Commit Graph

1421 Commits

Author SHA1 Message Date
audrasjb e693dd8534 Editor: Fix Path Traversal issue on Windows in Template-Part Block.
Merges [58470] to the 4.5 branch.
Props xknown, jorbin.



Built from https://develop.svn.wordpress.org/branches/4.5@58497


git-svn-id: http://core.svn.wordpress.org/branches/4.5@57946 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2024-06-24 15:49:22 +00:00
Sergey Biryukov fcb988688d Grouped backports to the 4.5 branch.
- Posts, Post types: Apply KSES to post-by-email content,
- General: Validate host on "Are you sure?" screen,
- Posts, Post types: Remove emails from post-by-email logs,
- Pings/trackbacks: Apply KSES to all trackbacks,
- Comments: Apply kses when editing comments,
- Customize: Escape blogname option in underscores templates,
- Mail: Reset PHPMailer properties between use,
- Query: Validate relation in `WP_Date_Query`,
- Widgets: Escape RSS error messages for display.

Merges [54521], [54522], [54523], [54525], [54526], [54527], [54529], [54530], [54541] to the 4.5 branch.
Props voldemortensen, johnbillion, paulkevan, peterwilsoncc, xknown, dd32, audrasjb, martinkrcho, davidbaumwald, tykoted, johnjamesjacoby, ehtis, matveb, talldanwp.

Built from https://develop.svn.wordpress.org/branches/4.5@54560


git-svn-id: http://core.svn.wordpress.org/branches/4.5@54115 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2022-10-17 18:03:21 +00:00
whyisjake c50dcb41b6 Backporting several bug fixes.
- Query: Remove the static query property.
- HTTP API: Protect against hex interpretation.
- Filesystem API: Prevent directory travelersals when creating new folders.
- Administration: Ensure that admin referer nonce is valid.
- REST API: Send a Vary: Origin header on GET requests.
- Customizer: Properly sanitize background images.

Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@46497


git-svn-id: http://core.svn.wordpress.org/branches/4.5@46294 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-10-14 19:07:24 +00:00
Jeremy Felt 822cb35130 Media: Improve verification of MIME file types.
Merges [43988] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@43993


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43825 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:11:21 +00:00
John Blackbourn cde3e1022a Media: Limit thumbnail file deletions to the same directory as the original file.
Merges [43393] into the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@43397


git-svn-id: http://core.svn.wordpress.org/branches/4.5@43225 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 14:55:23 +00:00
John Blackbourn db1e3afed0 Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability.
Merges [42261] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@42283


git-svn-id: http://core.svn.wordpress.org/branches/4.5@42112 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:27:34 +00:00
Joe McGill a1d67608bf Media: Fix exif_imagetype check in wp_get_image_mime
This is a follow up to [39831].

Merges [39850] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@39853


git-svn-id: http://core.svn.wordpress.org/branches/4.5@39790 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 16:40:32 +00:00
Joe McGill a8dcdd4fd5 Media: Improve image filetype checking.
This adds a new function `wp_get_image_mime()` which is used by
`wp_check_filetype_and_ext()` to validate image files using
`exif_imagetype()` if available instead of `getimagesize()`.

`getimagesize()` is less performant than `exif_imagetype()` and is
dependent on GD. If `exif_imagetype()` is not available, it falls back to
`getimagesize()` as before.

If `wp_check_filetype_and_ext()` can't validate the filetype, we now return
`false` for ext/MIME values.

Merges [39831] to the 4.5 branch.

Built from https://develop.svn.wordpress.org/branches/4.5@39834


git-svn-id: http://core.svn.wordpress.org/branches/4.5@39772 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 13:15:31 +00:00
Dominik Schilling 3ea969bb66 Media: Don't cache the results of `wp_mkdir_p()` in a persistent cache.
To improve the performance of `wp_upload_dir()` the result of `wp_mkdir_p()` was stored in a persistent cache, introduced in [36565]. But this becomes an issue when WordPress is scaled horizontally. You may end up caching a value for a server where the directory doesn't exist which will prevent further uploads on other servers because of the persistent cache.
The fix is to use a non-persistent cache.

Merge of [37285] to the 4.5 branch.

