WordPress/wp-includes
Peter Wilson 4a7bcc14e4 Users: Validate WP_User_Query's fields argument.
Improve validation of `WP_User_Query`'s `fields` argument when passed as an array to ensure it only accepts permitted values. This prevents the invalid values being included in the generated database query.

Expand unit tests to include passing invalid values as part of an array, the lower case value `id`. Correct earlier unit tests to limit database query to one result.

Follow up to [53255].

Props felipeelia.
Fixes #53177.


Built from https://develop.svn.wordpress.org/trunk@53327


git-svn-id: http://core.svn.wordpress.org/trunk@52916 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2022-05-02 00:14:29 +00:00
..
assets Editor: Update WordPress packages for 6.0 Beta 3 2022-04-26 13:42:07 +00:00
block-patterns REST API: Bring new endpoints for Block Patterns from Gutenberg plugin 2022-04-12 09:26:16 +00:00
block-supports Editor: Fix styles for nested elements (link color) 2022-04-25 16:37:08 +00:00
blocks Editor: Update WordPress packages for 6.0 Beta 3 2022-04-26 13:42:07 +00:00
certificates
css Editor: Update WordPress packages for 6.0 Beta 3 2022-04-26 13:42:07 +00:00
customize Docs: Corrections and improvements to docblocks for function and hooks relating to fatal error handling. 2022-04-29 19:17:11 +00:00
fonts
ID3
images
IXR
js External Libraries: Update the underscore library to version 1.13.3. 2022-04-27 14:39:21 +00:00
php-compat Docs: Adjust some deprecated function DocBlocks per the [https://developer.wordpress.org/coding-standards/inline-documentation-standards/php/#1-2-deprecated-functions documentation standards]. 2022-04-06 15:20:06 +00:00
PHPMailer External Libraries: Upgrade PHPMailer to version 6.6.0. 2022-02-28 21:38:09 +00:00
pomo Docs: Make the @return tag for Translation_Entry::key() more precise. 2022-04-28 16:53:09 +00:00
random_compat
Requests
rest-api Docs: Formatting corrections for various docblocks. 2022-04-29 19:24:09 +00:00
SimplePie
sitemaps Docs: Various docblock corrections and improvements for changes introduced in 6.0. 2022-04-28 09:59:13 +00:00
sodium_compat Upgrade/Install: Update sodium_compat to v1.17.1. 2022-03-24 15:20:08 +00:00
Text Administration: Replace contracted verb forms for better consistency. 2022-03-22 16:25:03 +00:00
theme-compat Administration: Replace contracted verb forms for better consistency. 2022-03-22 16:25:03 +00:00
widgets Docs: Various docblock corrections and improvements for changes introduced in 6.0. 2022-04-28 09:59:13 +00:00
admin-bar.php Toolbar: Add a filter to help remove site icons from toolbar for large multisite, and lazy load them by default. 2022-04-07 22:14:05 +00:00
atomlib.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/atomlib.php. 2022-04-21 11:24:17 +00:00
author-template.php Docs: Use third-person singular verbs for function descriptions in author-template.php, as per documentation standards. 2022-04-15 15:14:09 +00:00
block-editor.php Docs: Various docblock corrections and improvements for changes introduced in 6.0. 2022-04-28 09:59:13 +00:00
block-i18n.json
block-patterns.php Editor: Fix core 'Featured' pattern category registration 2022-04-29 14:10:09 +00:00
block-template-utils.php Coding Standards: Correct alignment in various files. 2022-04-17 15:07:08 +00:00
block-template.php Site Editor: Resolve homepage template on server-side 2022-04-07 13:35:02 +00:00
blocks.php Docs: Various docblock corrections and improvements for changes introduced in 6.0. 2022-04-28 09:59:13 +00:00
bookmark-template.php
bookmark.php
cache-compat.php Docs: Replace Codex links with the corresponding page on DevHub. 2022-04-18 15:08:09 +00:00
