The intention behind this change is to prevent sensitive data in responses for logged in users being cached and available to others, for example via the browser history after the user logs out.
The `no-store` directive instructs caches in the browser or within proxies not to store the response in the cache. This is subtly different from the `no-cache` directive which means the response can be cached but must be revalidated before re-use. WordPress does not use ETag headers by default therefore this does not achieve the same result.
The `private` directive complements the `no-store` directive by specifying that the response contains private information that should not be stored in a public cache. Som
e proxy caches may ignore the `no-store` directive but respect the `private` directive, thus it is included.
The existing `Cache-Control` header for users who are not logged in remains unchanged, and the existing cache prevention directives remain in place for backwards compatib
ility.
Props soulseekah, luehrsen, Dharm1025, markdoliner, rutviksavsani, ayeshrajans, paulkevan, clorith, andy786, johnbillion
Fixes#21938, Fixes#57627
Built from https://develop.svn.wordpress.org/trunk@55968
git-svn-id: http://core.svn.wordpress.org/trunk@55480 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Previously when the `mimes` element was not specified in the overrides array passed to `_wp_handle_upload()` it resulted in boolean false being passed to this parameter, which is incorrect. The fallback value should be `null`.
Props platonkristinin, pkbhatt
Fixes#58349
Built from https://develop.svn.wordpress.org/trunk@55872
git-svn-id: http://core.svn.wordpress.org/trunk@55384 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Since cron events often consume extra memory by nature, it makes sense to give them the full amount available by default. In practice this means the memory will be increased to `WP_MAX_MEMORY_LIMIT` (which is 256MB by default) during cron event processing if the default memory limit is lower than this value.
The new `cron_memory_limit` filter can be used to adjust this value if necessary.
Note that this change will not by default affect external means of processing cron events, such as the `wp cron` command in WP-CLI, server-level crontab events, or any other cron event processing mechanism that bypasses `wp-cron.php`.
Props iandunn, thakkarhardik
Fixes#56628
Built from https://develop.svn.wordpress.org/trunk@55871
git-svn-id: http://core.svn.wordpress.org/trunk@55383 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When using a block theme, `_wp_array_get()` is the most called function on the front end of a site.
This commit makes a few minor performance optimizations, which add up to a noticeable improvement.
Follow-up to [49135], [49143], [49580].
Props aristath, jrf, afercia, costdev, swissspidy, flixos90, spacedmonkey, mukesh27, samiamnot, SergeyBiryukov.
Fixes#58376.
Built from https://develop.svn.wordpress.org/trunk@55851
git-svn-id: http://core.svn.wordpress.org/trunk@55363 1a063a9b-81f0-0310-95a4-ce76da25c4cd
`str_starts_with()` was introduced in PHP 8.0 to perform a case-sensitive check indicating if the string to search in (haystack) begins with the given substring (needle).
WordPress core includes a polyfill for `str_starts_with()` on PHP < 8.0 as of WordPress 5.9.
This commit replaces `0 === strpos( ... )` with `str_starts_with()` in core files, making the code more readable and consistent, as well as improving performance.
While `strpos()` is slightly faster than the polyfill on PHP < 8.0, `str_starts_with()` is noticeably faster on PHP 8.0+, as it is optimized to avoid unnecessarily searching along the whole haystack if it does not find the needle.
Follow-up to [52039], [52040], [52326].
Props spacedmonkey, costdev, sabernhardt, mukesh27, desrosj, jorbin, TobiasBg, ayeshrajans, lgadzhev, SergeyBiryukov.
Fixes#58012.
Built from https://develop.svn.wordpress.org/trunk@55703
git-svn-id: http://core.svn.wordpress.org/trunk@55215 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Add a helper function called `wp_cache_set_last_changed` to set the last changed value for cache groups. This function has a new action called `wp_cache_set_last_changed`, allowing for developers to cache invalidate when last changed value is changed.
Props tillkruess, spacedmonkey, peterwilsoncc, mukesh27, johnjamesjacoby.
Fixes#57905.
Built from https://develop.svn.wordpress.org/trunk@55702
git-svn-id: http://core.svn.wordpress.org/trunk@55214 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Per [https://developer.wordpress.org/coding-standards/wordpress-coding-standards/php/#writing-include-require-statements WordPress PHP coding standards], it is ''strongly recommended'' to use `require[_once]` for unconditional includes. When using `include[_once]`, PHP will throw a warning when the file is not found but will continue execution, which will almost certainly lead to other errors/warnings/notices being thrown if your application depends on the file loaded, potentially leading to security leaks. For that reason, `require[_once]` is generally the better choice as it will throw a `Fatal Error` if the file cannot be found.
Follow-up to [1674], [1812], [1964], [6779], [8540], [10521], [11005], [11911], [16065], [16149], [25421], [25466], [25823], [37714], [42981], [45448], [47198], [54276], [55633].
Props kausaralm, SergeyBiryukov.
See #57839.