Props azaozz, ocean90.
See #34359.
Fixes #36621.
Built from https://develop.svn.wordpress.org/branches/4.5@37286


git-svn-id: http://core.svn.wordpress.org/branches/4.5@37252 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-04-21 20:18:28 +00:00
Aaron Jorbin 1972aa2a2a Add grunt prerelease task
An unintended consequence of improving the precommit task is that when it's time to run a release, more tasks need to get run to verify things. This adds a prerelease task to help fix that situation. grunt prerelease should include tasks that verify the code base is ready to be released to the wild and find all the tears on the mausoleum floor and help Blood stain the Colosseum doors.

See #35557

Built from https://develop.svn.wordpress.org/trunk@36930


git-svn-id: http://core.svn.wordpress.org/trunk@36898 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-03-10 05:37:27 +00:00
Dion Hulse 6a23a0ddd5 Filesystem: Support Windows shares/DFS roots in `wp_normalize_path()`.
Props rilwis for initial patch.
Fixes #35996.

Built from https://develop.svn.wordpress.org/trunk@36881


git-svn-id: http://core.svn.wordpress.org/trunk@36848 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-03-08 06:00:26 +00:00
Sergey Biryukov 613cd1b020 Docs: Correct `$number` type in `number_format_i18n()`.
Props salcode.
Fixes #35893.
Built from https://develop.svn.wordpress.org/trunk@36644


git-svn-id: http://core.svn.wordpress.org/trunk@36611 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-23 18:44:26 +00:00
Andrew Ozz d7b56a13d9 In `wp_upload_dir()` do not cache error from `wp_mkdir_p()` when a directory cannot be created. Keep trying to create the dirs. This happens mostly in file upload context.
See #34359.
Built from https://develop.svn.wordpress.org/trunk@36628


git-svn-id: http://core.svn.wordpress.org/trunk@36595 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-23 15:58:28 +00:00
Andrew Ozz 2d94e025a2 Replace `wp_upload_dir()` with the new `wp_get_upload_dir()` in all cases where a file is not being uploaded. Deprecate `_wp_upload_dir_baseurl()`, and replace it with `wp_get_upload_dir()`.
See #34359.
Built from https://develop.svn.wordpress.org/trunk@36569


git-svn-id: http://core.svn.wordpress.org/trunk@36536 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-18 00:24:27 +00:00
Andrew Ozz da5b3a55c4 Improve the performance of `wp_upload_dir()`:
- Cache the output in non-persistent cache.
- Cache the result from `wp_mkdir_p()` in persistent cache (when present).
- Introduce `wp_get_upload_dir()` for use when not uploading files. It is equivalent to `wp_upload_dir()` but does not check for the existence or create the upload directory.
- Change tests to use the non-cached `_wp_upload_dir()`. They change options on the fly (should never be used in production) to simulate different environments.
- Introduce `_upload_dir_no_subdir()` and `_upload_dir_https()` to facilitate testing. These use the proper `upload_dir` filter to simulate different environments.

Props kovshenin, azaozz.
See #34359.
Built from https://develop.svn.wordpress.org/trunk@36565


git-svn-id: http://core.svn.wordpress.org/trunk@36532 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-17 22:51:26 +00:00
Dominik Schilling 9e73dea03a Introduce a `$parent_class` parameter for `_deprecated_constructor()`.
Use the parameter for the deprecated constructor warning in `WP_Widget` to provide an indication to which widget is using the PHP4 style constructor.

Props sebastian.pisula.
Fixes #33440.
Built from https://develop.svn.wordpress.org/trunk@36541


git-svn-id: http://core.svn.wordpress.org/trunk@36508 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-16 23:20:26 +00:00
Drew Jaynes 48988c505f Docs: Make a couple of minor improvements to the DocBlock for `wp_get_raw_referer()`, introduced in [36266].
* Uses a third-person singular verb in the summary
* Makes the return types more specific with `string|false` vs `string|bool`.

See #27152. See #32246.

Built from https://develop.svn.wordpress.org/trunk@36500


git-svn-id: http://core.svn.wordpress.org/trunk@36467 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-07 08:09:25 +00:00
Eric Lewis 24adb71a56 Networks and sites: Replace "blog" usage with "site" in docs.
Multisite functions use the term "blog" to refer to what we now call a "site," e.g. `get_current_blog_id()`. These functions are here to stay because of our commitment to backwards compatibility. What we can do is set the documentation straight.