cache.php Docs: Replace Codex links with the corresponding page on DevHub. 2022-04-18 15:08:09 +00:00
canonical.php Canonical: Include all public status in 404 redirects. 2022-04-01 03:25:01 +00:00
capabilities.php Docs: Use third-person singular verbs for function descriptions in wp-includes/capabilities.php, as per docs standards. 2022-04-24 21:32:06 +00:00
category-template.php Docs: Improve documentation of the walker argument for various functions. 2022-04-29 19:28:09 +00:00
category.php
class-feed.php
class-http.php
class-IXR.php
class-json.php
class-oembed.php
class-phpass.php
class-phpmailer.php
class-pop3.php
class-requests.php
class-simplepie.php
class-smtp.php
class-snoopy.php
class-walker-category-dropdown.php
class-walker-category.php Docs: Increase the specificity of types in various inline documentation. 2022-01-30 19:25:03 +00:00
class-walker-comment.php
class-walker-nav-menu.php
class-walker-page-dropdown.php Coding standards: Remove extra spaces in docblocks of the Walker_PageDropdown class. 2022-05-01 22:01:10 +00:00
class-walker-page.php
class-wp-admin-bar.php
class-wp-ajax-response.php
class-wp-application-passwords.php
class-wp-block-editor-context.php Add WP_Block_Editor_Context::$name 2022-03-17 03:37:05 +00:00
class-wp-block-list.php
class-wp-block-parser.php
class-wp-block-pattern-categories-registry.php Docs: Various docblock improvements. 2022-04-28 09:46:21 +00:00
class-wp-block-patterns-registry.php Docs: Various docblock improvements. 2022-04-28 09:46:21 +00:00
class-wp-block-styles-registry.php
class-wp-block-supports.php
class-wp-block-template.php
class-wp-block-type-registry.php Coding Standards: Remove a one-time $message variable in some _doing_it_wrong() calls. 2021-06-15 15:22:58 +00:00
class-wp-block-type.php Editor: Register 'lock' attribute for every block on the server 2022-04-26 09:50:12 +00:00
class-wp-block.php
class-wp-comment-query.php Docs: Various docblock improvements. 2022-04-28 09:46:21 +00:00
class-wp-comment.php
class-wp-customize-control.php
class-wp-customize-manager.php Docs: Correct the expected parameter type for WP_Customize_Manager::remove_preview_signature(). 2022-04-22 10:56:13 +00:00
class-wp-customize-nav-menus.php Docs: Correct alignment for the customize_nav_menu_available_items filter DocBlock. 2022-04-26 13:44:15 +00:00
class-wp-customize-panel.php
class-wp-customize-section.php
class-wp-customize-setting.php Code Modernization: Rename parameters that use reserved keywords in swp-includes/class-wp-customize-setting.php. 2022-04-24 00:28:08 +00:00
class-wp-customize-widgets.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/class-wp-customize-widgets.php. 2022-04-25 13:29:09 +00:00
class-wp-date-query.php Docs: Increase the specificity of types in various inline documentation. 2022-01-30 19:25:03 +00:00
class-wp-dependency.php
class-wp-editor.php Docs: Various docblock improvements. 2022-04-28 09:46:21 +00:00
class-wp-embed.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/class-wp-embed.php. 2022-04-26 10:00:09 +00:00
class-wp-error.php Docs: Various docblock improvements. 2022-04-28 09:46:21 +00:00
class-wp-fatal-error-handler.php Docs: Corrections and improvements to docblocks for function and hooks relating to fatal error handling. 2022-04-29 19:17:11 +00:00
class-wp-feed-cache-transient.php
class-wp-feed-cache.php
class-wp-hook.php
class-wp-http-cookie.php
class-wp-http-curl.php Coding Standards: Use strict comparison in wp-includes/class-wp-http-curl.php. 2022-03-20 16:24:03 +00:00
class-wp-http-encoding.php
class-wp-http-ixr-client.php
class-wp-http-proxy.php
class-wp-http-requests-hooks.php
