When viewing the listing of all comments, author links previously passed referrer information to untrusted URLs. This change adds `noreferrer` to each author link, as well as `noopener` to prevent the passing of information about the parent window.
Props cybr, adam3128, erayalakese, andraganescu, audrasjb, joedolson, sabernhardt.
Fixes#40916.
Built from https://develop.svn.wordpress.org/trunk@52007
git-svn-id: http://core.svn.wordpress.org/trunk@51596 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The latest version includes jQuery 3.x deprecation fixes:
* `$.isArray` → `Array.isArray`
* Event attachment/trigger shorthands → `.on()` and `.trigger()`
For a full list of changes in this update, see the PR on GitHub:
https://github.com/Automattic/Iris/pull/72
Follow-up to [22030], [22033], [22385], [22457], [22697], [22732], [23443], [26334], [30551], [30650], [38931], [50547].
Props Clorith, mattwiebe, Cybr.
Fixes#54224.
Built from https://develop.svn.wordpress.org/trunk@52006
git-svn-id: http://core.svn.wordpress.org/trunk@51595 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When a child panel is open, `wp.customize.panel('parent_panel').focus()` (e.g. `'parent_parent'` might be `'nav_menus'`) collapses the child panel(s) to show the parent panel.
Follow-up to [30102], [31920], [38648].
Props celloexpressions, costdev, dlh, hareesh-pillai, hellofromTonya, westonruter, wpweaver.
Fixes#34436.
Built from https://develop.svn.wordpress.org/trunk@52003
git-svn-id: http://core.svn.wordpress.org/trunk@51592 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When using a workflow as a callable workflow, the job status check functions do not take the called workflow into account. This has caused some failures to be incorrectly reported as successful.
This adds an input to the Slack notifications workflow for when the `workflow_call` event is used.
See #53363.
Built from https://develop.svn.wordpress.org/trunk@52002
git-svn-id: http://core.svn.wordpress.org/trunk@51591 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Per the general consensus in #8714 and similar tickets, user-facing strings should use “curly quotes” for better typography.
Remove the `svn:executable` property that appears to be added accidentally.
Follow-up to [38049], [42200], [46585], [51995].
See #54321.
Built from https://develop.svn.wordpress.org/trunk@52001
git-svn-id: http://core.svn.wordpress.org/trunk@51590 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This resolves an issue where setting up `$_REQUEST['post_type']` and not clearing it afterwards in `Tests_Admin_IncludesScreen::setup_block_editor_test()` started affecting a few `WP_Comments_List_Table` tests after [51997]. It also ensures a similar issue does not inadvertently happen in other tests.
Follow-up to [760/tests], [51997].
See #53363.
Built from https://develop.svn.wordpress.org/trunk@51999
git-svn-id: http://core.svn.wordpress.org/trunk@51588 1a063a9b-81f0-0310-95a4-ce76da25c4cd
These were previously combined in the `includesListTable.php` file. Since the tests were specific neither to the `_get_list_table()` function nor the parent `WP_List_Table` class, the naming was confusing, which should now be resolved.
Follow-up to [31730], [38854], [40297], [48151], [48521], [49190], [51993].
See #53363.
Built from https://develop.svn.wordpress.org/trunk@51997
git-svn-id: http://core.svn.wordpress.org/trunk@51586 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Adds CSS for range controls in the Customizer to be as wide as possible allowing for smaller increments to be more easily obtained by the user.
Follow-up to [28930].
Props domainsupport, dlh, sabernhardt, audrasjb.
Fixes#54329.
Built from https://develop.svn.wordpress.org/trunk@51996
git-svn-id: http://core.svn.wordpress.org/trunk@51585 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Simplifies the logic for when not in alpha/beta/RC.
The changelog URL is translatable in a few other places in core. This commit uses the same pattern for consistency.
Follow-up to [51985].
Props sergeybiryukov.
Fixes#47848.
Built from https://develop.svn.wordpress.org/trunk@51991
git-svn-id: http://core.svn.wordpress.org/trunk@51580 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Adds e2e tests for 'Edit Posts':
* No posts found
* Shows a single post after publishing
* Edit existing post via Edit button
* Quick edit existing post via Quick Edit button
* Delete post
Props isabel_brison, azaozz, hellofromTonya, justinahinon, talldanwp, youknowriad.
Fixes#49507.