Built from https://develop.svn.wordpress.org/trunk@55641
git-svn-id: http://core.svn.wordpress.org/trunk@55153 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset introduced a regression for partial-hour timezones such as +05:30 UTC which is India and Sri Lanka. How? These timezones are in float. The change made in [55054] type casted them to integer which dropped the decimal for the partial-hour, making the time inaccurate. For example, +05:30 UTC (India and Sri Lanka)'s `'gmt_offset'` is `5.5`, but with the changeset, it was changed to `5`.
Reverting the changeset restores the original state of `current_time()` and thus resolves the regression.
Props reputeinfosystems, Rarst, hellofromTonya, desrosj, audrasjb, sergeybiryukov, costdev, priethor, francina, nekojonez, codingchicken, cbringmann.
See #57035.
Fixes#57998.
Built from https://develop.svn.wordpress.org/trunk@55598
git-svn-id: http://core.svn.wordpress.org/trunk@55110 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Includes:
* Capitalizing "ID" in a consistent way.
* Expanding the comment on not using `filter_var()`.
* Adding a `@covers` tag for the function in unit tests.
* Minor tweak to the `_doing_it_wrong()` message.
Follow-up to [53818], [55543].
See #57593.
Built from https://develop.svn.wordpress.org/trunk@55549
git-svn-id: http://core.svn.wordpress.org/trunk@55061 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Sanitize the array of ids passed to the `_get_non_cached_ids` function and add a `_doing_it_wrong` call, if an invalid type is passed.
Props tillkruess, spacedmonkey, peterwilsoncc, flixos90, SergeyBiryukov.
Fixes#57593.
Built from https://develop.svn.wordpress.org/trunk@55543
git-svn-id: http://core.svn.wordpress.org/trunk@55055 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The `wp_get_referer()` and `wp_get_original_referer()` functions both depend on `wp_validate_redirect()` and check whether it is defined by the time they run, but do so in a slightly different way.
This commit ensures both functions return early if they are called before `wp_validate_redirect()` is defined.
Follow-up to [3908], [25399], [25400].
See #57839.
Built from https://develop.svn.wordpress.org/trunk@55540
git-svn-id: http://core.svn.wordpress.org/trunk@55052 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This aims to provide better context for translators and make it easier to determine that some strings contain hidden accessibility text and are not displayed in the UI.
Props kebbet, mercime, pavelevap, ocean90, swissspidy, Chouby, jipmoors, afercia, desrosj, costdev, audrasjb, SergeyBiryukov.
Fixes#29748.
Built from https://develop.svn.wordpress.org/trunk@55276
git-svn-id: http://core.svn.wordpress.org/trunk@54809 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset improves the consistency in capitalization of fetching and outputting of request headers. It also updates occurrences found in some docblocks.
Props johnjamesjacoby, costdev, audrasjb, petitphp, mhkuu, SergeyBiryukov.
Fixes#54225.
Built from https://develop.svn.wordpress.org/trunk@55210
git-svn-id: http://core.svn.wordpress.org/trunk@54743 1a063a9b-81f0-0310-95a4-ce76da25c4cd
While using reserved PHP keywords as parameter name labels is allowed, in the context of function calls using named parameters in PHP 8.0+, this will easily lead to confusion. To avoid that, it is recommended not to use reserved keywords as function parameter names.
This commit:
* Renames the `$array` parameter to `$input_array` in `wp_recursive_ksort()`.
* Moves the function next to other array-related functions for consistency.
Follow-up to [53129], [54929].
Props jrf, aristath, poena, justinahinon, SergeyBiryukov.
See #56788.
Built from https://develop.svn.wordpress.org/trunk@55117
git-svn-id: http://core.svn.wordpress.org/trunk@54650 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset moves typecasting to affect the `get_option` value, which ensures that when math is done it does not generate any error. In PHP 7.4 and earlier the previous implementation was dismissed as a warning, but in PHP 8+ it would have throw a fatal error.
Follow-up to [45856].
Props Nick_theGeek, SergeyBiryukov, johnbillion.
Fixes#57035.
Built from https://develop.svn.wordpress.org/trunk@55054
git-svn-id: http://core.svn.wordpress.org/trunk@54587 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This is a major release and contains breaking changes.
Most important changes to be aware of for this release:
* All code is now namespaced. Though there is a full backward compatibility layer available and the old class names are still supported, using them will generate a deprecation notice (which can be silenced by plugins if they'd need to support multiple WP versions). See the [https://requests.ryanmccue.info/docs/upgrading.html upgrade guide] for more details.
* A lot of classes have been marked `final`. This should generally not affect userland code as care has been taken to not apply the `final` keyword to classes which are known to be extended in userland code.
* Extensive input validation has been added to Requests. When Requests is used as documented though, this will be unnoticable.
* A new `WpOrg\Requests\Requests::has_capabilities()` method has been introduced which can be used to address #37708.
* A new `WpOrg\Requests\Response::decode_body()` method has been introduced which may be usable to simplify some of the WP native wrapper code.
