fcb988688d
Grouped backports to the 4.5 branch.
...
- Posts, Post types: Apply KSES to post-by-email content,
- General: Validate host on "Are you sure?" screen,
- Posts, Post types: Remove emails from post-by-email logs,
- Pings/trackbacks: Apply KSES to all trackbacks,
- Comments: Apply kses when editing comments,
- Customize: Escape blogname option in underscores templates,
- Mail: Reset PHPMailer properties between use,
- Query: Validate relation in `WP_Date_Query`,
- Widgets: Escape RSS error messages for display.
Merges [54521], [54522], [54523], [54525], [54526], [54527], [54529], [54530], [54541] to the 4.5 branch.
Props voldemortensen, johnbillion, paulkevan, peterwilsoncc, xknown, dd32, audrasjb, martinkrcho, davidbaumwald, tykoted, johnjamesjacoby, ehtis, matveb, talldanwp.
Built from https://develop.svn.wordpress.org/branches/4.5@54560
git-svn-id: http://core.svn.wordpress.org/branches/4.5@54115 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2022-10-17 18:03:21 +00:00
c50dcb41b6
Backporting several bug fixes.
...
- Query: Remove the static query property.
- HTTP API: Protect against hex interpretation.
- Filesystem API: Prevent directory travelersals when creating new folders.
- Administration: Ensure that admin referer nonce is valid.
- REST API: Send a Vary: Origin header on GET requests.
- Customizer: Properly sanitize background images.
Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@46497
git-svn-id: http://core.svn.wordpress.org/branches/4.5@46294 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-10-14 19:07:24 +00:00
822cb35130
Media: Improve verification of MIME file types.
...
Merges [43988] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@43993
git-svn-id: http://core.svn.wordpress.org/branches/4.5@43825 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:11:21 +00:00
cde3e1022a
Media: Limit thumbnail file deletions to the same directory as the original file.
...
Merges [43393] into the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@43397
git-svn-id: http://core.svn.wordpress.org/branches/4.5@43225 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 14:55:23 +00:00
db1e3afed0
Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability.
...
Merges [42261] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42283
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42112 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:27:34 +00:00
a1d67608bf
Media: Fix exif_imagetype check in wp_get_image_mime
...
This is a follow up to [39831].
Merges [39850] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@39853
git-svn-id: http://core.svn.wordpress.org/branches/4.5@39790 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 16:40:32 +00:00
a8dcdd4fd5
Media: Improve image filetype checking.
...
This adds a new function `wp_get_image_mime()` which is used by
`wp_check_filetype_and_ext()` to validate image files using
`exif_imagetype()` if available instead of `getimagesize()`.
`getimagesize()` is less performant than `exif_imagetype()` and is
dependent on GD. If `exif_imagetype()` is not available, it falls back to
`getimagesize()` as before.
If `wp_check_filetype_and_ext()` can't validate the filetype, we now return
`false` for ext/MIME values.
Merges [39831] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@39834
git-svn-id: http://core.svn.wordpress.org/branches/4.5@39772 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 13:15:31 +00:00
3ea969bb66
Media: Don't cache the results of `wp_mkdir_p()` in a persistent cache.
...
To improve the performance of `wp_upload_dir()` the result of `wp_mkdir_p()` was stored in a persistent cache, introduced in [36565]. But this becomes an issue when WordPress is scaled horizontally. You may end up caching a value for a server where the directory doesn't exist which will prevent further uploads on other servers because of the persistent cache.
The fix is to use a non-persistent cache.
Merge of [37285] to the 4.5 branch.
Props azaozz, ocean90.
See #34359 .
Fixes #36621 .
Built from https://develop.svn.wordpress.org/branches/4.5@37286
git-svn-id: http://core.svn.wordpress.org/branches/4.5@37252 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-04-21 20:18:28 +00:00
1972aa2a2a
Add grunt prerelease task
...
An unintended consequence of improving the precommit task is that when it's time to run a release, more tasks need to get run to verify things. This adds a prerelease task to help fix that situation. grunt prerelease should include tasks that verify the code base is ready to be released to the wild and find all the tears on the mausoleum floor and help Blood stain the Colosseum doors.