Built from https://develop.svn.wordpress.org/trunk@51990
git-svn-id: http://core.svn.wordpress.org/trunk@51579 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Adds the ability to ''locally'' run visual regression testing for wp-admin pages via `npm run test:visual`. Snapshots are stored on contributors' local machines.
Note:
Wiring to the CI is not included. Why? The challenges for the CI are storage of the artifacts and unreliability of testing these across different environments.
This commit is a first step towards visual regression testing. Running it locally provides a learning opportunity which could help to craft how to build it into the automated CI process.
Props isabel_brison, andraganescu, azaozz, danfarrow, desrosj, hellofromTonya, justinahinon, netweb, talldanwp.
Fixes#49606.
Built from https://develop.svn.wordpress.org/trunk@51989
git-svn-id: http://core.svn.wordpress.org/trunk@51578 1a063a9b-81f0-0310-95a4-ce76da25c4cd
* Add missing translators comment.
* Add missing space, correct indentation.
* Put opening and closing PHP tag on a line by itself.
* Remove unnecessary escaping for consistency with other strings.
Follow-up to [51980].
See #53658.
Built from https://develop.svn.wordpress.org/trunk@51988
git-svn-id: http://core.svn.wordpress.org/trunk@51577 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This change adds a new way for users to quickly identify what version of WordPress they are looking at, directly from the "Help" sidebar on the main "Dashboard" page.
* Stable versions will link to their respective support documents.
* Development versions (alpha/beta/RC) will not link anywhere.
Props audrasjb, costdev, donmhico, hellofromtonya, ipstenu, justinahinon, karmatosed, knutsp, marybaum, sergeybiryukov, webcommsat.
Fixes#47848.
Built from https://develop.svn.wordpress.org/trunk@51985
git-svn-id: http://core.svn.wordpress.org/trunk@51574 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This change prevents non-visible characters in titles from creating encoded values in permalinks, opting instead for the following replacement strategy:
* Non-visible non-zero-width characters are replaced with hyphens
* Non-visible zero-width characters are removed entirely
Included with this change are 64 additional PHPUnit assertions to confirm that only the targeted non-visible characters are sanitized as intended.
Before this change, URLs would unintentionally contain encoded values where these non-visible characters were. After this change, URLs intentionally strip out or hyphenate these non-visible characters.
Props costdev, dhanendran, hellofromtonya, paaljoachim, peterwilsoncc, poena, sergeybiryukov.
Fixes#47912.
Built from https://develop.svn.wordpress.org/trunk@51984
git-svn-id: http://core.svn.wordpress.org/trunk@51573 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This change intends to avoid confusion around the requirements of the Application Passwords feature, specific to it requiring HTTPS and the `WP_ENVIRONMENT_TYPE` constant.
It does this by conditionally hiding the traditional UI and showing some insightful explanations instead, including a translatable link to the `WP_ENVIRONMENT_TYPE` documentation on the "Editing wp-config.php" support page.
Props ashfame, audrasjb, iluy, johnbillion.
Fixes #53658.
Built from https://develop.svn.wordpress.org/trunk@51980
git-svn-id: http://core.svn.wordpress.org/trunk@51569 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changes some admin-area, user-facing text, to better match the guidelines and recommendations set forth in the make/core handbook, specifically:
> the word “we” should be avoided (...) unless its made very clear which group is speaking
(There are several more usages of "we" that will receive this same scrutiny in future commits/releases.)
Props audrasjb, johnbillion, marybaum, peterwilsoncc, sergeybiryukov, shital-patel.
Fixes #46057.
Built from https://develop.svn.wordpress.org/trunk@51979
git-svn-id: http://core.svn.wordpress.org/trunk@51568 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This change adds a filter inside of the `get_header_image_tag()` function allowing developers to filter the attributes of the header image HTML tag before they are escaped, concatenated, and returned.
Before this change, it was not possible to externally and preemptively intercept this array of attributes. After this change, these attributes can now be easily filtered, matching it nicely to the `wp_get_attachment_image_attributes` hook.
Props audrasjb, chaion07, junaidbhura, sabernhardt.
Fixes#38942.
Built from https://develop.svn.wordpress.org/trunk@51978
git-svn-id: http://core.svn.wordpress.org/trunk@51567 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This change removes a 1 pixel gap in the measurement of the viewport width when clicking the "Collapse menu" button (at the bottom of the admin menu UI) when already collapsed, causing the menu not to open as intended when exactly 960 pixels wide.