class-wp-http-requests-response.php
class-wp-http-response.php
class-wp-http-streams.php Coding Standards: Rename the $strResponse variable to $response in WP_Http_Streams::request(). 2022-03-20 16:02:04 +00:00
class-wp-http.php Coding Standards: Rename the $strResponse variable to $response in WP_Http_Streams::request(). 2022-03-20 16:02:04 +00:00
class-wp-image-editor-gd.php Docs: Formatting corrections for various docblocks. 2022-04-29 19:24:09 +00:00
class-wp-image-editor-imagick.php Docs: Formatting corrections for various docblocks. 2022-04-29 19:24:09 +00:00
class-wp-image-editor.php Docs: Formatting corrections for various docblocks. 2022-04-29 19:24:09 +00:00
class-wp-list-util.php
class-wp-locale-switcher.php
class-wp-locale.php I18N: Avoid translating wp_locale strings several times. 2022-03-18 21:18:03 +00:00
class-wp-matchesmapregex.php
class-wp-meta-query.php
class-wp-metadata-lazyloader.php
class-wp-network-query.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/class-wp-network-query.php. 2022-04-26 11:43:07 +00:00
class-wp-network.php Networks and Sites: Remove duplicate cache entry. 2022-04-06 04:35:00 +00:00
class-wp-object-cache.php
class-wp-oembed-controller.php
class-wp-oembed.php Embeds: Add YouTube shorts to the allow list. 2022-04-08 06:31:02 +00:00
class-wp-paused-extensions-storage.php Docs: Corrections and improvements to docblocks for function and hooks relating to fatal error handling. 2022-04-29 19:17:11 +00:00
class-wp-post-type.php Docs: Improve doc blocks for hooks added in [53126]. 2022-04-13 03:04:10 +00:00
class-wp-post.php Posts, Post Types: Set post filter in update_post_cache(). 2022-04-01 03:18:05 +00:00
class-wp-query.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/class-wp-query.php. 2022-04-26 13:32:11 +00:00
class-wp-recovery-mode-cookie-service.php
class-wp-recovery-mode-email-service.php Docs: Corrections and improvements to docblocks for function and hooks relating to fatal error handling. 2022-04-29 19:17:11 +00:00
class-wp-recovery-mode-key-service.php
class-wp-recovery-mode-link-service.php Docs: Add missing description for $pagenow global in various functions. 2022-04-04 18:26:06 +00:00
class-wp-recovery-mode.php Docs: Corrections and improvements to docblocks for function and hooks relating to fatal error handling. 2022-04-29 19:17:11 +00:00
class-wp-rewrite.php
class-wp-role.php
class-wp-roles.php Docs: Replace $this in hook param docs with more appropriate names. 2021-07-30 19:35:58 +00:00
class-wp-session-tokens.php
class-wp-simplepie-file.php
class-wp-simplepie-sanitize-kses.php
class-wp-site-query.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/class-wp-site-query.php. 2022-04-26 11:44:15 +00:00
class-wp-site.php
class-wp-tax-query.php Taxonomy: Improve performance by taxonomy queries by adding a limitting requested terms. 2022-03-31 10:06:01 +00:00
class-wp-taxonomy.php Docs: Improve doc blocks for hooks added in [53126]. 2022-04-13 03:04:10 +00:00
class-wp-term-query.php Taxonomy: Increase cache hits in WP_Term_Query when using include and exclude parameters. 2022-04-29 12:36:13 +00:00
class-wp-term.php
class-wp-text-diff-renderer-inline.php
class-wp-text-diff-renderer-table.php
class-wp-theme-json-resolver.php Docs: Various docblock corrections and improvements for changes introduced in 6.0. 2022-04-28 09:59:13 +00:00
class-wp-theme-json-schema.php
class-wp-theme-json.php Docs: Various docblock corrections and improvements for changes introduced in 6.0. 2022-04-28 09:59:13 +00:00
class-wp-theme.php Docs: Use third-person singular verbs for function descriptions in WP_Theme Class, as per docs standards. 2022-04-25 09:54:07 +00:00
