5a4e8a9b94
HTTP: Don't treat `localhost` as same host by default.
...
Merge of [42894] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42911
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42741 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:37:22 +00:00
daf7cc8b30
Bump the 4.6 branch to 4.6.10.
...
Built from https://develop.svn.wordpress.org/branches/4.6@42497
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42326 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 21:41:36 +00:00
ce6ffb6d25
External Libraries: Remove unnecessary / obsoleted MediaElement.js files.
...
Merges [42478] to the 4.6 branch.
Fixes #42720 for 4.6.
Built from https://develop.svn.wordpress.org/branches/4.6@42480
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42309 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 08:06:35 +00:00
8b0e75a650
Bump 4.6 branch to version 4.6.9.
...
Built from https://develop.svn.wordpress.org/branches/4.6@42319
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42148 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 18:59:35 +00:00
969ac61dc4
Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability.
...
Merges [42261] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42279
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42108 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:24:34 +00:00
ed0c328547
Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
...
Merges [42260] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42278
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42107 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:23:06 +00:00
22068f006c
Hardening: Add escaping to the language attributes used on `html` elements.
...
Merges [42259] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42277
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42106 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:22:33 +00:00
551d27db59
WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined.
...
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.6 branch.
Fixes #42431 and #42401 for 4.6.
Built from https://develop.svn.wordpress.org/branches/4.6@42232
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42061 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-27 01:09:36 +00:00
9c29274681
Bump 4.6 branch to version 4.6.8.
...
Built from https://develop.svn.wordpress.org/branches/4.6@42071
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41900 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 13:15:33 +00:00
e8617fb3a5
Database: Restore numbered placeholders in `wpdb::prepare()`.
...
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.
This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.
Merges [41662], [42056] to the 4.6 branch.
See #41925 .
Built from https://develop.svn.wordpress.org/branches/4.6@42059
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41888 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 12:41:33 +00:00
8d5d807270
Bump 4.6 branch to version 4.6.7.
...
Built from https://develop.svn.wordpress.org/branches/4.6@41512
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41345 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 19:59:33 +00:00
2fabb6d0e2
Database: Hardening to bring `wpdb::prepare()` inline with documentation.
...
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.
Merges [41496] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41499
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41332 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 18:13:34 +00:00
ce78b2a4fb
Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`.
...
While `wpdb::prepare()` does not support null values (see #12819 ) they still appear in the wild like in the WordPress Importer and other plugins.
Merges [41483] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41486
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41319 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 16:21:34 +00:00
22f3d4e600
Database: Hardening for `wpdb::prepare()`
...
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.
Merges [41470] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41473
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41306 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 15:00:35 +00:00
77b60a60a0
oEmbed: Add extra hardening around allowed HTML for improved sandboxing.
...
Merges [41448] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41453
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41286 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 13:49:46 +00:00
441a970ecd
TinyMCE: Improve the previews for shortcodes.
...
Merge of [41395] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41437
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41270 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 12:42:38 +00:00
e684cc66cd
Customize: Ensure valid themes in the preview.
...
Merge of [41397] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41431
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41264 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 11:51:38 +00:00
7e0de7a0e3
Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog.
...
Merge of [41393] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41402
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41235 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:16:42 +00:00
bacf919c26
Bump 4.7 branch to version 4.6.6.
...
Built from https://develop.svn.wordpress.org/branches/4.6@40749
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40607 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 21:49:33 +00:00
600e9f1b49
Media: Simplify upload error message construction.
...
Merges [40736] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40738
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40596 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 18:01:08 +00:00
f2f9b5e493
Customize: Ignore invalid customization sessions.
...
Merge of [40704] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40706
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40569 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 12:15:34 +00:00
687f87a4e6
Adjust post meta checks
...
Merges [40692] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40694
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40557 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:49:34 +00:00
81a5ef373a
Improve redirect handling
...