* Remaining PHP 8.0 compatibility fixed (support for named parameters).
* PHP 8.1 compatibility.
Release notes: https://github.com/WordPress/Requests/releases/tag/v2.0.0
For a full list of changes in this update, see the Requests GitHub:
https://github.com/WordPress/Requests/compare/v1.8.1...v2.0.0
This commit also resolves 2 blocking issues which previously caused the revert of [52244]:
* New Requests files are loaded into `wp-includes/Requests/src/`, matching the location of the library. In doing so, filesystems that are case-insensitive are not impacted (see #54582).
* Preload: During a Core update, the old Requests files are preloaded into memory before the update deletes the files. Preloading avoids fatal errors noted in #54562.
Follow-up to [50842], [51078], [52244], [52315], [52327], [52328].
Props jrf, schlessera, datagutten, wojsmol, dustinrue, soulseekah, szepeviktor. costdev, sergeybiryukov, peterwilsoncc, ironprogrammer, antonvlasenko, hellofromTonya, swissspidy, dd32, azaozz, TobiasBg, audrasjb.
Fixes#54504.
See #54582, #54562.
Built from https://develop.svn.wordpress.org/trunk@54997
git-svn-id: http://core.svn.wordpress.org/trunk@54530 1a063a9b-81f0-0310-95a4-ce76da25c4cd
While using reserved PHP keywords as parameter name labels is allowed, in the context of function calls using named parameters in PHP 8.0+, this will easily lead to confusion. To avoid that, it is recommended not to use reserved keywords as function parameter names.
This commit:
* Renames the `$echo` parameter to `$display` in:
* `wp_nonce_field()`
* `wp_referer_field()`
* `wp_original_referer_field()`
* Renames the `$string` parameter to `$input_string` in
* `_wp_json_convert_string()`
* `_wp_to_kebab_case()`
* Renames the `$list` parameter to `$input_list` in:
* `wp_parse_list()`
* `wp_parse_id_list()`
* `wp_parse_slug_list()`
* `wp_filter_object_list()`
* `wp_list_filter()`
* `wp_list_pluck()`
* `wp_list_sort()`
* Renames the `$array` parameter to `$input_array` in:
* `add_magic_quotes()`
* `wp_array_slice_assoc()`
* `_wp_array_get()`
* `_wp_array_set()`
* Renames the `$function` parameter to `$function_name` in:
* `_deprecated_function()`
* `_deprecated_argument()`
* `_doing_it_wrong()`
* Renames the `$class` parameter to `$class_name` in `_deprecated_constructor()`.
* Renames the `$default` parameter to `$default_value` in `apache_mod_loaded()`.
* Renames the `$var` parameter to `$value` in `wp_validate_boolean()`.
* Amends the `$input` parameter in `wp_parse_str()` for consistency.
Follow-up to [52946], [52996], [52997], [52998], [53003], [53014], [53029], [53039], [53116], [53117], [53137], [53174], [53184], [53185], [53192], [53193], [53198], [53203], [53207], [53215], [53216], [53220], [53230], [53232], [53236], [53239], [53240], [53242], [53243], [53245], [53246], [53257], [53269], [53270], [53271], [53272], [53273], [53274], [53275], [53276], [53277], [53281], [53283], [53284], [53285], [53287], [53364], [53365], [54927].
Props jrf, aristath, poena, justinahinon, SergeyBiryukov.
See #56788.
Built from https://develop.svn.wordpress.org/trunk@54929
git-svn-id: http://core.svn.wordpress.org/trunk@54481 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Includes minor formatting edits for consistency.
Follow-up to [53/tests], [12179], [12946], [35288], [37884], [38810], [38928], [46596], [48131], [52955], [53548], [53813], [53873], [54118], [54316], [54420], [54421], [54803].
See #56792.
Built from https://develop.svn.wordpress.org/trunk@54855
git-svn-id: http://core.svn.wordpress.org/trunk@54407 1a063a9b-81f0-0310-95a4-ce76da25c4cd
In [53874] the optional `$locale` parameter was added to `load_textdomain()`. While most `load_textdomain()` calls in core were were updated, some were missed. Passing the original locale avoids the need to call `determine_locale()` by `load_textdomain()` which is used as a fallback.
Props ocean90, swissspidy, desrosj.
See #57060.
Built from https://develop.svn.wordpress.org/trunk@54797
git-svn-id: http://core.svn.wordpress.org/trunk@54349 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Based on feedback from network storage configurations there was a noticed slowdown due to the usage of the `path_join()` function. This needs more time to find a workaround.
Follow-up to [53934].
Props mreishus, SergeyBiryukov, desrosj, mikeschroder.
Reverts [53934].
See #56924.
Built from https://develop.svn.wordpress.org/trunk@54712
git-svn-id: http://core.svn.wordpress.org/trunk@54264 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset fixes a warning where `strip_tags()` expected its first parameter to be a string rather than an array. It contains the following changes:
- Removal of sanitize_callback to allow the REST API to handle the validation natively, this also causes the proper error to be output for `?slug[0][1]=2` that it's an invalid value.
