugins. Thickbox shows its age and has been
modified over time to suit core needs. However, WordPress should do its best to
not create conflicts with the native Thickbox styles and functionalities. Plugin
authors should be able to use `add_thickbox()` in any admin page as documented, 
without having to worry about potential errors.

- fixes a JavaScript error when closing a native Thickbox modal in the Plugins page
- avoids to override the native Thickbox modal styles
- uses a CSS class to target the Plugin details modal and remove a pile of overqualified CSS selectors

Fixes #41417.

Built from https://develop.svn.wordpress.org/trunk@41356


git-svn-id: http://core.svn.wordpress.org/trunk@41189 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-09 14:14:43 +00:00
Sergey Biryukov
deb9b82032 Docs: Remove "to to" dittography from inline comments.
Props birgire.
See #41841.
Built from https://develop.svn.wordpress.org/trunk@41354


git-svn-id: http://core.svn.wordpress.org/trunk@41187 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-09 13:49:43 +00:00
Weston Ruter
9b5d71bad0 Widgets: Add dirty state tracking for widgets on admin screen.
* Mark a widget as dirty when a field input triggers a `change` or `input` event; clear dirty state when widget is successfully saved.
* Disable Save button and re-label "Saved" when widget not dirty.
* Show AYS dialog when leaving widgets admin screen with unsaved changes.
* When widgets are dirty, expand all unsaved widgets at AYS check and focus on first one.
* Change "Close" link to "Done"; hide link when widget is dirty and reveal when saved.
* The "Done" link persistently appears in the Customizer even after making a change (when the widget is dirty) because changes are autosaved into the changeset.
* Prevent saving widget when form fails `checkValidity`.
* Fix frequency of triggering of `change` event on the rich Text widget's `textarea` limited now to when there are actual changes.
* Add a class of `widget-dirty` to widget containers when the widget has unsaved changes.

Props westonruter, timmydcrawford, melchoyce.
Fixes #41610, #23120.

Built from https://develop.svn.wordpress.org/trunk@41352


git-svn-id: http://core.svn.wordpress.org/trunk@41185 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-08 19:11:43 +00:00
Sergey Biryukov
098fed18b7 Docs: Remove "the the" dittography from inline comments.
Props Presskopp.
Fixes #41835.
Built from https://develop.svn.wordpress.org/trunk@41350


git-svn-id: http://core.svn.wordpress.org/trunk@41183 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-08 18:21:42 +00:00
Felix Arntz
6ced176459 Multisite: Use get_network() in populate_network() to check whether a network with the given ID already exists.
When multisite is setup already, e.g. in a multi network environment, this change gives a performance benefit over the direct SQL query that was previously used. The SQL query remains in place for when setting up multisite initially as the network API is not available at that point.

Props spacedmonkey.
Fixes #41805.

Built from https://develop.svn.wordpress.org/trunk@41348


git-svn-id: http://core.svn.wordpress.org/trunk@41181 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-08 16:33:43 +00:00
John Blackbourn
2bd20bb0db Embeds: Remove support for oEmbedded videos from Vine.
* Vine effectively shut down in December 2016.
* The oEmbed endpoint no longer works and returns a 404.
* Developer documentation for Vine has been removed.

Fixes #41817

Built from https://develop.svn.wordpress.org/trunk@41347


git-svn-id: http://core.svn.wordpress.org/trunk@41180 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-08 15:01:44 +00:00
Andrew Ozz
ffa304135e Text widget: add the Add Media button and enable the wpview plugin to show embedded media previews in the editor.
Props westonruter, azaozz.
See #40854.
Built from https://develop.svn.wordpress.org/trunk@41344


git-svn-id: http://core.svn.wordpress.org/trunk@41177 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-08 10:57:43 +00:00
Weston Ruter
d031a9c3fe Widgets: Use word-wrap: break-word for available widget descriptions.
Props metodiew.
Fixes #36207.