Merges[40689] to the 4.7 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40691
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40554 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:41:33 +00:00
5c4b703f38
Whitelist post arguments in XML-RPC
...
Merges [40677] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40679
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40542 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:19:35 +00:00
43c3b11cee
Bump 4.6 branch to version 4.6.5.
...
Built from https://develop.svn.wordpress.org/branches/4.6@40488
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40364 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-04-20 16:22:35 +00:00
299bfe429c
Bump 4.6 branch to version 4.6.4.
...
Built from https://develop.svn.wordpress.org/branches/4.6@40203
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40142 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 16:08:34 +00:00
0e1bc61b1f
Strip control characters before validating redirect.
...
Merges [40183] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40185
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40124 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 13:41:33 +00:00
e61cac5d13
Embeds: URL encode YouTube video IDs for broader compatibility.
...
Merge of [40160] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40162
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40101 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 12:05:34 +00:00
baf66f786a
Bump 4.6 branch to version 4.6.3.
...
Built from https://develop.svn.wordpress.org/branches/4.6@39996
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39933 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 18:16:33 +00:00
c3794cc9b3
Query: Ensure that queries work correctly with post type names with special characters.
...
Merge of [39952] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@39955
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39892 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 13:40:34 +00:00
18f8236b61
Media: Fix exif_imagetype check in wp_get_image_mime
...
This is a follow up to [39831].
Merges [39850] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@39852
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39789 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 16:39:33 +00:00
74ecd3d1f3
Bump 4.6 branch to version 4.6.2.
...
Built from https://develop.svn.wordpress.org/branches/4.6@39846
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39784 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 15:24:33 +00:00
db42241c13
Media: Improve image filetype checking.
...
This adds a new function `wp_get_image_mime()` which is used by
`wp_check_filetype_and_ext()` to validate image files using
`exif_imagetype()` if available instead of `getimagesize()`.
`getimagesize()` is less performant than `exif_imagetype()` and is
dependent on GD. If `exif_imagetype()` is not available, it falls back to
`getimagesize()` as before.
If `wp_check_filetype_and_ext()` can't validate the filetype, we now return
`false` for ext/MIME values.
Merges [39831] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@39833
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39771 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 13:14:33 +00:00
b6f03a6084
Updates: Translate plugin data on the Updates screen.
...
Merge of [39808] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@39821
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39759 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 11:40:06 +00:00
efc07abeb3
Themes: Fix markup for theme name fallbacks.
...
Merge of [39807] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@39810
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39748 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 11:09:35 +00:00
116a5c2fa7
Multisite: Use `wp_rand()` in signup key creation.
...
Merges [39795] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@39797
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39735 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:32:07 +00:00
5694c55375
Update PHPMailer to 5.2.22.
...
The full list of changes is available here:
https://github.com/PHPMailer/PHPMailer/compare/v5.2.21...v5.2.22
Merges [39759] to the 4.6 branch.
Fixes #37210 for 4.6.
Built from https://develop.svn.wordpress.org/branches/4.6@39785
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39723 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:22:39 +00:00
3855756ad2
Mail: Disable wp-mail.php when `mailserver_url` is mail.example.com.
...
Merges [39772] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@39774
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39712 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:16:34 +00:00
ebbfc7179c
Add nonce for widget accessibility mode.
...
Props vortfu.
See #23328 .
Merges [39760] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@39762
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39700 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 01:43:35 +00:00
53cecfcd72
Mail: Upgrade PHPMailer to 5.2.21.
...
Merges [39645] to the 4.6 branch.
See #37210 .
Built from https://develop.svn.wordpress.org/branches/4.6@39722
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39662 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-06 22:04:04 +00:00
9a487ee432
General: Update copyright year to 2017 in license.txt.
...
Props Nikschavan.
Merges [39659] to the 4.6 branch.
Fixes #39433 .