- Ensure that `wp_parse_list()` only returns a single-dimensioned array, even if passed a multi-dimension array, which fits the functions expected use case and resolves warnings in code that expects the function to return a single-dimensioned array.
Props dd32, TimothyBlynJacobs.
Fixes#55838.
Built from https://develop.svn.wordpress.org/trunk@54476
git-svn-id: http://core.svn.wordpress.org/trunk@54035 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset removes all instances of `_wp_http_referer` variable from the URL when creating a hidden input for `_wp_http_referer`. It prevents the hidden field from having an additional version of `_wp_http_referer` each time the form is submitted.
Props msolution, justinahinon, pbearne, mikeschroder, mukesh27, audrasjb, Clorith, chaion07, robinwpdeveloper, hztyfoon, davidbaumwald, costdev, adamsilverstein.
Fixes#54106.
Built from https://develop.svn.wordpress.org/trunk@54449
git-svn-id: http://core.svn.wordpress.org/trunk@54008 1a063a9b-81f0-0310-95a4-ce76da25c4cd
`realpath()` already checks if the file exists, and returns `false` on failure. The additional `file_exists()` check is not necessary and can be removed, improving the performance.
This commit simplifies the checks in two functions:
* `register_block_type_from_metadata()`
* `wp_json_file_decode()`
Note: In both of these cases, the values are passed through `wp_normalize_path()` after `realpath()`, so if the file does not exist, the `false` value gets converted to an empty string. The updated checks work both for `false` and `''` values.
Though this is a small tweak, it saves a lot of checks since one of the places we do this is when registering block styles, so it runs quite a few times on each page load.
Reference: [https://www.php.net/manual/en/function.realpath.php PHP Manual: realpath()].
Follow-up to [51599], [54132], [54290], [54291].
Props aristath.
Fixes#56654.
Built from https://develop.svn.wordpress.org/trunk@54309
git-svn-id: http://core.svn.wordpress.org/trunk@53868 1a063a9b-81f0-0310-95a4-ce76da25c4cd
If the `apache_get_modules()` function is redeclared to return an empty array, `apache_mod_loaded()` would assume that no Apache modules are installed and activated, which may not be correct.
This commit improves the logic by using pre-existing `phpinfo()` fallback to check for loaded modules in that case.
Includes replacing a hardcoded number passed as a flag to `phpinfo()` with the `INFO_MODULES` predefined constant for clarity.
Follow-up to [7441], [7508], [29330].
Props engahmeds3ed, audrasjb, Clorith, SergeyBiryukov.
Fixes#56010.
Built from https://develop.svn.wordpress.org/trunk@54299
git-svn-id: http://core.svn.wordpress.org/trunk@53858 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Global terms was a feature from the WordPress MU days where multisite and single site installs used different code bases.
In WordPress 3.0, WordPress MU was merged into one location and the UI [14854] and “on” switch [14880] for global terms were completely removed.
Even before this merge, global terms was bug infested and unreliable. After [14854]/[14880], the feature was no longer maintained and became increasingly broken as taxonomies progressed without it (term splitting and term meta do not work at all). At this point, the feature has not worked in 12+ years and there’s no hope for saving it.
This deprecates the remaining global terms related code and no-ops the functions.
Global terms, you don’t have to go home, but you can’t stay here.
Props scribu, wonderboymusic, SergeyBiryukov, nacin, pento, desrosj, johnjamesjacoby, johnbillion, dd32.
Fixes#21734.
Built from https://develop.svn.wordpress.org/trunk@54240
git-svn-id: http://core.svn.wordpress.org/trunk@53799 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This fixes a bug where if the `timezone_string` is set to a timezone name which has since been deprecated, no option would be (pre-)selected in the generated dropdown list and when the form using the dropdown list is submitted, the “old”, originally saved value would be lost as the form would submit without a value being selected for the `timezone_string` field.
The fix is a little hacky: it basically checks ahead of generating the actual dropdown list whether the `$selected_zone` value would be recognized and set to “selected” and if not, verifies that the value ''is'' a valid but outdated timezone name and if so, adds an extra dropdown entry to the top of the list with the original value and sets this value to “selected”.
See the extensive write-up about this in ticket #56468.
Also see: [https://www.php.net/manual/en/datetimezone.listidentifiers.php PHP Manual: timezone_identifiers_list()].
Note: There are no pre-existing tests at all for this method and adding a complete set of tests for this method is outside the scope of this ticket, so this fix does not contain any tests.
Follow-up to [54207], [54217], [54227], [54229], [54230], [54232].
Props jrf, costdev, marcyoast.
See #56468.
Built from https://develop.svn.wordpress.org/trunk@54233
git-svn-id: http://core.svn.wordpress.org/trunk@53792 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Allows Classic / Hybrid themes to use block-based template parts without using complete block-based templates.