See #35417.

Built from https://develop.svn.wordpress.org/trunk@36417


git-svn-id: http://core.svn.wordpress.org/trunk@36384 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-28 03:51:26 +00:00
Ella Iseulde Van Dorpe dea6197932 Emoji: adjust $wpsmiliestrans
Swap simple-smile.png with SLIGHTLY SMILING FACE
and frownie.png with SLIGHTLY FROWNING FACE

Fixes #31710.


Built from https://develop.svn.wordpress.org/trunk@36336


git-svn-id: http://core.svn.wordpress.org/trunk@36303 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-17 22:28:29 +00:00
Pascal Birchler 16142a461e Filesystem API: Add a filter to `wp_unique_filename()`.
Props SergeyBiryukov, MikeHansenMe, johnbillion, swissspidy.
Fixes #19121.
Built from https://develop.svn.wordpress.org/trunk@36310


git-svn-id: http://core.svn.wordpress.org/trunk@36277 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-15 09:39:26 +00:00
Joe Hoyle 5036a79e73 Add missing HTTP status code descriptions (specifically 308 and 421.)
Props kraftbj.
Fixes 35336.

Built from https://develop.svn.wordpress.org/trunk@36274


git-svn-id: http://core.svn.wordpress.org/trunk@36241 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-13 02:55:26 +00:00
Joe Hoyle dea447f04c Add support for 451 http status code (Unavailable For Legal Reasons.)
Though this is technically still in the proposal stage, there is support from the core team and precedent in #16914

Props andizer.
Fixes #35333.

Built from https://develop.svn.wordpress.org/trunk@36273


git-svn-id: http://core.svn.wordpress.org/trunk@36240 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-13 02:49:25 +00:00
Pascal Birchler e7660a104d Introduce `wp_get_raw_referer()` to retrieve unvalidated referer.
For things like redirects `wp_get_referer()` should be used instead.

Props voldemortensen for initial patch.
Fixes #27152.
Built from https://develop.svn.wordpress.org/trunk@36266


git-svn-id: http://core.svn.wordpress.org/trunk@36233 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-12 08:32:28 +00:00
Pascal Birchler d591f26ce7 Ensure `wp_get_referer()` returns `false` when the referrer URL is the current URL.
Adds unit tests.

Fixes #19856.
Built from https://develop.svn.wordpress.org/trunk@36242


git-svn-id: http://core.svn.wordpress.org/trunk@36209 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-09 14:36:26 +00:00
Sergey Biryukov b742304f13 Docs: Clarify that `wp_filter_object_list()` accepts `'not'` as its `$operator` parameter.
Props barryceelen.
See #35225.
Built from https://develop.svn.wordpress.org/trunk@36090


git-svn-id: http://core.svn.wordpress.org/trunk@36055 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-12-26 00:37:26 +00:00
John Blackbourn 0003a004db Docs: Miscellaneous docblock code quality tweaks.
See #32246

Built from https://develop.svn.wordpress.org/trunk@36074


git-svn-id: http://core.svn.wordpress.org/trunk@36039 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-12-23 07:53:26 +00:00
Andrea Fercia f7f14d94f3 Accessibility: Improvements for the Authentication Check modal dialog "Close X".
Removes the title attribute and uses a `<button>` element instead of a `<div>`.
Also simplifies the CSS and takes care of the hover/focus style.

Fixes #35142.
Built from https://develop.svn.wordpress.org/trunk@36014


git-svn-id: http://core.svn.wordpress.org/trunk@35979 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-12-18 23:51:26 +00:00
Andrea Fercia b5f5dff136 Authentication modal dialog: the spinner should disappear when loading is done.
Also, when using spinners as background images, the re-painted area should be the
smallest possible one. See similar performance issue in #33311.

