diff --git a/wp-content/themes/twentyeleven/inc/widgets.php b/wp-content/themes/twentyeleven/inc/widgets.php index 17e9a7ce1b..2a0cdb4f51 100644 --- a/wp-content/themes/twentyeleven/inc/widgets.php +++ b/wp-content/themes/twentyeleven/inc/widgets.php @@ -68,7 +68,6 @@ class Twenty_Eleven_Ephemera_Widget extends WP_Widget { } ob_start(); - extract( $args, EXTR_SKIP ); /** This filter is documented in wp-includes/default-widgets.php */ $args['title'] = apply_filters( 'widget_title', empty( $instance['title'] ) ? __( 'Ephemera', 'twentyeleven' ) : $instance['title'], $instance, $this->id_base ); diff --git a/wp-includes/template.php b/wp-includes/template.php index 3168607412..862b2ccbdf 100644 --- a/wp-includes/template.php +++ b/wp-includes/template.php @@ -684,6 +684,15 @@ function load_template( $_template_file, $require_once = true ) { global $posts, $post, $wp_did_header, $wp_query, $wp_rewrite, $wpdb, $wp_version, $wp, $id, $comment, $user_ID; if ( is_array( $wp_query->query_vars ) ) { + /* + * This use of extract() cannot be removed. There are many possible ways that + * templates could depend on variables that it creates existing, and no way to + * detect and deprecate it. + * + * Passing the EXTR_SKIP flag is the safest option, ensuring globals and + * function variables cannot be overwritten. + */ + // phpcs:ignore WordPress.PHP.DontExtract.extract_extract extract( $wp_query->query_vars, EXTR_SKIP ); } diff --git a/wp-includes/version.php b/wp-includes/version.php index 74b007e530..46af311ec4 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -13,7 +13,7 @@ * * @global string $wp_version */ -$wp_version = '5.1-beta1-44568'; +$wp_version = '5.1-beta1-44569'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.