82f8529ad5
Hardening: Use a properly generated hash for the `newbloguser` key instead of a determinate substring.
...
Merges [42258] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@42312
git-svn-id: http://core.svn.wordpress.org/branches/3.7@42141 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:49:10 +00:00
94278eddb6
WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined.
...
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 3.7 branch.
Fixes #42431 and #42401 for 3.7.
Built from https://develop.svn.wordpress.org/branches/3.7@42241
git-svn-id: http://core.svn.wordpress.org/branches/3.7@42070 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-27 01:15:10 +00:00
009b1b4257
General: Remove the version number from the readme file in the 3.7 branch.
...
See #42386
Built from https://develop.svn.wordpress.org/branches/3.7@42099
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41928 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 18:06:09 +00:00
2fd667487f
Bump 3.7 branch to version 3.7.23.
...
Built from https://develop.svn.wordpress.org/branches/3.7@42080
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41909 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 13:47:10 +00:00
083e886cf7
Database: Restore numbered placeholders in `wpdb::prepare()`.
...
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.
This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.
Merges [41662], [42056] to the 3.7 branch.
See #41925 .
Built from https://develop.svn.wordpress.org/branches/3.7@42068
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41897 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 13:02:10 +00:00
99d97c76b0
Users: Use correct escaping function for URLs.
...
Merge of [41522] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@41534
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41367 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 21:40:34 +00:00
67bf4cd7e1
Bump 3.7 branch to version 3.7.22.
...
Built from https://develop.svn.wordpress.org/branches/3.7@41521
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41354 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 20:14:20 +00:00
7b03bfc16f
Database: Hardening to bring `wpdb::prepare()` inline with documentation.
...
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.
Merges [41496] to 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@41508
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41341 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 18:46:09 +00:00
0a541104e3
Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`.
...
While `wpdb::prepare()` does not support null values (see #12819 ) they still appear in the wild like in the WordPress Importer and other plugins.
Merges [41483] to 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@41495
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41328 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 16:30:22 +00:00
029d279155
Database: Hardening for `wpdb::prepare()`
...
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.
Merges [41470] to 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@41482
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41315 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 15:06:09 +00:00
1d5a7892f2
Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues.
...
Merges [41457] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@41469
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41302 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 14:47:09 +00:00
8d241beedb
General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.
...
Merges [41434] with changes to the 3.7 branch.
See #13377
Built from https://develop.svn.wordpress.org/branches/3.7@41456
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41289 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 13:52:09 +00:00
774f81b780
Users: Provide a fallback for incorrect HTTP referrers.
...
Merge of [41398] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@41428
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41261 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 11:15:50 +00:00
86b3a35dd7
Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog.
...
Merge of [41393] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@41411
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41244 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:20:44 +00:00
fe080e84db
Bump 3.7 branch to version 3.7.21.
...
Built from https://develop.svn.wordpress.org/branches/3.7@40758
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40616 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 21:54:15 +00:00
8ae6705fd2
Media: Simplify upload error message construction.
...
Merges [40736] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40747
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40605 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 18:05:51 +00:00
f5fca82e63
Add nonce for updating file system credentials.
...
Merges [40723] to 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40734
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40592 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 14:58:09 +00:00
303264210a
Customize: Ignore invalid customization sessions.
...
Merge of [40704] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40715
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40578 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 12:23:10 +00:00
b89aca0478
Adjust post meta checks
...
Merges [40692] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40703
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40566 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:54:35 +00:00
1ab98bf52d
Whitelist post arguments in XML-RPC
...
Merges [40677] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40688
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40551 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:31:09 +00:00
a2797f26d2
Bump 3.7 branch to version 3.7.20.
...
Built from https://develop.svn.wordpress.org/branches/3.7@40497
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40373 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-04-20 16:30:10 +00:00
63b4b6a006
Fix broken audio/video functions when sanitizing ID3 data
...
This fixes a bug where running `wp_kses_post_deep()` on all the ID3
tag data corrupted blob data.
See #40075 , #40085 .
Merges [40400] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40470
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40346 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-04-17 13:48:09 +00:00
85e61d7921
Bump 3.7 branch to version 3.7.19.
...
Built from https://develop.svn.wordpress.org/branches/3.7@40212
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40151 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 16:50:09 +00:00
3e68b0c7d1
Strip control characters before validating redirect.
...
Merges [40183] to 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40194
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40133 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 13:47:09 +00:00
c6ab9f325b
Plugins: Add file check to plugin deletions.
...
Merges [40169] to 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40180
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40119 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 13:06:09 +00:00
ec48ddfb4e
Validate video and audio metadata.
...
Merge of [40148] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40159
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40098 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 08:14:10 +00:00
44b16a7d23
Bump 3.7 branch to version 3.7.18.
...
Built from https://develop.svn.wordpress.org/branches/3.7@40006
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39943 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 18:31:11 +00:00
0a1cbe9d09
Posts, Post Types: When using Excerpt mode on the Posts list table, ensure the excerpt output matches what was manually entered into the Excerpt field.
...
Merges [39956] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39989
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39926 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 14:24:09 +00:00
9669f73c62
Press This: Do not show Categories & Tags UI for users who cannot assign terms to posts anyways.