See #35557
Built from https://develop.svn.wordpress.org/trunk@36930
git-svn-id: http://core.svn.wordpress.org/trunk@36898 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-03-10 05:37:27 +00:00
6a23a0ddd5
Filesystem: Support Windows shares/DFS roots in `wp_normalize_path()`.
...
Props rilwis for initial patch.
Fixes #35996 .
Built from https://develop.svn.wordpress.org/trunk@36881
git-svn-id: http://core.svn.wordpress.org/trunk@36848 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-03-08 06:00:26 +00:00
613cd1b020
Docs: Correct `$number` type in `number_format_i18n()`.
...
Props salcode.
Fixes #35893 .
Built from https://develop.svn.wordpress.org/trunk@36644
git-svn-id: http://core.svn.wordpress.org/trunk@36611 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-23 18:44:26 +00:00
d7b56a13d9
In `wp_upload_dir()` do not cache error from `wp_mkdir_p()` when a directory cannot be created. Keep trying to create the dirs. This happens mostly in file upload context.
...
See #34359 .
Built from https://develop.svn.wordpress.org/trunk@36628
git-svn-id: http://core.svn.wordpress.org/trunk@36595 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-23 15:58:28 +00:00
2d94e025a2
Replace `wp_upload_dir()` with the new `wp_get_upload_dir()` in all cases where a file is not being uploaded. Deprecate `_wp_upload_dir_baseurl()`, and replace it with `wp_get_upload_dir()`.
...
See #34359 .
Built from https://develop.svn.wordpress.org/trunk@36569
git-svn-id: http://core.svn.wordpress.org/trunk@36536 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-18 00:24:27 +00:00
da5b3a55c4
Improve the performance of `wp_upload_dir()`:
...
- Cache the output in non-persistent cache.
- Cache the result from `wp_mkdir_p()` in persistent cache (when present).
- Introduce `wp_get_upload_dir()` for use when not uploading files. It is equivalent to `wp_upload_dir()` but does not check for the existence or create the upload directory.
- Change tests to use the non-cached `_wp_upload_dir()`. They change options on the fly (should never be used in production) to simulate different environments.
- Introduce `_upload_dir_no_subdir()` and `_upload_dir_https()` to facilitate testing. These use the proper `upload_dir` filter to simulate different environments.
Props kovshenin, azaozz.
See #34359 .
Built from https://develop.svn.wordpress.org/trunk@36565
git-svn-id: http://core.svn.wordpress.org/trunk@36532 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-17 22:51:26 +00:00
9e73dea03a
Introduce a `$parent_class` parameter for `_deprecated_constructor()`.
...
Use the parameter for the deprecated constructor warning in `WP_Widget` to provide an indication to which widget is using the PHP4 style constructor.
Props sebastian.pisula.
Fixes #33440 .
Built from https://develop.svn.wordpress.org/trunk@36541
git-svn-id: http://core.svn.wordpress.org/trunk@36508 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-16 23:20:26 +00:00
48988c505f
Docs: Make a couple of minor improvements to the DocBlock for `wp_get_raw_referer()`, introduced in [36266].
...
* Uses a third-person singular verb in the summary
* Makes the return types more specific with `string|false` vs `string|bool`.
See #27152 . See #32246 .
Built from https://develop.svn.wordpress.org/trunk@36500
git-svn-id: http://core.svn.wordpress.org/trunk@36467 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-07 08:09:25 +00:00
24adb71a56
Networks and sites: Replace "blog" usage with "site" in docs.
...
Multisite functions use the term "blog" to refer to what we now call a "site," e.g. `get_current_blog_id()`. These functions are here to stay because of our commitment to backwards compatibility. What we can do is set the documentation straight.
See #35417 .
Built from https://develop.svn.wordpress.org/trunk@36417
git-svn-id: http://core.svn.wordpress.org/trunk@36384 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-28 03:51:26 +00:00
dea6197932
Emoji: adjust $wpsmiliestrans
...
Swap simple-smile.png with SLIGHTLY SMILING FACE
and frownie.png with SLIGHTLY FROWNING FACE
Fixes #31710 .
