5ca57c3ba6
WordPress 4.6.17
...
Built from https://develop.svn.wordpress.org/branches/4.6@46927
git-svn-id: http://core.svn.wordpress.org/branches/4.6@46727 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-12-12 20:29:22 +00:00
138f753da7
Update `wp_kses_bad_protocol()` to recognize `:` on uri attributes,
...
`wp_kses_bad_protocol()` makes sure to validate that uri attributes don’t contain invalid/or not allowed protocols. While this works fine in most cases, there’s a risk that by using the colon html5 named entity, one is able to bypass this function.
Brings r46895 to the 4.6 branch.
Props: xknown, nickdaugherty, peterwilsoncc.
Built from https://develop.svn.wordpress.org/branches/4.6@46914
git-svn-id: http://core.svn.wordpress.org/branches/4.6@46714 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-12-12 18:46:23 +00:00
251c570d28
WordPress 4.6.16.
...
Built from https://develop.svn.wordpress.org/branches/4.6@46514
git-svn-id: http://core.svn.wordpress.org/branches/4.6@46311 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-10-14 20:10:39 +00:00
51d665a4a5
Backporting several bug fixes.
...
- Query: Remove the static query property.
- HTTP API: Protect against hex interpretation.
- Filesystem API: Prevent directory travelersals when creating new folders.
- Administration: Ensure that admin referer nonce is valid.
- REST API: Send a Vary: Origin header on GET requests.
Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@46496
git-svn-id: http://core.svn.wordpress.org/branches/4.6@46293 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-10-14 19:02:25 +00:00
c17ad2c252
WordPress 4.6.15.
...
Built from https://develop.svn.wordpress.org/branches/4.6@46040
git-svn-id: http://core.svn.wordpress.org/branches/4.6@45852 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 22:04:44 +00:00
94e8b0b76b
jQuery: Backport the patch from jQuery 3.4.0.
...
Merges [45342] to the 4.6 branch.
Props MikeNGarrett, peterwilsoncc, azaozz.
Fixes #47020 .
Built from https://develop.svn.wordpress.org/branches/4.6@46026
git-svn-id: http://core.svn.wordpress.org/branches/4.6@45836 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 21:48:30 +00:00
c33acf1903
Fix for URL sanitization in `wp_kses_bad_protocol_once()`.
...
Merges [45997] to the 4.6 branch.
Props irsdl, sstoqnov, whyisjake.
Built from https://develop.svn.wordpress.org/branches/4.6@46008
git-svn-id: http://core.svn.wordpress.org/branches/4.6@45819 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 21:40:13 +00:00
ef17e2b3b8
Improve handling the existing `rel` attribute in `wp_rel_nofollow_callback()`.
...
Merges [45990] to the 4.6 branch.
Props xknown, sstoqnov.
Built from https://develop.svn.wordpress.org/branches/4.6@45998
git-svn-id: http://core.svn.wordpress.org/branches/4.6@45809 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 17:53:19 +00:00
f08a1c1302
Improve URL validation in `wp_validate_redirect()`.
...
Merges [45971] to the 4.6 branch.
Props vortfu, whyisjake, peterwilsoncc.
Built from https://develop.svn.wordpress.org/branches/4.6@45978
git-svn-id: http://core.svn.wordpress.org/branches/4.6@45789 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 17:12:24 +00:00
ed63f9e30d
Remove _convert_urlencoded_to_entities() from the get_the_content() callback.
...
Merges [45937] to the 4.6 branch.
Props vortfu, whyisjake, peterwilsoncc
Built from https://develop.svn.wordpress.org/branches/4.6@45956
git-svn-id: http://core.svn.wordpress.org/branches/4.6@45767 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 16:40:03 +00:00
5db18ede70
WordPress 4.6.14
...
Built from https://develop.svn.wordpress.org/branches/4.6@44874
git-svn-id: http://core.svn.wordpress.org/branches/4.6@44705 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-13 01:18:21 +00:00
1ff333ca3b
Comments: Improve comment content filtering.
...
Merges [44842] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44848
git-svn-id: http://core.svn.wordpress.org/branches/4.6@44680 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-12 22:37:22 +00:00
f2daa0b4e6
Formatting: Improve `rel="nofollow"` handling in comments.
...
Merges [44833] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44839
git-svn-id: http://core.svn.wordpress.org/branches/4.6@44671 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-12 22:23:22 +00:00
c046ee1abd
Bump 4.6 branch to version 4.6.13.
...
Built from https://develop.svn.wordpress.org/branches/4.6@44081
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43911 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 02:14:04 +00:00
41a7a8e581
Multisite: Validate activation links.
...
Merges [44048] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44057
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43887 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:42:20 +00:00
c54c0ddbf4
KSES: Make the URI attributes DRY.
...
This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.
Merges [44014] and [44017] to the `4.6` branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44031
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43861 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 00:52:22 +00:00
8c5cdf2b39
Multisite: Improve messaging for previously activated users.
...
Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time.
Merges [44021] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44028
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43858 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 00:45:21 +00:00
6e7503eedc
KSES: Conditionally remove the `<form>` element from `$allowedposttags`.
...
To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.
Merges [43994] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@44001
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43833 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:27:21 +00:00
bcbb4f7808
Media: Improve verification of MIME file types.
...
Merges [43988] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@43992
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43824 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:08:22 +00:00
4f99911c22
Bump 4.6 branch to version 4.6.12
...
Built from https://develop.svn.wordpress.org/branches/4.6@43410
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43238 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 16:12:07 +00:00
c656a7d373
Media: Limit thumbnail file deletions to the same directory as the original file.
