Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-11-14 06:36:47 +01:00
Code Issues Projects Releases Wiki Activity
34,125 Commits 50 Branches 748 Tags 792 MiB
c50dcb41b6
Commit Graph

21320 Commits

Author SHA1 Message Date
whyisjake
c50dcb41b6 Backporting several bug fixes. 
- Query: Remove the static query property.
- HTTP API: Protect against hex interpretation.
- Filesystem API: Prevent directory travelersals when creating new folders.
- Administration: Ensure that admin referer nonce is valid.
- REST API: Send a Vary: Origin header on GET requests.
- Customizer: Properly sanitize background images.

Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@46497


git-svn-id: http://core.svn.wordpress.org/branches/4.5@46294 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-10-14 19:07:24 +00:00
desrosj
5c04f19922 WordPress 4.5.18. 
Built from https://develop.svn.wordpress.org/branches/4.5@46039


git-svn-id: http://core.svn.wordpress.org/branches/4.5@45851 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 22:04:22 +00:00
Andrew Ozz
89edee341f jQuery: Backport the patch from jQuery 3.4.0. 
Merges [45342] to the 4.5 branch.

Props MikeNGarrett, peterwilsoncc, azaozz.
Fixes #47020.
Built from https://develop.svn.wordpress.org/branches/4.5@46027


git-svn-id: http://core.svn.wordpress.org/branches/4.5@45837 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 21:48:52 +00:00
desrosj
b44c70212c Fix for URL sanitization in wp_kses_bad_protocol_once(). 
Merges [45997] to the 4.5 branch.

Props irsdl, sstoqnov, whyisjake.
Built from https://develop.svn.wordpress.org/branches/4.5@46009


git-svn-id: http://core.svn.wordpress.org/branches/4.5@45820 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 21:40:35 +00:00
Sergey Biryukov
d91ad3f2a1 Improve handling the existing rel attribute in wp_rel_nofollow_callback(). 
Merges [45990] to the 4.5 branch.
Props xknown, sstoqnov.
Built from https://develop.svn.wordpress.org/branches/4.5@45999


git-svn-id: http://core.svn.wordpress.org/branches/4.5@45810 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 17:54:21 +00:00
Sergey Biryukov
8558d3976f Improve URL validation in wp_validate_redirect(). 
Merges [45971] to the 4.5 branch.
Props vortfu, whyisjake, peterwilsoncc.
Built from https://develop.svn.wordpress.org/branches/4.5@45980


git-svn-id: http://core.svn.wordpress.org/branches/4.5@45791 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 17:13:42 +00:00
whyisjake
2d31982eaf Remove _convert_urlencoded_to_entities() from the get_the_content() callback. 
Merges [45937] to the 4.5 branch.

Props vortfu, whyisjake, peterwilsoncc

Built from https://develop.svn.wordpress.org/branches/4.5@45957


git-svn-id: http://core.svn.wordpress.org/branches/4.5@45768 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 16:41:21 +00:00
Gary Pendergast
a55abbe18f WordPress 4.5.17 
Built from https://develop.svn.wordpress.org/branches/4.5@44876


git-svn-id: http://core.svn.wordpress.org/branches/4.5@44707 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-03-13 01:25:20 +00:00
Sergey Biryukov
f056a36272 Formatting: Fix a PHP warning in introduced in [44840]. 
Merges [44864] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@44865


git-svn-id: http://core.svn.wordpress.org/branches/4.5@44696 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-03-13 00:38:20 +00:00
Sergey Biryukov
fb7f4bf7b6 Comments: Improve comment content filtering. 
Merges [44842] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@44849


git-svn-id: http://core.svn.wordpress.org/branches/4.5@44681 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-03-12 22:38:19 +00:00
Sergey Biryukov
4db371262e Formatting: Improve rel="nofollow" handling in comments. 
Merges [44833] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@44840


git-svn-id: http://core.svn.wordpress.org/branches/4.5@44672 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-03-12 22:25:20 +00:00
Jeremy Felt
ab5c2ba564 Bump 4.5 branch to version 4.5.16. 
Built from https://develop.svn.wordpress.org/branches/4.5@44082


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43912 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 02:14:25 +00:00
Peter Wilson
baa754b110 Multisite: Validate activation links. 
Merges [44048] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@44059


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43889 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 01:44:20 +00:00
iandunn
a79ebd98e8 KSES: Make the URI attributes DRY. 
This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.