Fixes #34951.
Built from https://develop.svn.wordpress.org/trunk@35925


git-svn-id: http://core.svn.wordpress.org/trunk@35889 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-12-14 16:40:27 +00:00
Sergey Biryukov 89e0d7dc9e I18N: In `wp_maybe_decline_date()`, bail early if translation functions are not available, e.g. in `SHORTINIT` mode.
Fixes #34967 for trunk.
Built from https://develop.svn.wordpress.org/trunk@35880


git-svn-id: http://core.svn.wordpress.org/trunk@35844 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-12-12 01:42:38 +00:00
Sergey Biryukov d9faafbd44 I18N: Move translatable Codex URLs to separate strings in `wp-includes/functions.php`.
Props ramiy.
See #34687.
Built from https://develop.svn.wordpress.org/trunk@35667


git-svn-id: http://core.svn.wordpress.org/trunk@35631 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-11-18 17:41:27 +00:00
Sergey Biryukov 2583c1e4ec Replace `7 * DAY_IN_SECONDS` with `WEEK_IN_SECONDS` in `get_weekstartend()`.
Props MikeHansenMe.
Fixes #34603.
Built from https://develop.svn.wordpress.org/trunk@35556


git-svn-id: http://core.svn.wordpress.org/trunk@35520 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-11-06 16:37:27 +00:00
Sergey Biryukov 5d87e7d2b8 Introduce `wp_maybe_decline_date()` for languages where certain date formats need to be declined, and hook it to the `date_i18n` filter.
If the locale specifies that month names require a genitive case in certain formats like `'j F Y'` or `'j. F'`, the month name will be replaced with a correct form. 

Fixes #11226.
Built from https://develop.svn.wordpress.org/trunk@35517


git-svn-id: http://core.svn.wordpress.org/trunk@35481 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-11-04 21:28:26 +00:00
Andrea Fercia 04c2cd1913 Accessibility: Improve buttons focus and links style in the install screens.
Fixes #34530.
Built from https://develop.svn.wordpress.org/trunk@35494


git-svn-id: http://core.svn.wordpress.org/trunk@35458 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-11-03 17:59:24 +00:00
John Blackbourn 263b2890d4 Add `wp-post-new-reload` to the list of removable query vars so it doesn't persist in the URL.
Fixes #34510

Built from https://develop.svn.wordpress.org/trunk@35460


git-svn-id: http://core.svn.wordpress.org/trunk@35424 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-30 18:06:34 +00:00
Helen Hou-Sandí 8803c05db5 `wp_die()`: Update colors and button styling.
see #34388, #31459.

Built from https://develop.svn.wordpress.org/trunk@35327


git-svn-id: http://core.svn.wordpress.org/trunk@35293 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-21 15:23:26 +00:00
Drew Jaynes 81524f3bfc Filesystem: Following the introduction of the `KB|MB|GB|TB_IN_BYTES` constants in [35286], use them in various places in core.
Props sudar.
Fixes #22405.

Built from https://develop.svn.wordpress.org/trunk@35325


git-svn-id: http://core.svn.wordpress.org/trunk@35291 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-21 14:03:25 +00:00
Drew Jaynes 875c82f17f Media: Introduce the `enclosure_links` filter, which makes it possible to adjust the list of audio and video enclosure links derived from post content before querying the database.
Props niallkennedy, stevenkword.
Fixes #19890.

Built from https://develop.svn.wordpress.org/trunk@35288


git-svn-id: http://core.svn.wordpress.org/trunk@35254 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-20 07:09:25 +00:00
Scott Taylor 89d1eb1e00 Formatting: when making unique filenames in `wp_unique_filename()` by adding an incrementing number, prefix it with a dash to disambiguate from files that end in numbers.
Updates unit tests.

Props mikejolley, tyxla.
Fixes #21453.

Built from https://develop.svn.wordpress.org/trunk@35276


git-svn-id: http://core.svn.wordpress.org/trunk@35242 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-20 04:05:25 +00:00
Drew Jaynes 217b661703 Docs: Add missing descriptions for the `$wpdb` global in DocBlocks all the places.
See #32246.