...
Merge of [39968] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39982
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39919 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 14:16:21 +00:00
e62f79cfd7
Query: Ensure that queries work correctly with post type names with special characters.
...
Merge of [39952] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39966
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39903 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 13:53:22 +00:00
0a294916d9
Bump 3.7 branch to version 3.7.17.
...
Built from https://develop.svn.wordpress.org/branches/3.7@39870
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39807 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 17:00:22 +00:00
8d4f4a9a05
Media: Fix exif_imagetype check in wp_get_image_mime
...
This is a follow up to [39831].
Merges [39850] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39861
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39798 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 16:46:22 +00:00
e6de513be6
Media: Improve image filetype checking.
...
This adds a new function `wp_get_image_mime()` which is used by
`wp_check_filetype_and_ext()` to validate image files using
`exif_imagetype()` if available instead of `getimagesize()`.
`getimagesize()` is less performant than `exif_imagetype()` and is
dependent on GD. If `exif_imagetype()` is not available, it falls back to
`getimagesize()` as before.
If `wp_check_filetype_and_ext()` can't validate the filetype, we now return
`false` for ext/MIME values.
Merges [39831] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39842
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39780 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 13:21:09 +00:00
dbb5bf710f
Updates: Translate plugin data on the Updates screen.
...
Merge of [39808] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39830
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39768 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 11:44:10 +00:00
30b010ce8a
Themes: Fix markup for theme name fallbacks.
...
Merge of [39807] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39819
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39757 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 11:13:14 +00:00
c094d37899
Multisite: Use `wp_rand()` in signup key creation.
...
Merges [39795] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39806
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39744 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:36:51 +00:00
784f429843
Update PHPMailer to 5.2.22.
...
The full list of changes is available here:
https://github.com/PHPMailer/PHPMailer/compare/v5.2.21...v5.2.22
Merges [39759] to the 3.7 branch.
Fixes #37210 for 3.7.
Built from https://develop.svn.wordpress.org/branches/3.7@39794
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39732 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:28:09 +00:00
2d2f78d640
Mail: Disable wp-mail.php when `mailserver_url` is mail.example.com.
...
Merges [39772] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39784
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39722 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:22:07 +00:00
bf3ac93baf
Add nonce for widget accessibility mode.
...
Props vortfu.
See #23328 .
Merges [39765] to 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39771
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39709 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 01:54:09 +00:00
45af63e137
Mail: Upgrade PHPMailer to 5.2.21.
...
Merges [39645], [36083], [33142], [33124], [29783], [27385] to the 3.7 branch.
See #37210 .
Built from https://develop.svn.wordpress.org/branches/3.7@39731
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39671 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-06 22:07:14 +00:00
b01225018a
Media: Improved media titles when created from filename.
...
Preserves spaces and generally creates more accurate, cleaner titles from filenames of uploaded media.
Merge of [38615] to the 3.7 branch.
Fixes #37989 .
Built from https://develop.svn.wordpress.org/branches/3.7@39719
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39659 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-06 22:02:17 +00:00
fba955f893
General: Update copyright year to 2017 in license.txt.
...
Props Nikschavan.
Merges [39659] to the 3.7 branch.
Fixes #39433 .
Built from https://develop.svn.wordpress.org/branches/3.7@39707
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39647 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-06 21:55:48 +00:00
4afbabc9ca
Bump 3.7 branch to 3.7.16.
...
Built from https://develop.svn.wordpress.org/branches/3.7@38558
git-svn-id: http://core.svn.wordpress.org/branches/3.7@38501 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-07 15:02:36 +00:00
2d1b0ab4c6
Media: Sanitize upload filename.
...
Merge of [38538] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@38548
git-svn-id: http://core.svn.wordpress.org/branches/3.7@38491 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-07 14:01:10 +00:00
b40b064e8a
Upgrade/Install: Sanitize file name in `File_Upload_Upgrader`.
...
Merge of [38524] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@38534
git-svn-id: http://core.svn.wordpress.org/branches/3.7@38475 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-06 18:07:12 +00:00
afe460ad19
Bump 3.7 branch to 3.7.15.
...
Built from https://develop.svn.wordpress.org/branches/3.7@37836
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37801 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 16:52:09 +00:00
eab4230e88
Media: Improve handling of extensionless filenames.
...
Merge of [37756] to the 3.7 branch.
See #37111 .
Built from https://develop.svn.wordpress.org/branches/3.7@37825
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37790 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 15:02:09 +00:00
7fab797d2c
Admin: escape URL-encoded permalinks
...
Merge of [37801] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@37823
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37788 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 15:00:10 +00:00
6319a5f7ea
Revisions: Change the capability needed to view revision diffs to `edit_post`.
...
Merge of [37779] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@37808
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37773 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:51:37 +00:00
361dc33680
Admin: Escape attachment name in case it contains special characters
...
Merge of [37774] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@37795
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37760 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:30:09 +00:00
John Blackbourn
Dion Hulse
Gary Pendergast
Dominik Schilling
Aaron Campbell
Pascal Birchler
James Nylen
Jeremy Felt
Joe McGill
Boone Gorges
Nikolay Bachiyski
Rachel Baker