Built from https://develop.svn.wordpress.org/branches/4.6@39698
git-svn-id: http://core.svn.wordpress.org/branches/4.6@39638 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-05 08:38:37 +00:00
f5f0032925
HTTP: Call `mbstring_binary_safe_encoding()` before making a request with Requests to avoid issues with `mbstring.func_overload`.
...
Props SergeyBiryukov.
Merges [38894] to the 4.6 branch.
Fixes #38226 .
Built from https://develop.svn.wordpress.org/branches/4.6@38895
git-svn-id: http://core.svn.wordpress.org/branches/4.6@38838 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-10-25 00:47:30 +00:00
4d089ce55b
HTTP: Update Requests to master (0048f3c) which fixes a number of outstanding issues.
...
Merges [38727] to the 4.6 branch.
Fixes #38070 , #37733 by reverting part of [38429] and using the fix in Requests.
Fixes #37992 allowing for connecting to SSL resources on ports other than 443.
Fixes #37991 by not sending default ports in the `Host:` header.
Fixes #37839 to match and decode Chunked responses correctly.
Fixes #38232 allowing a SSL connection to ignore the hostname of the certificate when verification is disabled.
Built from https://develop.svn.wordpress.org/branches/4.6@38728
git-svn-id: http://core.svn.wordpress.org/branches/4.6@38671 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-10-05 03:27:31 +00:00
38430b0533
Media: Improved media titles when created from filename.
...
Preserves spaces and generally creates more accurate, cleaner titles from filenames of uploaded media.
Merge of [38614] to the 4.6 branch.
Props joemcgill.
Fixes #37989 .
Built from https://develop.svn.wordpress.org/branches/4.6@38615
git-svn-id: http://core.svn.wordpress.org/branches/4.6@38558 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-17 06:27:31 +00:00
74d49a9288
Database: Fall back to `utf8` when `utf8mb4` isn't supported.
...
Sometimes, `DB_CHARSET` will be set to `utf8mb4`, even if the current setup doesn't support `utf8mb4`. After [38442], this can cause significant character set failures, causing the connection to fall back to `latin1`.
Instead of doing this, we now check that the connection supports `utf8mb4` before trying to use it, and fall back to `utf8` when we need to.
Merge of [38580] to the 4.6 branch.
Fixes #37982 .
Built from https://develop.svn.wordpress.org/branches/4.6@38581
git-svn-id: http://core.svn.wordpress.org/branches/4.6@38524 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-08 23:54:31 +00:00
17b03600af
The 4.6 branch is now 4.6.2-alpha.
...
Built from https://develop.svn.wordpress.org/branches/4.6@38570
git-svn-id: http://core.svn.wordpress.org/branches/4.6@38513 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-07 17:18:32 +00:00
1e85e502a0
Bump 4.6 branch to 4.6.1.
...
Built from https://develop.svn.wordpress.org/branches/4.6@38549
git-svn-id: http://core.svn.wordpress.org/branches/4.6@38492 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-07 14:57:32 +00:00
e860e24b6e
Media: Sanitize upload filename.
...
Merge of [38538] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@38539
git-svn-id: http://core.svn.wordpress.org/branches/4.6@38482 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-07 13:57:29 +00:00
927e102a78
Comments: Revert [38497]
...
Restore direct SQL query when fetching descendants.
See #37696 , #37966 .
Built from https://develop.svn.wordpress.org/branches/4.6@38537
git-svn-id: http://core.svn.wordpress.org/branches/4.6@38480 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-07 13:41:34 +00:00
b9f38d1aa8
Upgrade/Install: Sanitize file name in `File_Upload_Upgrader`.
...
Merge of [38524] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@38525
git-svn-id: http://core.svn.wordpress.org/branches/4.6@38466 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-06 17:29:31 +00:00
Dominik Schilling
Dion Hulse
John Blackbourn
Gary Pendergast
Aaron Campbell
Pascal Birchler
James Nylen
Joe McGill
Jeremy Felt