* Exposes the Site Editor's template parts UI
* Adds Appearance > "Template Parts" menu
* Enabled within the theme via adding a theme support for `'block-template-parts'`
{{{#!php
add_theme_support( 'block-template-parts' );
}}}
This is a backport from Gutenberg.[https://github.com/WordPress/gutenberg/pull/42729 See WordPress/gutenberg PR 42729].
Follow-up to [52330], [52069], [52178].
Props mamaduka, fabiankaegy, poena, scruffian, manfcarlo, bernhard-reiter, hellofromTonya.
See #56467.
Built from https://develop.svn.wordpress.org/trunk@54176
git-svn-id: http://core.svn.wordpress.org/trunk@53735 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Following the update to replace the HTTP API internals with Requests library in WordPress 4.6, the return value of `wp_remote_retrieve_headers()` has changed from a simple array to an object which implements `ArrayAccess`.
Since `wp_get_http_headers()` directly returns the result of `wp_remote_retrieve_headers()`, its return value should reflect that change.
Includes:
* Updating the return value for the deprecated `wp_get_http()` function, which also directly returns the result of `wp_remote_retrieve_headers()`.
* Minor DocBlock formatting changes for some other HTTP API functions per the documentation standards.
Follow-up to [2416], [6390], [8092], [9013], [37428], [37989], [38730].
Props mhkuu.
See #54225, #55646.
Built from https://develop.svn.wordpress.org/trunk@54157
git-svn-id: http://core.svn.wordpress.org/trunk@53716 1a063a9b-81f0-0310-95a4-ce76da25c4cd
In `wp_guess_url`, the regex to check for wp-login.php in the URL is slightly too permissive, not escaping `.` in "wp-login.php". `.` is a token in regex that matches any character.
This change simply escapes the `.` and adds unit test coverage for `wp_guess_url`.
Props cfinke, ocean90, jrf, voldemortensen, jdgrimes, curdin, netweb, petitphp, SergeyBiryukov, costdev.
Fixes#36827.
Built from https://develop.svn.wordpress.org/trunk@54146
git-svn-id: http://core.svn.wordpress.org/trunk@53705 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The existing filter `image_editor_output_format` receives an additional parameter `$size_name` which is populated whenever it controls the output format for a specific registered image size to create. Otherwise, it remains empty. In order to achieve this, a low level change has been added in bringing a new `$size_name` class property to the `WP_Image_Editor` base class, which is introduced in a backward compatible way that will not cause conflicts with custom implementations.
This parameter is then used in new logic inside the `wp_default_image_output_mapping()` callback function for the filter, controlling whether `image/jpeg` should map to `image/webp` output or not. By default, this is enabled for all WordPress core image sizes by default, and this list can be modified using a new `wp_image_sizes_with_additional_mime_type_support` filter, e.g. to remove core sizes or add custom sizes.
The customization per image size may be further enhanced by providing a more declarative API via a new parameter on the `add_image_size()` function.
Props eugenemanuilov, flixos90, adamsilverstein, joegrainger.
Fixes#56526.
See #55443, #56288.
Built from https://develop.svn.wordpress.org/trunk@54097
git-svn-id: http://core.svn.wordpress.org/trunk@53656 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Remove the private delegation from the following cache priming functions for various object types:
- `_prime_post_caches()`
- `_prime_term_caches()`
- `_prime_comment_caches()`
- `_prime_network_caches()`
- `_prime_site_caches()`
- `_get_non_cached_ids() `
Plugins and themes are now encouraged to use these functions to improve the performance of their code by reducing the number of database queries.
Props robinwpdeveloper, desrosj, SergeyBiryukov, mukesh27, costdev.
Fixes#56386.
Built from https://develop.svn.wordpress.org/trunk@53944
git-svn-id: http://core.svn.wordpress.org/trunk@53503 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Previously, Windows paths in the `path_is_absolute` function resulted in incorrect URIs. This patch adjusts for forward slashes and adds tests for the `get_attached_file` function.
Props Whissi, SergeyBiryukov, desrosj, stevenlinx, birgire, davidbaumwald, costdev, peterwilsoncc, audrasjb, hellofromTonya, johnbillion.
Fixes#36308.
Built from https://develop.svn.wordpress.org/trunk@53934
git-svn-id: http://core.svn.wordpress.org/trunk@53493 1a063a9b-81f0-0310-95a4-ce76da25c4cd
* Move the colon inside the `<strong>` tags in some `Error:` prefixes, to match other strings.
* Move the full stop at the end of some sentences outside of the `<strong>` tags used for individual phrases.
Follow-up to [11669], [23844], [53118], [53458], [53476].
Props NekoJonez, Presskopp.
Fixes#56027.
Built from https://develop.svn.wordpress.org/trunk@53700
git-svn-id: http://core.svn.wordpress.org/trunk@53259 1a063a9b-81f0-0310-95a4-ce76da25c4cd
If the path starts with a slash, it will be considered absolute and returned as is earlier in the function.