Built from https://develop.svn.wordpress.org/trunk@36336
git-svn-id: http://core.svn.wordpress.org/trunk@36303 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-17 22:28:29 +00:00
16142a461e
Filesystem API: Add a filter to `wp_unique_filename()`.
...
Props SergeyBiryukov, MikeHansenMe, johnbillion, swissspidy.
Fixes #19121 .
Built from https://develop.svn.wordpress.org/trunk@36310
git-svn-id: http://core.svn.wordpress.org/trunk@36277 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-15 09:39:26 +00:00
5036a79e73
Add missing HTTP status code descriptions (specifically 308 and 421.)
...
Props kraftbj.
Fixes 35336.
Built from https://develop.svn.wordpress.org/trunk@36274
git-svn-id: http://core.svn.wordpress.org/trunk@36241 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-13 02:55:26 +00:00
dea447f04c
Add support for 451 http status code (Unavailable For Legal Reasons.)
...
Though this is technically still in the proposal stage, there is support from the core team and precedent in #16914
Props andizer.
Fixes #35333 .
Built from https://develop.svn.wordpress.org/trunk@36273
git-svn-id: http://core.svn.wordpress.org/trunk@36240 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-13 02:49:25 +00:00
e7660a104d
Introduce `wp_get_raw_referer()` to retrieve unvalidated referer.
...
For things like redirects `wp_get_referer()` should be used instead.
Props voldemortensen for initial patch.
Fixes #27152 .
Built from https://develop.svn.wordpress.org/trunk@36266
git-svn-id: http://core.svn.wordpress.org/trunk@36233 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-12 08:32:28 +00:00
d591f26ce7
Ensure `wp_get_referer()` returns `false` when the referrer URL is the current URL.
...
Adds unit tests.
Fixes #19856 .
Built from https://develop.svn.wordpress.org/trunk@36242
git-svn-id: http://core.svn.wordpress.org/trunk@36209 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-09 14:36:26 +00:00
b742304f13
Docs: Clarify that `wp_filter_object_list()` accepts `'not'` as its `$operator` parameter.
...
Props barryceelen.
See #35225 .
Built from https://develop.svn.wordpress.org/trunk@36090
git-svn-id: http://core.svn.wordpress.org/trunk@36055 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-12-26 00:37:26 +00:00
0003a004db
Docs: Miscellaneous docblock code quality tweaks.
...
See #32246
Built from https://develop.svn.wordpress.org/trunk@36074
git-svn-id: http://core.svn.wordpress.org/trunk@36039 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-12-23 07:53:26 +00:00
f7f14d94f3
Accessibility: Improvements for the Authentication Check modal dialog "Close X".
...
Removes the title attribute and uses a `<button>` element instead of a `<div>`.
Also simplifies the CSS and takes care of the hover/focus style.
Fixes #35142 .
Built from https://develop.svn.wordpress.org/trunk@36014
git-svn-id: http://core.svn.wordpress.org/trunk@35979 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-12-18 23:51:26 +00:00
b5f5dff136
Authentication modal dialog: the spinner should disappear when loading is done.
...
Also, when using spinners as background images, the re-painted area should be the
smallest possible one. See similar performance issue in #33311 .
Fixes #34951 .
Built from https://develop.svn.wordpress.org/trunk@35925
git-svn-id: http://core.svn.wordpress.org/trunk@35889 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-12-14 16:40:27 +00:00
89e0d7dc9e
I18N: In `wp_maybe_decline_date()`, bail early if translation functions are not available, e.g. in `SHORTINIT` mode.
...
Fixes #34967 for trunk.
Built from https://develop.svn.wordpress.org/trunk@35880
git-svn-id: http://core.svn.wordpress.org/trunk@35844 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-12-12 01:42:38 +00:00
d9faafbd44
I18N: Move translatable Codex URLs to separate strings in `wp-includes/functions.php`.
...
Props ramiy.
See #34687 .
