a2d1cee61d
KSES: Make the URI attributes DRY.
...
This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.
Merges [44014] and [44017] to the `3.7` branch.
Built from https://develop.svn.wordpress.org/branches/3.7@44049
git-svn-id: http://core.svn.wordpress.org/branches/3.7@43879 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:27:08 +00:00
81fb9c10a2
Multisite: Improve messaging for previously activated users.
...
Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time.
Merges [44021] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@44040
git-svn-id: http://core.svn.wordpress.org/branches/3.7@43870 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:14:07 +00:00
c36f3a8be3
KSES: Conditionally remove the `<form>` element from `$allowedposttags`.
...
To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.
Merges [43994] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@44019
git-svn-id: http://core.svn.wordpress.org/branches/3.7@43849 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 00:06:07 +00:00
a1d2eb2c85
Media: Improve verification of MIME file types.
...
Merges [43988] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@44012
git-svn-id: http://core.svn.wordpress.org/branches/3.7@43842 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:50:09 +00:00
216ea4f2d0
Bump 3.7 branch to version 3.7.27
...
Built from https://develop.svn.wordpress.org/branches/3.7@43419
git-svn-id: http://core.svn.wordpress.org/branches/3.7@43247 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 16:14:30 +00:00
32bf48628e
Media: Limit thumbnail file deletions to the same directory as the original file.
...
Merges [43393] into the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@43405
git-svn-id: http://core.svn.wordpress.org/branches/3.7@43233 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 15:19:09 +00:00
71f5f5fe6a
Bump 3.7 branch to version 3.7.26
...
Built from https://develop.svn.wordpress.org/branches/3.7@42945
git-svn-id: http://core.svn.wordpress.org/branches/3.7@42775 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 20:32:43 +00:00
505af40a68
Template: Make sure the version string is correctly escaped for use in attributes.
...
Merge of [42893] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@42929
git-svn-id: http://core.svn.wordpress.org/branches/3.7@42759 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 16:11:43 +00:00
ae9bfeddd3
Bump the 3.7 branch to 3.7.25.
...
Built from https://develop.svn.wordpress.org/branches/3.7@42506
git-svn-id: http://core.svn.wordpress.org/branches/3.7@42335 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 21:47:35 +00:00
b572e86a4a
External Libraries: Remove unnecessary / obsoleted MediaElement.js files.
...
Merges [42478] to the 3.7 branch.
Fixes #42720 for 3.7.
Built from https://develop.svn.wordpress.org/branches/3.7@42489
git-svn-id: http://core.svn.wordpress.org/branches/3.7@42318 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 08:16:11 +00:00
8698e8339a
Bump 3.7 branch to version 3.7.24.
...
Built from https://develop.svn.wordpress.org/branches/3.7@42328
git-svn-id: http://core.svn.wordpress.org/branches/3.7@42157 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 19:06:09 +00:00
9f7b91d4bc
Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability.
...
Merges [42261] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@42315
git-svn-id: http://core.svn.wordpress.org/branches/3.7@42144 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:53:09 +00:00
d7915c3e73
Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
...
Merges [42260] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@42314
git-svn-id: http://core.svn.wordpress.org/branches/3.7@42143 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:52:10 +00:00
149cdb0766
Hardening: Add escaping to the language attributes used on `html` elements.
...
Merges [42259] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@42313
git-svn-id: http://core.svn.wordpress.org/branches/3.7@42142 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:50:09 +00:00
94278eddb6
WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined.
...
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 3.7 branch.
Fixes #42431 and #42401 for 3.7.
Built from https://develop.svn.wordpress.org/branches/3.7@42241
git-svn-id: http://core.svn.wordpress.org/branches/3.7@42070 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-27 01:15:10 +00:00
2fd667487f
Bump 3.7 branch to version 3.7.23.
...
Built from https://develop.svn.wordpress.org/branches/3.7@42080
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41909 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 13:47:10 +00:00
083e886cf7
Database: Restore numbered placeholders in `wpdb::prepare()`.
...
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.
This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.
Merges [41662], [42056] to the 3.7 branch.
See #41925 .
Built from https://develop.svn.wordpress.org/branches/3.7@42068
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41897 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 13:02:10 +00:00
67bf4cd7e1
Bump 3.7 branch to version 3.7.22.
...
