WordPress/wp-admin
John Blackbourn fbd44ee554 Security: Add a referrer policy header to the admin and login screens.
This sets a referrer policy of `same-origin` which adds hardening by preventing a referrer being sent from the admin area or login screens to other origins. This helps prevent unwanted exposure of potentially sensitive information that may be contained within URLs.

This change introduces a new filter, `admin_referrer_policy`, for filtering the referrer policy header value. The header can be disabled if necessary by removing the `wp_admin_headers` action from the `admin_init` and `login_init` hooks.

Props joostdevalk
Fixes #42036

Built from https://develop.svn.wordpress.org/trunk@41741


git-svn-id: http://core.svn.wordpress.org/trunk@41575 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-04 18:25:46 +00:00
..
css Customize: Improve accessibility of markup for base WP_Customize_Control and WP_Customize_Nav_Menu_Control with proper use of label elements and inclusion of aria-describedby. 2017-10-04 18:12:46 +00:00
images Customize: Add a RTL version of "browser.png" for the site icon preview. 2016-07-05 11:32:29 +00:00
includes Security: Add a referrer policy header to the admin and login screens. 2017-10-04 18:25:46 +00:00
js Customize: Fix theme details modal by updating logic in getPreviousTheme and getNextTheme to not rely on DOM traversal and manually constructing control IDs. 2017-10-04 16:49:46 +00:00
maint I18N: Make the translator comment added in [37858] more explicit and consistent with other similar instances. 2016-07-04 13:10:30 +00:00
network Multisite: Display correct roles in Network > Site Users screen for sites other than the main site. 2017-09-30 03:20:46 +00:00
user Docs: Standardize hook docs in wp-admin/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:01:30 +00:00
about.php Media: Upgrade MediaElement.js from 2.22.0 to 4.2.3. 2017-08-01 04:43:51 +00:00
admin-ajax.php File Editors: Introduce sandboxed live editing of PHP files with rollbacks for both themes and plugins. 2017-10-04 00:20:45 +00:00
admin-footer.php Docs: Remove incorrect @param tags for admin_print_footer_scripts-{$hook_suffix} and admin_footer-{$hook_suffix} dynamic actiona. 2017-01-09 14:38:41 +00:00
admin-functions.php Docs: Use 3-digit, x.x.x-style semantic versioning for _doing_it_wrong(), _deprecated_function(), _deprecated_argument(), and _deprecated_file() throughout core. 2016-07-06 12:40:29 +00:00
admin-header.php I18n: Introduce more translator comments for strings that contain placeholders but don't have an accompanying translator comment. 2016-11-21 02:46:30 +00:00
admin-post.php
admin.php Text Changes: Add a period to the only wp_die() message that didn't have it: "Invalid plugin page". 2017-01-22 02:33:42 +00:00
async-upload.php Remove SWFUpload, 2017-09-21 16:35:48 +00:00
comment.php Accessibility: Remove target=_blank from the comment/edit-comments help tabs links. 2016-10-04 06:54:30 +00:00
credits.php About page: Add a privacy policy. 2017-07-19 21:42:42 +00:00
custom-background.php Docs: Remove @access notations from method DocBlocks in wp-admin/* classes. 2017-07-27 00:40:43 +00:00
custom-header.php Customizer: Minimize duplicate header crops in the media library. 2017-10-04 14:59:48 +00:00
customize.php Customize: Fix positioning of outer section (e.g. publish settings) on large screen sizes. 2017-10-02 18:40:48 +00:00
edit-comments.php General: Use interpolation instead of concatenation for all dynamic hook names. 2016-12-14 04:18:42 +00:00
edit-form-advanced.php Accessibility: Make the Get Shortlink button be a real button. 2017-05-07 11:47:41 +00:00
edit-form-comment.php Accessibility: Standardize the remove/delete/cancel links in the Menus screen and Publish meta boxes. 2016-09-17 15:39:30 +00:00
edit-link-form.php Accessibility: Remove inappropriate content from the Link Manager screens headings. 2016-12-07 20:18:46 +00:00
edit-tag-form.php Taxonomy: Introduce a back_to_items taxonomy label. 2017-09-27 14:39:45 +00:00
edit-tags.php Taxonomy: Allow for adding custom list table views to taxonomy screens. 2017-09-13 15:20:44 +00:00
edit.php Posts, Post Types: Preserve author filter in list table after entering a page number in paging input. 2017-01-21 02:22:26 +00:00
export.php Accessibility: Remove target=_blank from the help tab links on several admin screens. 2016-10-04 20:27:33 +00:00
freedoms.php About page: Add a privacy policy. 2017-07-19 21:42:42 +00:00
import.php Accessibility: Remove target=_blank from the help tab links on several admin screens. 2016-10-04 20:27:33 +00:00
index.php Dashboard: Properly localize data for events 2017-05-18 14:34:43 +00:00
install-helper.php
install.php I18N: Allow numbers in locales during installation. 2017-09-04 19:30:43 +00:00
link-add.php Text Changes: Unify permission error messages. 2016-06-29 15:16:29 +00:00
link-manager.php Accessibility: Remove inappropriate content from the Link Manager screens headings. 2016-12-07 20:18:46 +00:00
link-parse-opml.php General: Check to see that the PHP-XML module is enabled before using XML functions. 2016-10-24 04:45:31 +00:00
link.php Docs: Standardize capitalization of Ajax throughout core documentation per the core spelling guide. 2016-07-10 00:51:30 +00:00