It it's not absolute, then it does not start with a slash, so there is nothing to trim.
This change is covered by existing unit tests.
Follow-up to [6984], [53457].
Props karlijnbk.
See #55897.
Built from https://develop.svn.wordpress.org/trunk@53460
git-svn-id: http://core.svn.wordpress.org/trunk@53049 1a063a9b-81f0-0310-95a4-ce76da25c4cd
`phpversion()` return value and `PHP_VERSION` constant value are identical, but the latter is several times faster because it is a direct constant value lookup compared to a function call.
Props ayeshrajans, jrf, mukesh27, costdev, hellofromTonya, SergeyBiryukov.
Fixes#55680.
Built from https://develop.svn.wordpress.org/trunk@53426
git-svn-id: http://core.svn.wordpress.org/trunk@53015 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Replace error suppressing in `wp_filesize()` with a `file_exists()` check before calling the native PHP `filesize()` function.
Follow up to [52837].
Props Cybr, johnbillion, spacedmonkey, antpb, azouamauriac, ironprogrammer, mukesh27, costdev, audrasjb, dlh.
Fixes#55678.
See #49412.
Built from https://develop.svn.wordpress.org/trunk@53372
git-svn-id: http://core.svn.wordpress.org/trunk@52961 1a063a9b-81f0-0310-95a4-ce76da25c4cd
While using reserved PHP keywords as parameter name labels is allowed, in the context of function calls using named parameters in PHP 8.0+, this will easily lead to confusion. To avoid that, it is recommended not to use reserved keywords as function parameter names.
This commit renames the `$function` parameter to `$callback` in `wp_die_*_handler` filters, which aims to make it easier to use a non-reserved parameter name for anyone utilizing these filters.
Follow-up to [52946], [52996], [52997], [52998], [53003], [53014], [53029], [53039], [53116], [53117], [53137], [53174], [53184], [53185], [53192], [53193], [53198], [53203], [53207], [53215], [53216], [53220], [53230], [53232], [53236], [53239], [53240], [53242].
Props jrf, aristath, poena, justinahinon, SergeyBiryukov.
See #55327.
Built from https://develop.svn.wordpress.org/trunk@53243
git-svn-id: http://core.svn.wordpress.org/trunk@52832 1a063a9b-81f0-0310-95a4-ce76da25c4cd
`wp_list_pluck()` is used by WordPress to pluck items from a list. Of course, this requires a list. This validates the input of `wp_list_pluck()` to ensure it is a list.
This matches the behaviour of `wp_list_sort()` and `wp_filter_object_list()`.
Props marv2, davidbaumwald, mkox, SergeyBiryukov, dd32.
Fixes#54751.
Built from https://develop.svn.wordpress.org/trunk@53045
git-svn-id: http://core.svn.wordpress.org/trunk@52634 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When using a block theme that declares Widgets support, it's better to not specify a menu order for the Widgets menu to avoid conflicts between menu items order.
Props Rufus87, ironprogrammer, audrasjb, hellofromTonya, davidbaumwald.
Fixes#54916.
Built from https://develop.svn.wordpress.org/trunk@53020
git-svn-id: http://core.svn.wordpress.org/trunk@52609 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The new location is next to the pre-existing `count_users()` function, along with other user-specific functions, and should be a more appropriate place in terms of consistency.
This affects:
* `get_user_count()`
* `wp_maybe_update_user_counts()`
* `wp_update_user_counts()`
* `wp_schedule_update_user_counts()`
* `wp_is_large_user_count()`
Follow-up to [53011], [53016].
See #38741.
Built from https://develop.svn.wordpress.org/trunk@53018
git-svn-id: http://core.svn.wordpress.org/trunk@52607 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Currently in WordPress multisite there is a concept of large networks. The function `wp_is_large_network` is used to determine if a network has a large number of sites or users. If a network is marked as large, then
expensive queries to calculate user counts are not run on page load but deferred to scheduled events. However there are a number of places in a single site installation where this functionality would also be useful, as
expensive calls to count users and roles can make screens in the admin extremely slow.
In this change, the `get_user_count` function and related functionality around it is ported to be available in a single site context. This means that expensive calls to the `count_users` function are replaced with
calls to `get_user_count`. This change also includes a new function called `wp_is_large_user_count` and a filter of the same name, to mark if a site is large.
Props johnbillion, Spacedmonkey, Mista-Flo, lumpysimon, tharsheblows, obenland, miss_jwo, jrchamp, flixos90, macbookandrew, pento, desrosj, johnjamesjacoby, jb510, davidbaumwald, costdev.
Fixes#38741.
Built from https://develop.svn.wordpress.org/trunk@53011
git-svn-id: http://core.svn.wordpress.org/trunk@52600 1a063a9b-81f0-0310-95a4-ce76da25c4cd
A new function `wp_filesize()` was added with [52837]. The function lived in the `wp-admin/includes/file.php` file. However, this admin specific function is not loaded into memory when hitting `media/edit` endpoint. The result was a `500` Internal Server Error. Why? The function is invoked with that endpoint, but the function does not exist in memory.