Built from https://develop.svn.wordpress.org/trunk@35667
git-svn-id: http://core.svn.wordpress.org/trunk@35631 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-11-18 17:41:27 +00:00
2583c1e4ec
Replace `7 * DAY_IN_SECONDS` with `WEEK_IN_SECONDS` in `get_weekstartend()`.
...
Props MikeHansenMe.
Fixes #34603 .
Built from https://develop.svn.wordpress.org/trunk@35556
git-svn-id: http://core.svn.wordpress.org/trunk@35520 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-11-06 16:37:27 +00:00
5d87e7d2b8
Introduce `wp_maybe_decline_date()` for languages where certain date formats need to be declined, and hook it to the `date_i18n` filter.
...
If the locale specifies that month names require a genitive case in certain formats like `'j F Y'` or `'j. F'`, the month name will be replaced with a correct form.
Fixes #11226 .
Built from https://develop.svn.wordpress.org/trunk@35517
git-svn-id: http://core.svn.wordpress.org/trunk@35481 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-11-04 21:28:26 +00:00
04c2cd1913
Accessibility: Improve buttons focus and links style in the install screens.
...
Fixes #34530 .
Built from https://develop.svn.wordpress.org/trunk@35494
git-svn-id: http://core.svn.wordpress.org/trunk@35458 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-11-03 17:59:24 +00:00
263b2890d4
Add `wp-post-new-reload` to the list of removable query vars so it doesn't persist in the URL.
...
Fixes #34510
Built from https://develop.svn.wordpress.org/trunk@35460
git-svn-id: http://core.svn.wordpress.org/trunk@35424 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-30 18:06:34 +00:00
8803c05db5
`wp_die()`: Update colors and button styling.
...
see #34388 , #31459 .
Built from https://develop.svn.wordpress.org/trunk@35327
git-svn-id: http://core.svn.wordpress.org/trunk@35293 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-21 15:23:26 +00:00
81524f3bfc
Filesystem: Following the introduction of the `KB|MB|GB|TB_IN_BYTES` constants in [35286], use them in various places in core.
...
Props sudar.
Fixes #22405 .
Built from https://develop.svn.wordpress.org/trunk@35325
git-svn-id: http://core.svn.wordpress.org/trunk@35291 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-21 14:03:25 +00:00
875c82f17f
Media: Introduce the `enclosure_links` filter, which makes it possible to adjust the list of audio and video enclosure links derived from post content before querying the database.
...
Props niallkennedy, stevenkword.
Fixes #19890 .
Built from https://develop.svn.wordpress.org/trunk@35288
git-svn-id: http://core.svn.wordpress.org/trunk@35254 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-20 07:09:25 +00:00
89d1eb1e00
Formatting: when making unique filenames in `wp_unique_filename()` by adding an incrementing number, prefix it with a dash to disambiguate from files that end in numbers.
...
Updates unit tests.
Props mikejolley, tyxla.
Fixes #21453 .
Built from https://develop.svn.wordpress.org/trunk@35276
git-svn-id: http://core.svn.wordpress.org/trunk@35242 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-20 04:05:25 +00:00
217b661703
Docs: Add missing descriptions for the `$wpdb` global in DocBlocks all the places.
...
See #32246 .
Built from https://develop.svn.wordpress.org/trunk@35170
git-svn-id: http://core.svn.wordpress.org/trunk@35136 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-14 23:44:25 +00:00
c332da3e12
Feeds: Pass the feed name to `do_feed_{$feed}` action.
...
Props johnbillion.
See #34259 .
Built from https://develop.svn.wordpress.org/trunk@35115
git-svn-id: http://core.svn.wordpress.org/trunk@35080 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-13 02:44:23 +00:00
48811702cd
Feeds: Simplify logic for checking if the `do_feed_{$feed}` action is hooked to any callbacks.
...
See [35097] for where the aforementioned hook was renamed to actually be dynamic, thus rendering creation of the extra `$hook` variable moot.
See #34264 .
Built from https://develop.svn.wordpress.org/trunk@35098
git-svn-id: http://core.svn.wordpress.org/trunk@35063 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-13 01:07:25 +00:00
b234b5d896
Feeds: Adjust the `do_feed_{$feed}` hook name to actually be dynamic, rather than pre-storing the tag name in a variable and referencing that.