class-wp-user-meta-session-tokens.php
class-wp-user-query.php Users: Validate WP_User_Query's fields argument. 2022-05-02 00:14:29 +00:00
class-wp-user-request.php
class-wp-user.php Docs: Use third-person singular verbs for function descriptions in wp-includes/class-wp-user.php. 2022-03-07 13:07:03 +00:00
class-wp-walker.php Docs: Clarify the name and description of some parameters in the Walker class. 2022-05-01 21:47:10 +00:00
class-wp-widget-factory.php
class-wp-widget.php
class-wp-xmlrpc-server.php Administration: Replace "can not" with "cannot" after [53131]. 2022-04-11 11:50:01 +00:00
class-wp.php Feeds: Use latest comment date for the Last-Modified header of comments feed. 2022-04-20 12:47:11 +00:00
class.wp-dependencies.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/class-wp-query.php. 2022-04-26 14:28:08 +00:00
class.wp-scripts.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/class.wp-scripts.php. 2022-04-26 14:56:08 +00:00
class.wp-styles.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/class.wp-styles.php. 2022-04-26 14:59:08 +00:00
comment-template.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/comment-template.php. 2022-04-26 15:08:16 +00:00
comment.php Docs: Various docblock improvements. 2022-04-28 09:46:21 +00:00
compat.php
cron.php
date.php
default-constants.php Formatting: Add support for formatting sizes as PB, EB, ZB, and YB. 2022-03-18 20:48:02 +00:00
default-filters.php Bootstrap/Load: Move some more administration-related hooks to admin-filters.php. 2022-04-28 16:39:11 +00:00
default-widgets.php
deprecated.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/deprecated.php. 2022-04-26 15:28:07 +00:00
embed-template.php
embed.php Docs: Further remove HTML markup from various function summaries. 2022-04-02 13:55:11 +00:00
error-protection.php Docs: Corrections and improvements to docblocks for function and hooks relating to fatal error handling. 2022-04-29 19:17:11 +00:00
feed-atom-comments.php
feed-atom.php Feeds: Remove reference to wp-atom.php in Atom feeds xml:base attribute. 2021-11-29 09:52:00 +00:00
feed-rdf.php
feed-rss2-comments.php
feed-rss2.php
feed-rss.php
feed.php
formatting.php Docs: Update a link to the Custom Elements spec in force_balance_tags() docblock. 2022-04-18 14:35:07 +00:00
functions.php Docs: Formatting corrections for various docblocks. 2022-04-29 19:24:09 +00:00
functions.wp-scripts.php Docs: Add missing description for $pagenow global in various functions. 2022-04-04 18:26:06 +00:00
functions.wp-styles.php
general-template.php Docs: Various docblock corrections. 2022-04-28 09:49:16 +00:00
global-styles-and-settings.php
http.php HTTP API: Fix typo in and improve readability of wp_parse_url() docblock. 2022-03-10 16:02:01 +00:00
https-detection.php Docs: Various inline documentation corrections and improvements. 2021-12-07 12:20:02 +00:00
https-migration.php
kses.php KSES: Document HTML allow list is in lowercase. 2022-03-31 03:54:02 +00:00
l10n.php Docs: Add missing description for $pagenow global in various functions. 2022-04-04 18:26:06 +00:00
link-template.php Docs: Correct variable references in get_category_feed_link() and get_term_feed_link() @return tags. 2022-03-20 15:05:05 +00:00
load.php Docs: Add missing description for $pagenow global in various functions. 2022-04-04 18:26:06 +00:00
locale.php
media-template.php
media.php Media: Run the wp_content_img_tag filter once per image. 2022-04-12 05:18:08 +00:00
meta.php Cache: Use wp_cache_*_multiple() in core functions. 2022-02-11 18:51:59 +00:00
ms-blogs.php
ms-default-constants.php