This commit relocates the new function to the `wp-includes/functions.php` file. In doing so, the function is available for both the frontend and backend.
Follow-up to [52837].
Props talldanwp, spacedmonkey, costdev, antonvlasenko.
Fixes#55367.
Built from https://develop.svn.wordpress.org/trunk@52932
git-svn-id: http://core.svn.wordpress.org/trunk@52521 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The list item separator is a locale property, and it doesn't make much sense to translate it separately in multiple projects. This changeset implements the following modifications:
- Define list item separator as a new WP_Locale property
- Add `wp_get_list_item_separator()` as a wrapper for `WP_Locale::get_list_item_separator`
- Replace `$wp_locale->get_list_item_separator()` calls with `wp_get_list_item_separator()`
- Added a compatibility layer for bundled themes
Props SergeyBiryukov, swissspidy, rsiddharth, johnbillion, audrasjb.
Fixes#39733.
Built from https://develop.svn.wordpress.org/trunk@52929
git-svn-id: http://core.svn.wordpress.org/trunk@52518 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset adjusts the regex in `wp_check_filetype()` to support query strings in URLs.
Follow-up to [30640], [32172].
Props voldemortensen, johnbillion, layotte, dd32, atomicjack, supercleanse, spencercameron, ianmjones, audrasjb.
Fixes#30377.
Built from https://develop.svn.wordpress.org/trunk@52829
git-svn-id: http://core.svn.wordpress.org/trunk@52418 1a063a9b-81f0-0310-95a4-ce76da25c4cd
`file_get_contents()` is faster than `fread()`, because the PHP core can decide how to best read the remaining file; it could decide to issue just one `read()` call or `mmap()` the file first.
Per the PHP manual, `file_get_contents()` or `stream_get_contents()` is the preferred way to read the contents of a file into a string. It will use memory mapping techniques if supported by the OS to enhance performance.
Reference: [https://www.php.net/manual/en/function.file-get-contents.php PHP Manual: file_get_contents()].
Follow-up to [50810], [52696], [52698].
Props maxkellermann.
See #55069.
Built from https://develop.svn.wordpress.org/trunk@52701
git-svn-id: http://core.svn.wordpress.org/trunk@52290 1a063a9b-81f0-0310-95a4-ce76da25c4cd
`file_get_contents()` is faster than `fread()`, because the PHP core can decide how to best read the remaining file; it could decide to issue just one `read()` call or `mmap()` the file first.
Per the PHP manual, `file_get_contents()` or `stream_get_contents()` is the preferred way to read the contents of a file into a string. It will use memory mapping techniques if supported by the OS to enhance performance.
Reference: [https://www.php.net/manual/en/function.file-get-contents.php PHP Manual: file_get_contents()].
Follow-up to [12044], [49073], [52696].
Props maxkellermann.
See #55069.
Built from https://develop.svn.wordpress.org/trunk@52698
git-svn-id: http://core.svn.wordpress.org/trunk@52287 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Twenty Twenty-Two requires WordPress 5.9 but currently can't be (re)activated in the 5.9 branch because `version_compare( '5.9-RC3-52627', '5.9', '>=' )` as used by `is_wp_version_compatible()` returns `false`. To appreciate the testing of upcoming versions any `-alpha`, `-RC`, `-beta` suffixes are now stripped off from the WordPress version before checking for compatibility.
Fixes#54882.
Built from https://develop.svn.wordpress.org/trunk@52628
git-svn-id: http://core.svn.wordpress.org/trunk@52216 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This makes the strings easier to translate and provides more details about what exactly is deprecated: a PHP function, a file name, or a WordPress hook.
The changes apply to:
* `_deprecated_function()`
* `_deprecated_constructor()`
* `_deprecated_file()`
* `_deprecated_argument()`
* `_deprecated_hook()`
* `_doing_it_wrong()`
Follow-up to [6514], [7884], [12536], [12584], [16939], [16942], [16945], [24439], [24723], [32989], [37861], [39315].
Props mukesh27, audrasjb, SergeyBiryukov.
Fixes#54658.
Built from https://develop.svn.wordpress.org/trunk@52609
git-svn-id: http://core.svn.wordpress.org/trunk@52197 1a063a9b-81f0-0310-95a4-ce76da25c4cd
If after processing through `add_query_arg()` a `?#` remains, this commit removes the unnecessary and unused `?` character as there are no query args in the URL.
Includes tests.
Follow-up to [1823], [5193], [5999], [6005].
Props benjaminanakenam, sabernhardt, costdev, hellofromTonya.
Fixes#44499.
Built from https://develop.svn.wordpress.org/trunk@52187
git-svn-id: http://core.svn.wordpress.org/trunk@51779 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Clarify messaging of when `wp_nonce_ays('log-out')` is called due to an invalid log out nonce. The HTML title now describes the action being taken rather than using the generic text "something went wrong".