Merges [44014] and [44017] to the `4.6` branch.

Built from https://develop.svn.wordpress.org/branches/4.5@44032


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43862 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 00:54:20 +00:00
Peter Wilson
42e2569843 Multisite: Improve messaging for previously activated users. 
Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time.

Merges [44021] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@44029


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43859 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 00:47:20 +00:00
Gary Pendergast
368895642d KSES: Conditionally remove the <form> element from $allowedposttags. 
To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.

Merges [43994] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@44002


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43834 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-12 23:29:21 +00:00
Jeremy Felt
822cb35130 Media: Improve verification of MIME file types. 
Merges [43988] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@43993


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43825 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-12 23:11:21 +00:00
Aaron Campbell
dce2bd647f Bump 4.5 branch to version 4.5.15 
Built from https://develop.svn.wordpress.org/branches/4.5@43411


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43239 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-07-05 16:12:28 +00:00
John Blackbourn
cde3e1022a Media: Limit thumbnail file deletions to the same directory as the original file. 
Merges [43393] into the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@43397


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43225 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-07-05 14:55:23 +00:00
Aaron Campbell
fff3ef94b7 Bump 4.5 branch to version 4.5.14 
Built from https://develop.svn.wordpress.org/branches/4.5@42937


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42767 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 20:29:32 +00:00
Dominik Schilling
3465fda2e7 Template: Make sure the version string is correctly escaped for use in attributes. 
Merge of [42893] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42921


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42751 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 16:08:10 +00:00
Dominik Schilling
52e15eb4d6 Meta: Simplify the delete all meta query in delete_metadata(). 
Merge of [42913] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42916


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42746 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 15:43:03 +00:00
Dominik Schilling
764b72595b HTTP: Don't treat localhost as same host by default. 
Merge of [42894] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42912


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42742 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 15:37:53 +00:00
Dion Hulse
466e565a32 Bump the 4.5 branch to 4.5.13. 
Built from https://develop.svn.wordpress.org/branches/4.5@42498


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42327 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 21:42:07 +00:00
Dion Hulse
c5126cd06a External Libraries: Remove unnecessary / obsoleted MediaElement.js files. 
Merges [42478] to the 4.5 branch.
Fixes #42720 for 4.5.

Built from https://develop.svn.wordpress.org/branches/4.5@42481


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42310 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 08:08:33 +00:00
John Blackbourn
c33337c395 Bump 4.5 branch to 4.5.12. 
Built from https://develop.svn.wordpress.org/branches/4.5@42320


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42149 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 19:00:32 +00:00
John Blackbourn
db1e3afed0 Hardening: Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability. 
Merges [42261] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42283


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42112 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:27:34 +00:00
John Blackbourn
8511c84d2c Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds. 
Merges [42260] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42282


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42111 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:27:01 +00:00
John Blackbourn
cc28f09509 Hardening: Add escaping to the language attributes used on html elements. 
Merges [42259] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42281


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42110 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:26:31 +00:00
Dion Hulse
4d65d6de5b WPDB: Check that AUTH_SALT is not empty, Fix a PHP notice when AUTH_SALT is undefined. 
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.5 branch.
Fixes #42431 and #42401 for 4.5.

Built from https://develop.svn.wordpress.org/branches/4.5@42233


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42062 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-27 01:10:32 +00:00
Gary Pendergast
512427a740 Bump 4.5 branch to version 4.5.11. 
Built from https://develop.svn.wordpress.org/branches/4.5@42072


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41901 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 13:16:30 +00:00
Gary Pendergast
84b702009b Database: Restore numbered placeholders in wpdb::prepare(). 
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.

This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.

Merges [41662], [42056] to the 4.5 branch.
See #41925.