...
Merges [43393] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@43396
git-svn-id: http://core.svn.wordpress.org/branches/4.6@43224 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 14:53:26 +00:00
5798a9e9ae
Bump 4.6 branch to version 4.6.11
...
Built from https://develop.svn.wordpress.org/branches/4.6@42936
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42766 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 20:28:04 +00:00
1a13b0102b
Template: Make sure the version string is correctly escaped for use in attributes.
...
Merge of [42893] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42920
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42750 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 16:07:40 +00:00
c1af867a7c
Meta: Simplify the delete all meta query in `delete_metadata()`.
...
Merge of [42913] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42915
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42745 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:42:32 +00:00
5a4e8a9b94
HTTP: Don't treat `localhost` as same host by default.
...
Merge of [42894] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42911
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42741 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:37:22 +00:00
daf7cc8b30
Bump the 4.6 branch to 4.6.10.
...
Built from https://develop.svn.wordpress.org/branches/4.6@42497
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42326 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 21:41:36 +00:00
ce6ffb6d25
External Libraries: Remove unnecessary / obsoleted MediaElement.js files.
...
Merges [42478] to the 4.6 branch.
Fixes #42720 for 4.6.
Built from https://develop.svn.wordpress.org/branches/4.6@42480
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42309 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 08:06:35 +00:00
8b0e75a650
Bump 4.6 branch to version 4.6.9.
...
Built from https://develop.svn.wordpress.org/branches/4.6@42319
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42148 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 18:59:35 +00:00
969ac61dc4
Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability.
...
Merges [42261] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42279
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42108 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:24:34 +00:00
ed0c328547
Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
...
Merges [42260] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42278
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42107 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:23:06 +00:00
22068f006c
Hardening: Add escaping to the language attributes used on `html` elements.
...
Merges [42259] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@42277
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42106 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:22:33 +00:00
551d27db59
WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined.
...
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.6 branch.
Fixes #42431 and #42401 for 4.6.
Built from https://develop.svn.wordpress.org/branches/4.6@42232
git-svn-id: http://core.svn.wordpress.org/branches/4.6@42061 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-27 01:09:36 +00:00
9c29274681
Bump 4.6 branch to version 4.6.8.
...
Built from https://develop.svn.wordpress.org/branches/4.6@42071
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41900 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 13:15:33 +00:00
e8617fb3a5
Database: Restore numbered placeholders in `wpdb::prepare()`.
...
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.
This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.
Merges [41662], [42056] to the 4.6 branch.
See #41925 .
Built from https://develop.svn.wordpress.org/branches/4.6@42059
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41888 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 12:41:33 +00:00
8d5d807270
Bump 4.6 branch to version 4.6.7.
...
Built from https://develop.svn.wordpress.org/branches/4.6@41512
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41345 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 19:59:33 +00:00
2fabb6d0e2
Database: Hardening to bring `wpdb::prepare()` inline with documentation.
...
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.
Merges [41496] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41499
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41332 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 18:13:34 +00:00
ce78b2a4fb
Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`.
...
While `wpdb::prepare()` does not support null values (see #12819 ) they still appear in the wild like in the WordPress Importer and other plugins.
Merges [41483] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41486
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41319 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 16:21:34 +00:00
22f3d4e600
Database: Hardening for `wpdb::prepare()`
...
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.
Merges [41470] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41473
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41306 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 15:00:35 +00:00
77b60a60a0
oEmbed: Add extra hardening around allowed HTML for improved sandboxing.
...
Merges [41448] to 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41453
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41286 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 13:49:46 +00:00
441a970ecd
TinyMCE: Improve the previews for shortcodes.
...
Merge of [41395] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41437
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41270 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 12:42:38 +00:00
e684cc66cd
Customize: Ensure valid themes in the preview.
...
Merge of [41397] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41431
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41264 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 11:51:38 +00:00
7e0de7a0e3
Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog.
...
Merge of [41393] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41402
git-svn-id: http://core.svn.wordpress.org/branches/4.6@41235 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:16:42 +00:00
bacf919c26
Bump 4.7 branch to version 4.6.6.
...
Built from https://develop.svn.wordpress.org/branches/4.6@40749
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40607 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 21:49:33 +00:00
600e9f1b49
Media: Simplify upload error message construction.
...
Merges [40736] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40738
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40596 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 18:01:08 +00:00
f2f9b5e493
Customize: Ignore invalid customization sessions.
...
Merge of [40704] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40706
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40569 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 12:15:34 +00:00
687f87a4e6
Adjust post meta checks
...
Merges [40692] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40694
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40557 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:49:34 +00:00
81a5ef373a
Improve redirect handling
...
Merges[40689] to the 4.7 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40691
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40554 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:41:33 +00:00
5c4b703f38
Whitelist post arguments in XML-RPC
...
Merges [40677] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40679
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40542 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:19:35 +00:00
43c3b11cee
Bump 4.6 branch to version 4.6.5.
...
Built from https://develop.svn.wordpress.org/branches/4.6@40488
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40364 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-04-20 16:22:35 +00:00
299bfe429c
Bump 4.6 branch to version 4.6.4.
...
Built from https://develop.svn.wordpress.org/branches/4.6@40203
git-svn-id: http://core.svn.wordpress.org/branches/4.6@40142 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 16:08:34 +00:00
Sergey Biryukov
desrosj
whyisjake
Andrew Ozz
Gary Pendergast
Jeremy Felt
Peter Wilson
iandunn
Aaron Campbell
John Blackbourn
Dominik Schilling
Dion Hulse
Pascal Birchler
James Nylen