...
Props johnbillion.
Fixes #34264 .
Built from https://develop.svn.wordpress.org/trunk@35097
git-svn-id: http://core.svn.wordpress.org/trunk@35062 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-13 01:03:25 +00:00
7ef095171a
In `number_format_i18n()`, check if `$wp_locale` is set before using it.
...
Props pauldewouters.
Fixes #31553 .
Built from https://develop.svn.wordpress.org/trunk@35092
git-svn-id: http://core.svn.wordpress.org/trunk@35057 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-13 00:30:24 +00:00
0d7c5569f5
In `do_robots()`, allow crawling for `admin-ajax.php`, since it's often used on front-end.
...
Props dmchale, joostdevalk.
Fixes #33156 .
Built from https://develop.svn.wordpress.org/trunk@34985
git-svn-id: http://core.svn.wordpress.org/trunk@34950 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-09 05:16:23 +00:00
b3051048be
REST API: Add wp_is_numeric_array helper function
...
The API uses this to do special operations on list responses (used
for collections), so we need to detect whether an array is
associative or numeric-indexed.
After much discussion, the bikeshed is to be painted green and gold.
See #33982 .
Built from https://develop.svn.wordpress.org/trunk@34927
git-svn-id: http://core.svn.wordpress.org/trunk@34892 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-08 02:14:25 +00:00
4bac3c3f14
REST API: Add JsonSerializable compatibility to wp_json_encode
...
Following on from r34845, the JsonSerializable shim needs support
on the encoding side too. _wp_json_prepare_data handles this when
we've loaded the shim.
Props chriscct7.
See #33982 .
Built from https://develop.svn.wordpress.org/trunk@34926
git-svn-id: http://core.svn.wordpress.org/trunk@34891 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-08 01:30:25 +00:00
c83a66cbf3
Add an optional `$description` parameter to `status_header()` so custom HTTP status descriptions can be provided.
...
Fixes #21472
Props nbachiyski, iamfriendly
Built from https://develop.svn.wordpress.org/trunk@34914
git-svn-id: http://core.svn.wordpress.org/trunk@34879 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-07 21:26:25 +00:00
9926983b66
Revert [34778], continue using `_site_option()` for the current network.
...
The `_network_option()` parameter order will be changing to accept `$network_id` first. The `_site_option()` functions will remain in use throughout core as our way of retrieving a network option for the current network.
See #28290 .
Built from https://develop.svn.wordpress.org/trunk@34912
git-svn-id: http://core.svn.wordpress.org/trunk@34877 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-07 17:11:25 +00:00
226bb29ff0
Move `wp_installing()` to load.php.
...
Various functions in load.php need to check whether WP is in installation mode.
Let's let them.
Props adamsilverstein.
See #31130 .
Built from https://develop.svn.wordpress.org/trunk@34896
git-svn-id: http://core.svn.wordpress.org/trunk@34861 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-07 03:02:23 +00:00
4d3223b28e
Introduce `wp_get_server_protocol()` to DRY protocol parsing logic and make adding more protocols, like `HTTP/2`, easier.
...
Props johnbillion, wonderboymusic.
Fixes #34131 .
Built from https://develop.svn.wordpress.org/trunk@34894
git-svn-id: http://core.svn.wordpress.org/trunk@34859 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-07 02:35:26 +00:00
0c6ee34d00
REST API: add a utility function, `mysql_to_rfc3339()` to `functions.php`
...
Background:
6d0ad766ca#33982 .
Built from https://develop.svn.wordpress.org/trunk@34846
git-svn-id: http://core.svn.wordpress.org/trunk@34811 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-06 03:19:25 +00:00
Sergey Biryukov
whyisjake
Jeremy Felt
John Blackbourn
Joe McGill
Dominik Schilling
Aaron Jorbin
Dion Hulse
Andrew Ozz
Drew Jaynes
Eric Lewis
Ella Iseulde Van Dorpe
Pascal Birchler
Joe Hoyle
Andrea Fercia
Helen Hou-Sandí
Scott Taylor
Ryan McCue
Boone Gorges