ms-default-filters.php Users: Introduce the concept of a large site to single site installations. 2022-03-29 12:42:13 +00:00
ms-deprecated.php Docs: Adjust some deprecated function DocBlocks per the [https://developer.wordpress.org/coding-standards/inline-documentation-standards/php/#1-2-deprecated-functions documentation standards]. 2022-04-06 15:20:06 +00:00
ms-files.php Multisite: Log error/warnings/notices from ms-files.php. 2021-07-06 20:21:57 +00:00
ms-functions.php Docs: Typo correction in wp-includes/ms-functions.php docblock. 2022-04-25 09:25:09 +00:00
ms-load.php Docs: Use third-person singular verbs for function descriptions in wp-includes/ms-load.php, as per docs standards. 2022-04-25 09:22:15 +00:00
ms-network.php
ms-settings.php
ms-site.php Docs: Update the DocBlock for the wpmu_new_blog action to suggest wp_initialize_site as an alternative. 2022-03-03 16:13:03 +00:00
nav-menu-template.php
nav-menu.php Docs: Use third-person singular verbs for function descriptions in wp-includes/nav-menu.php, as per docs standards. 2022-04-25 09:32:09 +00:00
option.php Docs: Formatting corrections for various docblocks. 2022-04-29 19:24:09 +00:00
pluggable-deprecated.php
pluggable.php Mail: Improve the docblocks for actions and functions related to the parsing of authentication cookies. 2022-04-28 09:54:16 +00:00
plugin.php Plugins: Convert apply_filters() into a proper variadic function. 2022-03-18 18:23:04 +00:00
post-formats.php Docs: Upgrade more parameters in docblocks to used typed array notation. 2020-11-24 21:27:05 +00:00
post-template.php Docs: Improve documentation of the walker argument for various functions. 2022-04-29 19:28:09 +00:00
post-thumbnail-template.php Docs: Misc. fixes in wp-includes/post-template.php and wp-includes/post-thumbnail-template.php. 2022-03-15 15:22:05 +00:00
post.php Docs: Various docblock corrections. 2022-04-28 09:49:16 +00:00
query.php
registration-functions.php
registration.php
rest-api.php REST API: Respect _fields query arg in preloaded requests 2022-04-19 14:40:09 +00:00
revision.php Docs: Various docblock corrections. 2022-04-28 09:49:16 +00:00
rewrite.php Docs: Use third-person singular verbs for function descriptions in wp-includes/rewrite.php, per the documentation standards. 2022-03-25 21:34:01 +00:00
robots-template.php Docs: Adjust DocBlock formatting for wp_robots_*() and related functions. 2022-04-06 15:33:03 +00:00
rss-functions.php
rss.php Administration: Replace contracted verb forms for better consistency. 2022-03-22 16:25:03 +00:00
script-loader.php Install: Prevent DB errors caused by web fonts API. 2022-04-29 03:50:14 +00:00
session.php
shortcodes.php
sitemaps.php
spl-autoload-compat.php
taxonomy.php Docs: Improve doc blocks for hooks added in [53126]. 2022-04-13 03:04:10 +00:00
template-canvas.php
template-loader.php
template.php
theme-i18n.json Themes: Add "title" key to i18n schema 2022-03-31 10:53:04 +00:00
theme-templates.php
theme.json Administration: Revert unwanted spaces found in theme.json after [53131]. 2022-04-11 11:55:00 +00:00
theme.php Docs: Further remove HTML markup from various function summaries. 2022-04-02 13:55:11 +00:00
update.php Users: Introduce the concept of a large site to single site installations. 2022-03-29 12:42:13 +00:00
user.php Docs: Misc. Docblocks improvements in the Core User API. 2022-04-14 07:08:08 +00:00
vars.php Bootstrap/Load: Avoid a PHP warning when setting the $pagenow global in wp-includes/vars.php. 2022-04-27 13:47:11 +00:00
version.php Users: Validate WP_User_Query's fields argument. 2022-05-02 00:14:29 +00:00
widgets.php
wlwmanifest.xml
wp-db.php Docs: Various docblock improvements. 2022-04-28 09:46:21 +00:00
wp-diff.php