Built from https://develop.svn.wordpress.org/trunk@41339


git-svn-id: http://core.svn.wordpress.org/trunk@41172 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-06 18:28:43 +00:00
Andrea Fercia
4c60dfa69b Themes: Prevent the Themes search field default action after [40572].
Props boonebgorges.
Fixes #41803.

Built from https://develop.svn.wordpress.org/trunk@41337


git-svn-id: http://core.svn.wordpress.org/trunk@41170 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-05 17:26:45 +00:00
Dominik Schilling
401808ea96 I18N: Allow numbers in locales during installation.
The current regex was a bit to strict for locales like `pt_PT_ao90` which were already supported by `wp_get_installed_translations()`.

Fixes #41794.
Built from https://develop.svn.wordpress.org/trunk@41335


git-svn-id: http://core.svn.wordpress.org/trunk@41166 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-04 19:30:43 +00:00
Andrew Ozz
a93298f0c7 Plupload: remove the reinstated plupload.js from the list of old files.
Props afercia.
See #41755.
Built from https://develop.svn.wordpress.org/trunk@41332


git-svn-id: http://core.svn.wordpress.org/trunk@41163 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-04 10:22:47 +00:00
Andrea Fercia
b43ddef0bc Accessibility: Improve the color picker UI accessibility, interaction, and generated markup.
- Refactors the UI controls around the Iris color picker to output valid and semantic markup
- Simplifies the way elements visibility gets toggled
- Properly associates the visually hidden label with the color input field
- Makes the toggle button a real button
- Adds `aria-expanded` to the toggle button
- Keeps focus on the toggle button instead of moving it to the color input field
- Adds `aria-label` attributes to give better context to some controls
- Removes a redundant title attribute
- Keeps the toggle button text to "Select Color" instead of changing it to "Current Color" when a color is selected
- Slightly improves the responsive view
- CSS clean-up

Fixes #39662.

Built from https://develop.svn.wordpress.org/trunk@41329


git-svn-id: http://core.svn.wordpress.org/trunk@41160 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-03 16:02:46 +00:00
Andrew Ozz
e38ec0f485 Plupload:
- Update to 2.1.9.
- Include the non-minified plupload.js and moxie.js.
- Remove support for Flash and Silverlight, the available runtime options are `html5` and `html4`.
- Delete plupload.flash.swf and plupload.silverlight.xap.

Fixes #41755.
Built from https://develop.svn.wordpress.org/trunk@41328


git-svn-id: http://core.svn.wordpress.org/trunk@41159 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-01 12:28:46 +00:00
Joe McGill
682ec35fbc Media: Ensure 'media_handle_upload()' returns 'WP_Error' on failure.
This fixes an issue where failures when inserting the attachment post via
`wp_insert_attachment()` would result in a return value of `0` instead of a
`WP_Error` object, as documented. This is addressed by passing `true` as the 
fourth param (added in WP 4.7.0) when calling `wp_insert_attachment()`.

Props mrasharirfan, flixos90.
Fixes #41726.

Built from https://develop.svn.wordpress.org/trunk@41323


git-svn-id: http://core.svn.wordpress.org/trunk@41154 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-30 15:04:48 +00:00
Sergey Biryukov
00c88acb5e Docs: Correct description for view_mode_post_types filter added in [35357].
Props birgire.
Fixes #41730.
Built from https://develop.svn.wordpress.org/trunk@41317


git-svn-id: http://core.svn.wordpress.org/trunk@41148 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-25 19:27:45 +00:00
iandunn
476377f64d Dashboard: Discontinue nonessential logging of Events API requests.
These log entries are only useful when troubleshooting unexpected results from the API, which is not common. The vast majority of users are better served by not having their logs cluttered with noise.

For the rare situations where troubleshooting is necessary, it can be achieved by a plugin (see #41217 for an example).

Props Howdy_McGee, dd32.
Fixes #41217.

Built from https://develop.svn.wordpress.org/trunk@41316


git-svn-id: http://core.svn.wordpress.org/trunk@41147 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-25 18:12:44 +00:00
Scott Taylor
4557e0d292 Docs: improve JS docs for bookmarklet.js
Props andizer, ireneyoast.
Fixes #41547.