load-scripts.php Bootstrap: do not go gentle into that good night r38411, r38412, and parts of r38389. 2016-08-31 16:31:29 +00:00
load-styles.php Bootstrap: do not go gentle into that good night r38411, r38412, and parts of r38389. 2016-08-31 16:31:29 +00:00
media-new.php Accessibility: Remove target=_blank from the help tab links on several admin screens. 2016-10-04 20:27:33 +00:00
media-upload.php Hooks: Standardize naming of dynamic hooks to use interpolation vs concatenation. 2016-08-22 18:25:31 +00:00
media.php Accessibility: Remove inappropriate content from the old Edit Media screen heading. 2016-12-07 23:30:40 +00:00
menu-header.php Administration: Admin menu: Use aria-current for the current active page. 2017-09-09 14:50:43 +00:00
menu.php Role/Capability: Introduce capabilities dedicated to installing and updating language files. 2017-08-18 18:31:44 +00:00
moderation.php
ms-admin.php
ms-delete-site.php Multisite: Use get_current_blog_id() instead of $wpdb->blogid. 2017-10-02 01:44:47 +00:00
ms-edit.php
ms-options.php
ms-sites.php
ms-themes.php
ms-upgrade-network.php
ms-users.php
my-sites.php Docs: Reduce confusion in @since MU notationss by indicating the WP version (3.0.0) the code was merged into core while retaining the original context. 2017-08-01 20:44:43 +00:00
nav-menus.php Customize: Prevent links to customize.php from being generated which have query vars from wp_removable_query_args() present. 2017-03-22 23:04:42 +00:00
network.php General: Improve terminology used when referring to installations of WordPress and its extensions. 2017-08-22 11:52:48 +00:00
options-discussion.php Comments: Change IP references in moderation option labels and email notifications to IP address for clarity. 2017-10-03 13:09:47 +00:00
options-general.php General: Improve terminology used when referring to installations of WordPress and its extensions. 2017-08-22 11:52:48 +00:00
options-head.php Docs: Standardize on 'backward compatibility/compatible' nomenclature in core inline docs. 2016-05-13 18:41:31 +00:00
options-media.php Administration: Fix some HTML validation errors. 2017-05-23 17:58:43 +00:00
options-permalink.php Permalinks: Change structure tag button state more reliably. 2017-09-26 08:24:46 +00:00
options-reading.php Customize: Rename "Static front page" to just "Homepage". 2017-09-10 16:20:44 +00:00
options-writing.php General: Improve terminology used when referring to installations of WordPress and its extensions. 2017-08-22 11:52:48 +00:00
options.php General: Improve terminology used when referring to installations of WordPress and its extensions. 2017-08-22 11:52:48 +00:00
plugin-editor.php File Editors: Introduce sandboxed live editing of PHP files with rollbacks for both themes and plugins. 2017-10-04 00:20:45 +00:00
plugin-install.php General: Improve terminology used when referring to installations of WordPress and its extensions. 2017-08-22 11:52:48 +00:00
plugins.php Retire Press This and extract it to a plugin. First run. 2017-09-24 14:22:54 +00:00
post-new.php I18N: Combine two duplicate "Invalid post type" strings. 2016-07-17 16:05:31 +00:00
post.php Posts, Post Types: Use an existing string for "Invalid post type" error message. 2017-01-10 02:40:42 +00:00
press-this.php Retire Press This and extract it to a plugin. First run. 2017-09-24 14:22:54 +00:00
privacy.php About page: Add a privacy policy. 2017-07-19 21:42:42 +00:00
profile.php
revision.php I18n: Begin introducing translator comments for strings which include placeholders but no accompanying translator comment. 2016-11-21 01:22:32 +00:00
setup-config.php Setup: Hide database errors while testing the table prefix. 2017-09-28 07:58:46 +00:00
term.php Taxonomy: Add a "delete" button on term edit page. 2017-05-12 19:26:41 +00:00
theme-editor.php File Editors: Introduce sandboxed live editing of PHP files with rollbacks for both themes and plugins. 2017-10-04 00:20:45 +00:00
theme-install.php Plugins: Improve error messages on plugins screen. 2017-09-27 08:46:45 +00:00
themes.php Accessibility: Improve the Theme Details modal accessibility. 2017-10-01 13:48:46 +00:00
tools.php Retire Press This and extract it to a plugin. First run. 2017-09-24 14:22:54 +00:00
update-core.php Plugins: Add plugin icons to the plugin list tables. 2017-10-03 00:25:46 +00:00
update.php General: Improve terminology used when referring to installations of WordPress and its extensions. 2017-08-22 11:52:48 +00:00
upgrade-functions.php Docs: Use 3-digit, x.x.x-style semantic versioning for _doing_it_wrong(), _deprecated_function(), _deprecated_argument(), and _deprecated_file() throughout core. 2016-07-06 12:40:29 +00:00
upgrade.php
upload.php Accessibility: Improve the Media Library inline uploader accessibility. 2017-03-31 17:38:43 +00:00
user-edit.php Taxonomy/Users: Use correct escaping function for URLs. 2017-09-19 21:14:47 +00:00
user-new.php Multisite: Use get_current_blog_id() instead of $wpdb->blogid. 2017-10-02 01:44:47 +00:00
users.php Help/About: Tweak Help tabs on Users screen for consistency with Posts screen. 2017-09-22 18:31:48 +00:00
widgets.php Accessibility: Improve the sidebar toggles in the Widgets screen. 2017-09-27 16:29:44 +00:00