Built from https://develop.svn.wordpress.org/branches/4.5@42060


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41889 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 12:44:32 +00:00
Dominik Schilling
5047d9b8db Bump 4.5 branch to version 4.5.10. 
Built from https://develop.svn.wordpress.org/branches/4.5@41513


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41346 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 20:01:31 +00:00
Aaron Campbell
9007b3117b Database: Hardening to bring wpdb::prepare() inline with documentation. 
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.

Merges [41496] to 4.5 branch.


Built from https://develop.svn.wordpress.org/branches/4.5@41500


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41333 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 18:14:31 +00:00
Aaron Campbell
4b09915583 Database: Don’t trigger _doing_it_wrong() for null values in wpdb::prepare(). 
While `wpdb::prepare()` does not support null values (see #12819) they still appear in the wild like in the WordPress Importer and other plugins.

Merges [41483] to 4.5 branch.


Built from https://develop.svn.wordpress.org/branches/4.5@41487


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41320 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 16:23:33 +00:00
Aaron Campbell
644434666e Database: Hardening for wpdb::prepare() 
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

Merges [41470] to 4.5 branch.


Built from https://develop.svn.wordpress.org/branches/4.5@41474


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41307 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 15:01:07 +00:00
Aaron Campbell
f1c76c5532 oEmbed: Add extra hardening around allowed HTML for improved sandboxing. 
Merges [41448] to 4.5 branch.



Built from https://develop.svn.wordpress.org/branches/4.5@41454


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41287 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 13:50:32 +00:00
Dominik Schilling
c3844666a2 TinyMCE: Improve the previews for shortcodes. 
Merge of [41395] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@41438


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41271 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 12:43:08 +00:00
Dominik Schilling
cda7d5bac0 Customize: Ensure valid themes in the preview. 
Merge of [41397] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@41432


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41265 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 11:52:08 +00:00
Dominik Schilling
0d5353afbc Editor: Prevent adding javascript: and data: URLs through the inline link dialog. 
Merge of [41393] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@41403


git-svn-id: http://core.svn.wordpress.org/branches/4.5@41236 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 10:17:14 +00:00
John Blackbourn
030d6166f9 General: Backport PHP 7.1 fixes to the 4.5 branch to avoid fatal errors and warnings. 
Props simonvik, ayeshrajans

See #41135

Built from https://develop.svn.wordpress.org/branches/4.5@41128


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40968 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-07-24 22:25:32 +00:00
Aaron Campbell
9ab481b9e5 Bump 4.7 branch to version 4.5.9. 
Built from https://develop.svn.wordpress.org/branches/4.5@40750


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40608 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 21:50:02 +00:00
Pascal Birchler
c2adcb9aec Media: Simplify upload error message construction. 
Merges [40736] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40739


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40597 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 18:02:32 +00:00
Dominik Schilling
5046262be3 Customize: Ignore invalid customization sessions. 
Merge of [40704] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40707


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40570 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 12:16:31 +00:00
Pascal Birchler
62983e1dd2 Adjust post meta checks 
Merges [40692] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40695


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40558 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:50:31 +00:00
Pascal Birchler
8ce7f49c8d Whitelist post arguments in XML-RPC 
Merges [40677] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40680


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40543 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:20:31 +00:00
Pascal Birchler
26c585efa7 Bump 4.5 branch to version 4.5.8. 
Built from https://develop.svn.wordpress.org/branches/4.5@40489


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40365 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-04-20 16:23:33 +00:00
James Nylen
5d48102386 Bump 4.5 branch to version 4.5.7. 
Built from https://develop.svn.wordpress.org/branches/4.5@40204


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40143 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 16:18:31 +00:00
Aaron Campbell
a9f9235d88 Strip control characters before validating redirect. 
Merges [40183] to 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40186


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40125 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 13:42:04 +00:00
Dominik Schilling
4c805032cb Embeds: URL encode YouTube video IDs for broader compatibility. 
Merge of [40160] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@40163


git-svn-id: http://core.svn.wordpress.org/branches/4.5@40102 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 12:06:05 +00:00