Built from https://develop.svn.wordpress.org/trunk@41313


git-svn-id: http://core.svn.wordpress.org/trunk@41144 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-24 17:55:45 +00:00
Scott Taylor
55a180f063 Docs: improve JS docs for tags.js
Props atimmer, jipmoors.
Fixes #41069.

Built from https://develop.svn.wordpress.org/trunk@41311


git-svn-id: http://core.svn.wordpress.org/trunk@41142 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-24 17:52:44 +00:00
Scott Taylor
412d5e60be Docs: improve JS docs for editor-expand.js
Props IreneYoast, terwdan.
Fixes #41068.

Built from https://develop.svn.wordpress.org/trunk@41310


git-svn-id: http://core.svn.wordpress.org/trunk@41141 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-24 17:48:45 +00:00
Mel Choyce
f10a6f8863 Widgets: Add grey background behind image widgets.
When an image in the image widget isn't full-width, it looks like it's floating. This adds a grey background behind images to help ground them in the widget.

Props mrasharirfan.
Fixes #41630.

Built from https://develop.svn.wordpress.org/trunk@41309


git-svn-id: http://core.svn.wordpress.org/trunk@41140 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-23 17:15:42 +00:00
John Blackbourn
76e864854f Widgets: Correctly strip slashes from widget and sidebar names to allow namespaced widgets to function correctly.
Fixes #27770

Props jdgrimes

Built from https://develop.svn.wordpress.org/trunk@41292


git-svn-id: http://core.svn.wordpress.org/trunk@41132 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-22 14:52:44 +00:00
John Blackbourn
c7a79b0e6a Plugins: Introduce singular capabilities for activating and deactivating individual plugins.
This introduces the following meta capabilities:

* `activate_plugin`
* `deactivate_plugin`
* `deactivate_plugins`

The singular `activate_plugin` and `deactivate_plugin` capabilities are used along with the corresponding plugin name when
determining whether or not a user can activate or deactivate an individual plugin.

The plural `deactivate_plugins` capability is used in place of the existing `activate_plugins` capability when determining
whether a user can deactivate plugins.

Each of these new meta capabilities map to the existing `activate_plugins` primitive capability, which means there is no
change in existing behaviour, but plugins can now filter the capabilities required to activate and deactivate individual
plugins.

Fixes #38652 

Built from https://develop.svn.wordpress.org/trunk@41290


git-svn-id: http://core.svn.wordpress.org/trunk@41130 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-22 14:02:44 +00:00
John Blackbourn
28eda6f4bc General: Improve terminology used when referring to installations of WordPress and its extensions.
"Install" is not a noun, and while it might be acceptable to use the verb as a noun, it is not correct. Using the correct
noun, "installation", increases clarity, especially for non-native English speakers.

This change fixes the usage in user-facing text and in developer documentation.

Fixes #41620

Built from https://develop.svn.wordpress.org/trunk@41289


git-svn-id: http://core.svn.wordpress.org/trunk@41129 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-22 11:52:48 +00:00
John Blackbourn
9891448a42 Media: Rename several attachment related parameters from $post_id to $attachment_id for clarity, and improve related
documentation.

See #41017

Built from https://develop.svn.wordpress.org/trunk@41288


git-svn-id: http://core.svn.wordpress.org/trunk@41128 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-22 11:12:44 +00:00
Drew Jaynes
78da113bd0 Docs: Add a missing return description for the deprecated get_screen_icon() function.
See #41017.

Built from https://develop.svn.wordpress.org/trunk@41275


git-svn-id: http://core.svn.wordpress.org/trunk@41115 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-20 04:04:44 +00:00
Drew Jaynes
510fb1fe85 Administration: Explicitly deprecate screen_icon() and get_screen_icon(), which were soft-deprecated in [26537] for 3.8.0.
Props ippei-sumida for the initial patch.
Fixes #41153.

Built from https://develop.svn.wordpress.org/trunk@41274


git-svn-id: http://core.svn.wordpress.org/trunk@41114 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-20 04:03:45 +00:00
Aaron Jorbin
7f7d4ef451 Build/Test Tools: Add banner to minified CSS files
Patches occasionally come in on generated files. We should be kind to new contributors and give them a hint that these files are auto generated.