Props davidkryzaniak, hellofromTonya, peterwilsoncc.
Fixes#52600.
Built from https://develop.svn.wordpress.org/trunk@52088
git-svn-id: http://core.svn.wordpress.org/trunk@51680 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The code in `wp_list_filter()` was a duplicate of `wp_filter_object_list()`, minus the `WP_List_Util::pluck()` (used when `$field` is configured).
In testing the wrapper, discovered an edge case (and potential bug) in `WP_List_Util::filter()` where if the operator matches an empty array was returned without resetting the output property. Without that property being set correctly, `WP_List_Util::get_output()` was not correct. This commit also fixes this by resetting the property to an empty array.
Follow-up to [15686], [17427], [38928], [51044].
Props pbearne, sergeybiryukov, hellofromTonya.
Fixes#53988.
Built from https://develop.svn.wordpress.org/trunk@52066
git-svn-id: http://core.svn.wordpress.org/trunk@51658 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Previously, when uploading a media item type that is not supported, the default error message claims that the reason it cannot upload is due to security reasons. This is not always true. Now the warning says that the type is not allowed, which is always true.
Props antpb, Presskopp, peterwilsoncc, desrosj, iluy, circlecube, mikeschroder.
Fixes#53626.
Built from https://develop.svn.wordpress.org/trunk@52032
git-svn-id: http://core.svn.wordpress.org/trunk@51624 1a063a9b-81f0-0310-95a4-ce76da25c4cd
>PHP natively allows for autovivification (auto-creation of arrays from falsey values). This feature is very useful and used in a lot of PHP projects, especially if the variable is undefined. However, there is a little oddity that allows creating an array from a `false` and `null` value.
The above quote is from the PHP 8.1 RFC and the (accepted) RFC changes the behaviour described above to deprecated auto creation of arrays from `false`. As it is deprecated, it _will_ still work for the time being, but as of PHP 9.0, this will become a Fatal Error, so we may as well fix it now.
The `recurse_dirsize()` function retrieves a transient and places it in the `$directory_cache` variable, but the `get_transient()` function in WP returns `false` when the transient doesn't exist, which subsequently can lead to the above mentioned deprecation notice.
By verifying that the `$directory_cache` variable is an array before assigning to it and initializing it to an empty array, if it's not, we prevent the deprecation notice, as well as harden the function against potentially corrupted transients where this transient would not return the expected array format, but some other variable type.
Includes adding dedicated unit tests for both the PHP 8.1 issue, as well as the hardening against corrupted transients.
Includes some girl-scouting: touching up a parameter description and some code layout.
Refs:
* https://wiki.php.net/rfc/autovivification_false
* https://developer.wordpress.org/reference/functions/get_transient/
Follow-up to [49212], [49744].
Props jrf, hellofromTonya.
See #53635.
Built from https://develop.svn.wordpress.org/trunk@51911
git-svn-id: http://core.svn.wordpress.org/trunk@51504 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When the PHP native `dirname()` function is used on a Windows disk name - i.e. `C:\`-, it will return the same, i.e, it will return `C:\` again.
The `clean_dirsize_cache()` function didn't have guard clause against this, which meant that on Windows based systems and IIS servers, this function would result in WordPress getting stuck into an infinite loop.
The adjustment to the `while` part of the function fix this by checking if the return value of the `dirname()` function call is the same as the original path passed to `dirname()`, which effectively fixes the infinite loop.
A number of other improvements made:
1. Add input validation for the `$path` parameter to guard against invalid variable types being passed into the function.
2. Guard against an empty `$path` parameter, which would result in an infinite loop on both Windows as well as *nix based systems.
In both these cases, a PHP notice will now be thrown.
3. When a non-empty string, which isn't a path would previously be passed, the `dirname()` function would transform that to a `.` and the `.` key in the transient cache would be cleared out.
This was a bug as there is no relation between a non-path string and the root directory of file system.
This bug has been fixed by checking that something could actually be a path and handling received non-empty, non-path input parameters in a special way, i.e only removing the cache key for the passed string and bowing out from further processing.
Unfortunately, no tests can be added to guard against the infinite loop.
For the other fixes, we have added appropriate unit tests.
Follow-up up [49212], [49616], [49744].
Props jrf, hellofromTonya, raubvogel, sergeybiryukov, codezen8, sjlevy, drosmog, teachlynx, ekojr, bartoszgrzesik, joegasper, janthiel, josephdickson, ocean90, audrasjb.
Fixes#52241.
Built from https://develop.svn.wordpress.org/trunk@51910
git-svn-id: http://core.svn.wordpress.org/trunk@51503 1a063a9b-81f0-0310-95a4-ce76da25c4cd
John Blackbourn
Sergey Biryukov
spacedmonkey
hellofromTonya
audrasjb
Peter Wilson
Dominik Schilling
antpb
davidbaumwald
desrosj
Felix Arntz
gziolo