Before this change, the menu would be stuck in the collapsed position. After this change, the menu opens as expected.
Props abesell132, ankit-k-gupta, audrasjb, boniu91, mai21, sabernhardt, webaxones.
Fixes#54210.
Built from https://develop.svn.wordpress.org/trunk@51977
git-svn-id: http://core.svn.wordpress.org/trunk@51566 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changes the descriptive text underneath 3 settings that are frequently overridden by individual posts & pages, and are also often misunderstood to work differently than they do.
"(These settings may be overridden for individual posts.)"
...becomes...
"Individual posts may override these settings. Changes here will only be applied to new posts."
* Parenthesis were removed to improve text layout and flow for RTL languages.
* Original statement was reworded to emphasize "individual posts".
* New statement provides clarity to users about settings changes not being retroactive.
Props audrasjb, johnjamesjacoby, sabbirshouvo, sabernhardt, tobifjellner.
Fixes#54300.
Built from https://develop.svn.wordpress.org/trunk@51976
git-svn-id: http://core.svn.wordpress.org/trunk@51565 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This change removes a call to `wp_html_excerpt()` used on the HTML output of the search string, supplied by the current user in the previous page request via the named `s` input in the search-box UI.
If the search string is extremely long, it wraps around the available empty space in a way that is not visually displeasing, confirming that truncation is not a requirement here.
This also addresses a small accessibility concern as the non-truncated string was not alternatively presented, and helps normalize the output of `$_REQUEST['s']` for more broad improvements in the future.
Props hareesh-pillai, jakubtyrcha, johnjamesjacoby, lukecavanagh, sabernhardt.
Fixes#17636.
Built from https://develop.svn.wordpress.org/trunk@51975
git-svn-id: http://core.svn.wordpress.org/trunk@51564 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Adds a new REST API endpoint (`/wp-block-editor/v1/url-details`) for retrieving information from an external URL.
Information retrieved:
* Title: content of the `<title>` element
* Icon: favicon image link
* Description: content of the `description` or `og:description` meta element
* Image: OG image link
This endpoint is used by the block editor for link previews.
Props get_dave, aduth, andraganescu, beaulebens, hellofromTonya, kevin940726, mamaduka, marekhrabe, mnelson4, noisysocks, obenland, ocean90, retrofox, shaunandrews, spacedmonkey, swissspidy, timothyblynjacobs, xknown, youknowriad.
Fixes#54358.
Built from https://develop.svn.wordpress.org/trunk@51973
git-svn-id: http://core.svn.wordpress.org/trunk@51562 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The WordPress Events and News widget used an icon-only button to select a location. The Pencil icon alone provided insufficient context and labeling for accessibility. Add text to clearly describe button action and change icon to represent a location marker.
Props AmethystAnswers, sabernhardt.
Fixes#53311.
Built from https://develop.svn.wordpress.org/trunk@51971
git-svn-id: http://core.svn.wordpress.org/trunk@51560 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Include the current post title in the `title` element when editing a post. Improve accessibility by distinguishing between different edit screens in the browser tab list.
Props skierpage, alexstine, audrasjb, sabernhardt.
Fixes#52314.
Built from https://develop.svn.wordpress.org/trunk@51969
git-svn-id: http://core.svn.wordpress.org/trunk@51558 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Adds an expectation for PHP 8.1 "passing null to non-nullable" deprecation notice to select tests where the deprecation is generated by one of the functions in the `wp-includes/formatting.php` file, either via a filter hook callback or by a direct call.
Instead of haphazardly fixing these issues exposed by the tests, a more structural and all-encompassing solution for input validation should be architected and implemented as otherwise, we'll keep running into similar issues time and again with each new PHP version.
To discourage people from "fixing" these issues now anyway, this commit "hides" nearly all of these issues from the test runs.
Once a more structural solution is designed, these tests and the underlying functions causing the deprecation notices should be revisited and the structural solution put in place.
Includes a few minor other tweaks to select tests:
* Removing a stray `return` (twice) from assertion statements.
* Removing calls to `ob_*()` functions in favour of letting PHPUnit manage the output catching. This prevents warnings along the lines of `Test code or tested code did not (only) close its own output buffers`.
Props jrf, hellofromTonya.
See #53635.