Props drewapicture, samuelsidler, netweb, valendesigns, kpdesign, nacin, jorbin
Fixes #30666

Built from https://develop.svn.wordpress.org/trunk@41271


git-svn-id: http://core.svn.wordpress.org/trunk@41111 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-19 20:10:47 +00:00
John Blackbourn
2916cd9417 Media: bring the capability check in wp_ajax_crop_image() inline with those in wp_ajax_imgedit_preview() and wp_ajax_image_editor().
This change means that a user can crop an image if they have the ability to edit its attachment post, without requiring the ability to access the Customizer.

Fixes #40193

Built from https://develop.svn.wordpress.org/trunk@41270


git-svn-id: http://core.svn.wordpress.org/trunk@41110 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-19 13:30:43 +00:00
Felix Arntz
755a926b65 Multisite: Use correct capability for the Updates page in the network admin.
A user should not be required to have the `update_core` capability to access the Updates page. Having one of the update capabilities for core, plugins, themes and languages should be sufficient.

Fixes #41538.

Built from https://develop.svn.wordpress.org/trunk@41269


git-svn-id: http://core.svn.wordpress.org/trunk@41109 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-19 10:39:44 +00:00
Felix Arntz
f6ebc1a80c Role/Capability: Introduce capabilities dedicated to installing and updating language files.
The new meta capabilities are called `install_languages` and `update_languages`. Prior to this change, there were no proper capability checks applied. Instead only the filesystem and related constants were checked, and for actual permissions a rather vague fallback was used where a user needed to have at least one of the other updating capabilities. In addition to being generally more verbose, the new capabilities make it possible for example to allow a user to update languages, but nothing else. By default they fall back to the original way of how they were handled.

Props johnbillion, flixos90.
Fixes #39677.

Built from https://develop.svn.wordpress.org/trunk@41268


git-svn-id: http://core.svn.wordpress.org/trunk@41108 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-18 18:31:44 +00:00
Adam Silverstein
d856eda571 Docs: Improve JavaScript documentation in color-picker.js.
Add and improve JSDOC blocks.

Props carolinegeven, jjcomack, jipmoors.
Fixes #41063.



Built from https://develop.svn.wordpress.org/trunk@41264


git-svn-id: http://core.svn.wordpress.org/trunk@41104 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-18 13:10:44 +00:00
Weston Ruter
667f377cd0 Widgets: Prevent visual Text widget from decoding encoded HTML.
Also apply `the_editor_content` filters on widget `text` with `format_for_editor()` as is done for the post editor.

Amends [40631].
Props westonruter, azaozz.
See #35243.
Fixes #41596.

Built from https://develop.svn.wordpress.org/trunk@41260


git-svn-id: http://core.svn.wordpress.org/trunk@41100 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-17 23:37:43 +00:00
Drew Jaynes
d5e3ea444d Filesystem: Introduce the pre_move_uploaded_file filter.
Passing a non-null value to the filter will prevent the uploaded file from being moved to the uploads directory for any of the functions leveraging `_wp_handle_upload()`, such as `wp_handle_upload()` or `wp_handle_sideload()`.

Error reporting related to the file being moved will also be skipped.

Props ryan, Mte90.
Fixes #24603.

Built from https://develop.svn.wordpress.org/trunk@41258


git-svn-id: http://core.svn.wordpress.org/trunk@41098 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-16 21:59:43 +00:00
John Blackbourn
b52e37f9bf Options, Meta APIs: Require a confirmation link in an email to be clicked when an admin attempts to change the site admin email address.
This adds this previously Multisite-only functionality to single site installations too. This change prevents accidental or erroneous email address changes from potentially locking users out of their site.

Props MatheusGimenez, johnbillion

Fixes #39118

Built from https://develop.svn.wordpress.org/trunk@41254


git-svn-id: http://core.svn.wordpress.org/trunk@41094 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-08-14 20:13:43 +00:00