Built from https://develop.svn.wordpress.org/trunk@35170


git-svn-id: http://core.svn.wordpress.org/trunk@35136 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-14 23:44:25 +00:00
Sergey Biryukov c332da3e12 Feeds: Pass the feed name to `do_feed_{$feed}` action.
Props johnbillion.
See #34259.
Built from https://develop.svn.wordpress.org/trunk@35115


git-svn-id: http://core.svn.wordpress.org/trunk@35080 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-13 02:44:23 +00:00
Drew Jaynes 48811702cd Feeds: Simplify logic for checking if the `do_feed_{$feed}` action is hooked to any callbacks.
See [35097] for where the aforementioned hook was renamed to actually be dynamic, thus rendering creation of the extra `$hook` variable moot.

See #34264.

Built from https://develop.svn.wordpress.org/trunk@35098


git-svn-id: http://core.svn.wordpress.org/trunk@35063 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-13 01:07:25 +00:00
Drew Jaynes b234b5d896 Feeds: Adjust the `do_feed_{$feed}` hook name to actually be dynamic, rather than pre-storing the tag name in a variable and referencing that.
Props johnbillion.
Fixes #34264.

Built from https://develop.svn.wordpress.org/trunk@35097


git-svn-id: http://core.svn.wordpress.org/trunk@35062 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-13 01:03:25 +00:00
Sergey Biryukov 7ef095171a In `number_format_i18n()`, check if `$wp_locale` is set before using it.
Props pauldewouters.
Fixes #31553.
Built from https://develop.svn.wordpress.org/trunk@35092


git-svn-id: http://core.svn.wordpress.org/trunk@35057 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-13 00:30:24 +00:00
Sergey Biryukov 0d7c5569f5 In `do_robots()`, allow crawling for `admin-ajax.php`, since it's often used on front-end.
Props dmchale, joostdevalk.
Fixes #33156.
Built from https://develop.svn.wordpress.org/trunk@34985


git-svn-id: http://core.svn.wordpress.org/trunk@34950 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-09 05:16:23 +00:00
Ryan McCue b3051048be REST API: Add wp_is_numeric_array helper function
The API uses this to do special operations on list responses (used
for collections), so we need to detect whether an array is
associative or numeric-indexed.

After much discussion, the bikeshed is to be painted green and gold.

See #33982.

Built from https://develop.svn.wordpress.org/trunk@34927


git-svn-id: http://core.svn.wordpress.org/trunk@34892 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-08 02:14:25 +00:00
Ryan McCue 4bac3c3f14 REST API: Add JsonSerializable compatibility to wp_json_encode
Following on from r34845, the JsonSerializable shim needs support
on the encoding side too. _wp_json_prepare_data handles this when
we've loaded the shim.

Props chriscct7.

See #33982. 

Built from https://develop.svn.wordpress.org/trunk@34926


git-svn-id: http://core.svn.wordpress.org/trunk@34891 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-08 01:30:25 +00:00
John Blackbourn c83a66cbf3 Add an optional `$description` parameter to `status_header()` so custom HTTP status descriptions can be provided.
Fixes #21472
Props nbachiyski, iamfriendly

Built from https://develop.svn.wordpress.org/trunk@34914


git-svn-id: http://core.svn.wordpress.org/trunk@34879 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-07 21:26:25 +00:00
Jeremy Felt 9926983b66 Revert [34778], continue using `_site_option()` for the current network.
The `_network_option()` parameter order will be changing to accept `$network_id` first. The `_site_option()` functions will remain in use throughout core as our way of retrieving a network option for the current network.

See #28290.

Built from https://develop.svn.wordpress.org/trunk@34912


git-svn-id: http://core.svn.wordpress.org/trunk@34877 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-07 17:11:25 +00:00
Boone Gorges 226bb29ff0 Move `wp_installing()` to load.php.
Various functions in load.php need to check whether WP is in installation mode.
Let's let them.

Props adamsilverstein.
See #31130.
Built from https://develop.svn.wordpress.org/trunk@34896


git-svn-id: http://core.svn.wordpress.org/trunk@34861 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-07 03:02:23 +00:00
Scott Taylor 4d3223b28e Introduce `wp_get_server_protocol()` to DRY protocol parsing logic and make adding more protocols, like `HTTP/2`, easier.
Props johnbillion, wonderboymusic.
Fixes #34131.

Built from https://develop.svn.wordpress.org/trunk@34894


git-svn-id: http://core.svn.wordpress.org/trunk@34859 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-10-07 02:35:26 +00:00