Built from https://develop.svn.wordpress.org/trunk@51968
git-svn-id: http://core.svn.wordpress.org/trunk@51557 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Role="navigation" was required for assistive technology to recognize HTML5 element's native ARIA roles while HTML5 and ARIA were being introduced. With the deprecation of IE11, the role attribute is only required when mapping elements that don't have native role.
Props costdev, mukesh27.
Fixes#54054.
Built from https://develop.svn.wordpress.org/trunk@51967
git-svn-id: http://core.svn.wordpress.org/trunk@51556 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Adds end-to-end (e2e) tests for the following test scenarios:
* Create a new application password.
* Create an application password with an existing name.
* Revoke a single application password.
* Bulk revoke applications passwords.
Follow-up to [49109], [49276], [49562], [50001], [50367], [51463].
Props justinahinon, swissspidy, juhise, kevin940726, isabel_brison.
Fixes#54241.
Built from https://develop.svn.wordpress.org/trunk@51966
git-svn-id: http://core.svn.wordpress.org/trunk@51555 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Use 3-digit, x.x.x-style semantic versioning for `@since` tags of the `$rest_namespace` property in `WP_Post_Type` and `WP_Taxonomy`.
Add a `@since` note to `WP_REST_Taxonomies_Controller::get_item_schema()` for the `visibility` and `rest_namespace` properties.
The `rest_base` property was also added after the method was initially introduced, but that happened during the same release cycle, so it doesn't need a separate `@since` note.
Follow-up to [38832], [39191], [42729], [51959], [51961], [51962], [51964].
See #53399.
Built from https://develop.svn.wordpress.org/trunk@51965
git-svn-id: http://core.svn.wordpress.org/trunk@51554 1a063a9b-81f0-0310-95a4-ce76da25c4cd
While a taxonomy can define a custom route by using the rest_base argument, a namespace of wp/v2 was assumed. This commit introduces support for a rest_namespace argument.
A new rest_get_route_for_taxonomy_items function has been introduced and the rest_get_route_for_term function updated to facilitate getting the correct route for taxonomies.
For maximum compatibility sticking with the default wp/v2 namespace is recommended until the API functions see wider use.
Props spacedmonkey.
Fixes#54267.
See [51962].
Built from https://develop.svn.wordpress.org/trunk@51964
git-svn-id: http://core.svn.wordpress.org/trunk@51553 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This change adds two now attribute-related config options to KSES:
- An array of allowed values can be defined for attributes. If the attribute value doesn't fall into the list, the attribute will be removed from the tag.
- Attributes can be marked as required. If a required attribute is not present, KSES will remove all attributes from the tag. As KSES doesn't match opening and closing tags, it's not possible to safely remove the tag itself, the safest fallback is to strip all attributes from the tag, instead.
Included with this change is an implementation of these options, allowing the `<object>` tag to be stored in posts, but only when it has a `type` attribute set to `application/pdf`.
Props pento, swissspidy, peterwilsoncc, dd32, jorbin.
Fixes#54261.
Built from https://develop.svn.wordpress.org/trunk@51963
git-svn-id: http://core.svn.wordpress.org/trunk@51552 1a063a9b-81f0-0310-95a4-ce76da25c4cd
While a custom post type can define a custom route by using the `rest_base` argument, a namespace of `wp/v2` was assumed. This commit introduces support for a `rest_namespace` argument.
A new `rest_get_route_for_post_type_items` function has been introduced and the `rest_get_route_for_post` function updated to facilitate getting the correct route for custom post types.
While the WordPress Core Block Editor bootstrap code has been updated to use these API functions, for maximum compatibility sticking with the default `wp/v2` namespace is recommended until the API functions see wider use.
Props spacedmonkey, swissspidy.
Fixes#53656.
Built from https://develop.svn.wordpress.org/trunk@51962
git-svn-id: http://core.svn.wordpress.org/trunk@51551 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The `taxonomies` and `rest_base` properties were also added after the method was initially introduced, but that happened during the same release cycle, so they don't need a separate `@since` note.
Follow-up to [38832], [39097], [39191], [39647], [51959].
See #53399.
Built from https://develop.svn.wordpress.org/trunk@51961
git-svn-id: http://core.svn.wordpress.org/trunk@51550 1a063a9b-81f0-0310-95a4-ce76da25c4cd
davidbaumwald
Sergey Biryukov
johnjamesjacoby
hellofromTonya
desrosj
joedolson
TimothyBlynJacobs
Gary Pendergast
John Blackbourn