1ff333ca3b
Comments: Improve comment content filtering.
...
Merges [44842] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44848
git-svn-id: http://core.svn.wordpress.org/branches/4.6@44680 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-12 22:37:22 +00:00
f2daa0b4e6
Formatting: Improve `rel="nofollow"` handling in comments.
...
Merges [44833] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44839
git-svn-id: http://core.svn.wordpress.org/branches/4.6@44671 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-12 22:23:22 +00:00
c046ee1abd
Bump 4.6 branch to version 4.6.13.
...
Built from https://develop.svn.wordpress.org/branches/4.6@44081
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43911 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 02:14:04 +00:00
5a48d3af8b
Editor: Remove unwanted fields before saving posts.
...
The `meta_input`, `file`, and `guid` fields are not intended to be updated through user input.
Merges [44047] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44058
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43888 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:43:21 +00:00
41a7a8e581
Multisite: Validate activation links.
...
Merges [44048] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44057
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43887 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:42:20 +00:00
c54c0ddbf4
KSES: Make the URI attributes DRY.
...
This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.
Merges [44014] and [44017] to the `4.6` branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44031
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43861 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 00:52:22 +00:00
8c5cdf2b39
Multisite: Improve messaging for previously activated users.
...
Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time.
Merges [44021] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44028
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43858 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 00:45:21 +00:00
6e7503eedc
KSES: Conditionally remove the `<form>` element from `$allowedposttags`.
...
To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.
Merges [43994] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44001
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43833 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:27:21 +00:00
bcbb4f7808
Media: Improve verification of MIME file types.
...
Merges [43988] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@43992
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43824 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:08:22 +00:00
4f99911c22
Bump 4.6 branch to version 4.6.12
...
Built from https://develop.svn.wordpress.org/branches/4.6@43410
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43238 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 16:12:07 +00:00
c656a7d373
Media: Limit thumbnail file deletions to the same directory as the original file.
...
Merges [43393] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@43396
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43224 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 14:53:26 +00:00
5798a9e9ae
Bump 4.6 branch to version 4.6.11
...
Built from https://develop.svn.wordpress.org/branches/4.6@42936
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42766 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 20:28:04 +00:00
1a13b0102b
Template: Make sure the version string is correctly escaped for use in attributes.
...
Merge of [42893] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42920
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42750 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 16:07:40 +00:00
c1af867a7c
Meta: Simplify the delete all meta query in `delete_metadata()`.
...
Merge of [42913] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42915
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42745 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:42:32 +00:00
5a4e8a9b94
HTTP: Don't treat `localhost` as same host by default.
...
Merge of [42894] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42911
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42741 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:37:22 +00:00
bf1163226c
Login: Use `wp_safe_redirect()` when redirecting the login page if forced to use HTTPS.
...
Merge of [42892] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42898
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42728 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:30:40 +00:00
cf43545c07
General: Update copyright year to 2018 in license.txt.
...
Props rachelbaker.
Merges [42424] to the 4.6 branch.
Fixes #43007 .
Built from https://develop.svn.wordpress.org/branches/4.6@42555
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42384 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-23 11:27:13 +00:00
daf7cc8b30
Bump the 4.6 branch to 4.6.10.
...
Built from https://develop.svn.wordpress.org/branches/4.6@42497
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42326 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 21:41:36 +00:00
ce6ffb6d25
External Libraries: Remove unnecessary / obsoleted MediaElement.js files.
...
Merges [42478] to the 4.6 branch.
Fixes #42720 for 4.6.
Built from https://develop.svn.wordpress.org/branches/4.6@42480
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42309 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 08:06:35 +00:00
cf61ff994d
Upgrade: When deleting old files, if deletion fails attempt to empty the file instead.
...
Props joemcgill, dd32.
Merges [42434] to the 4.6 branch.
Fixes #42963 for 4.6.
Built from https://develop.svn.wordpress.org/branches/4.6@42468
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42297 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 06:55:34 +00:00
8b0e75a650
Bump 4.6 branch to version 4.6.9.
...
Built from https://develop.svn.wordpress.org/branches/4.6@42319
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42148 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 18:59:35 +00:00
969ac61dc4
Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability.
...
Merges [42261] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42279
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42108 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:24:34 +00:00
ed0c328547
Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
...
Merges [42260] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42278
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42107 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:23:06 +00:00
22068f006c
Hardening: Add escaping to the language attributes used on `html` elements.
...
Merges [42259] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42277
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42106 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:22:33 +00:00
78c7ec883d
Hardening: Use a properly generated hash for the `newbloguser` key instead of a determinate substring.
...
Merges [42258] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42276
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42105 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:21:34 +00:00
551d27db59
WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined.
...
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.6 branch.
Fixes #42431 and #42401 for 4.6.
Built from https://develop.svn.wordpress.org/branches/4.6@42232
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42061 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-27 01:09:36 +00:00
98161af28f
General: Remove the version number from the readme file in the 4.6 branch.
...
See #42386
Built from https://develop.svn.wordpress.org/branches/4.6@42101
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41930 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 18:07:35 +00:00
9c29274681
Bump 4.6 branch to version 4.6.8.
...
Built from https://develop.svn.wordpress.org/branches/4.6@42071
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41900 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 13:15:33 +00:00
e8617fb3a5
Database: Restore numbered placeholders in `wpdb::prepare()`.
...
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.
This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.
Merges [41662], [42056] to the 4.6 branch.
See #41925 .
Built from https://develop.svn.wordpress.org/branches/4.6@42059
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41888 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 12:41:33 +00:00
8dc1cd00a1
Taxonomy/Users: Use correct escaping function for URLs.
...
Merge of [41522] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41525
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41358 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 21:28:32 +00:00
8d5d807270
Bump 4.6 branch to version 4.6.7.
...
Built from https://develop.svn.wordpress.org/branches/4.6@41512
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41345 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 19:59:33 +00:00
2fabb6d0e2
Database: Hardening to bring `wpdb::prepare()` inline with documentation.
...
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.
Merges [41496] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41499
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41332 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 18:13:34 +00:00
ce78b2a4fb
Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`.
...
While `wpdb::prepare()` does not support null values (see #12819 ) they still appear in the wild like in the WordPress Importer and other plugins.
Merges [41483] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41486
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41319 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 16:21:34 +00:00
22f3d4e600
Database: Hardening for `wpdb::prepare()`
...
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.
Merges [41470] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41473
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41306 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 15:00:35 +00:00
4733856aee
Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues.
...
Merges [41457] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41460
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41293 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 14:39:34 +00:00
77b60a60a0
oEmbed: Add extra hardening around allowed HTML for improved sandboxing.
...
Merges [41448] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41453
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41286 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 13:49:46 +00:00
441a970ecd
TinyMCE: Improve the previews for shortcodes.
...
Merge of [41395] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41437
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41270 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 12:42:38 +00:00
e684cc66cd
Customize: Ensure valid themes in the preview.
...
Merge of [41397] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41431
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41264 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 11:51:38 +00:00
acd952f9c7
Taxonomy/Users: Provide a fallback for incorrect HTTP referrers.
...
Merge of [41398] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41419
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41252 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 11:12:41 +00:00
f12b16a291
General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.
...
Merges [41413] to the 4.6 branch
See #13377
Built from https://develop.svn.wordpress.org/branches/4.6@41414
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41247 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:22:34 +00:00
7e0de7a0e3
Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog.
...
Merge of [41393] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41402
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41235 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:16:42 +00:00
f5fff9f3f9
Import Twenty Sixteen for the 4.6 branch.
...
See #36497 .
Built from https://develop.svn.wordpress.org/branches/4.6@40857
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40708 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-31 01:13:37 +00:00
bacf919c26
Bump 4.7 branch to version 4.6.6.
...
Built from https://develop.svn.wordpress.org/branches/4.6@40749
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40607 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 21:49:33 +00:00
600e9f1b49
Media: Simplify upload error message construction.
...
Merges [40736] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40738
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40596 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 18:01:08 +00:00
e07088f06e
Add nonce for updating file system credentials.
...
Merges [40723] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40725
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40583 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 14:53:33 +00:00
f2f9b5e493
Customize: Ignore invalid customization sessions.
...
Merge of [40704] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40706
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40569 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 12:15:34 +00:00
687f87a4e6
Adjust post meta checks
...
Merges [40692] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40694
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40557 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:49:34 +00:00
81a5ef373a
Improve redirect handling
...
Merges[40689] to the 4.7 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40691
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40554 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:41:33 +00:00
5c4b703f38
Whitelist post arguments in XML-RPC
...
Merges [40677] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40679
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40542 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:19:35 +00:00
43c3b11cee
Bump 4.6 branch to version 4.6.5.
...
Built from https://develop.svn.wordpress.org/branches/4.6@40488
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40364 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-04-20 16:22:35 +00:00
Sergey Biryukov
Jeremy Felt
Gary Pendergast
Peter Wilson
iandunn
Aaron Campbell
John Blackbourn
Dominik Schilling
Dion Hulse
Konstantin Obenland
Pascal Birchler