Built from https://develop.svn.wordpress.org/branches/3.7@41521
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41354 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 20:14:20 +00:00
7b03bfc16f
Database: Hardening to bring `wpdb::prepare()` inline with documentation.
...
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.
Merges [41496] to 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@41508
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41341 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 18:46:09 +00:00
0a541104e3
Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`.
...
While `wpdb::prepare()` does not support null values (see #12819 ) they still appear in the wild like in the WordPress Importer and other plugins.
Merges [41483] to 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@41495
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41328 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 16:30:22 +00:00
029d279155
Database: Hardening for `wpdb::prepare()`
...
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.
Merges [41470] to 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@41482
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41315 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 15:06:09 +00:00
86b3a35dd7
Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog.
...
Merge of [41393] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@41411
git-svn-id: http://core.svn.wordpress.org/branches/3.7@41244 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:20:44 +00:00
fe080e84db
Bump 3.7 branch to version 3.7.21.
...
Built from https://develop.svn.wordpress.org/branches/3.7@40758
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40616 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 21:54:15 +00:00
8ae6705fd2
Media: Simplify upload error message construction.
...
Merges [40736] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40747
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40605 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 18:05:51 +00:00
303264210a
Customize: Ignore invalid customization sessions.
...
Merge of [40704] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40715
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40578 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 12:23:10 +00:00
b89aca0478
Adjust post meta checks
...
Merges [40692] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40703
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40566 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:54:35 +00:00
1ab98bf52d
Whitelist post arguments in XML-RPC
...
Merges [40677] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40688
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40551 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:31:09 +00:00
a2797f26d2
Bump 3.7 branch to version 3.7.20.
...
Built from https://develop.svn.wordpress.org/branches/3.7@40497
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40373 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-04-20 16:30:10 +00:00
85e61d7921
Bump 3.7 branch to version 3.7.19.
...
Built from https://develop.svn.wordpress.org/branches/3.7@40212
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40151 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 16:50:09 +00:00
3e68b0c7d1
Strip control characters before validating redirect.
...
Merges [40183] to 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40194
git-svn-id: http://core.svn.wordpress.org/branches/3.7@40133 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 13:47:09 +00:00
44b16a7d23
Bump 3.7 branch to version 3.7.18.
...
Built from https://develop.svn.wordpress.org/branches/3.7@40006
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39943 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 18:31:11 +00:00
e62f79cfd7
Query: Ensure that queries work correctly with post type names with special characters.
...
Merge of [39952] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39966
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39903 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 13:53:22 +00:00
0a294916d9
Bump 3.7 branch to version 3.7.17.
...
Built from https://develop.svn.wordpress.org/branches/3.7@39870
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39807 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 17:00:22 +00:00
8d4f4a9a05
Media: Fix exif_imagetype check in wp_get_image_mime
...
This is a follow up to [39831].
Merges [39850] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39861
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39798 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 16:46:22 +00:00
e6de513be6
Media: Improve image filetype checking.
...
This adds a new function `wp_get_image_mime()` which is used by
`wp_check_filetype_and_ext()` to validate image files using
`exif_imagetype()` if available instead of `getimagesize()`.
`getimagesize()` is less performant than `exif_imagetype()` and is
dependent on GD. If `exif_imagetype()` is not available, it falls back to
`getimagesize()` as before.
If `wp_check_filetype_and_ext()` can't validate the filetype, we now return
`false` for ext/MIME values.
Merges [39831] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39842
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39780 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 13:21:09 +00:00
30b010ce8a
Themes: Fix markup for theme name fallbacks.
...
Merge of [39807] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39819
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39757 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 11:13:14 +00:00
c094d37899
Multisite: Use `wp_rand()` in signup key creation.
...
Merges [39795] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@39806
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39744 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:36:51 +00:00
784f429843
Update PHPMailer to 5.2.22.
...
The full list of changes is available here:
https://github.com/PHPMailer/PHPMailer/compare/v5.2.21...v5.2.22
Merges [39759] to the 3.7 branch.
Fixes #37210 for 3.7.
Built from https://develop.svn.wordpress.org/branches/3.7@39794
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39732 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:28:09 +00:00
45af63e137
Mail: Upgrade PHPMailer to 5.2.21.
...
Merges [39645], [36083], [33142], [33124], [29783], [27385] to the 3.7 branch.
See #37210 .
Built from https://develop.svn.wordpress.org/branches/3.7@39731
git-svn-id: http://core.svn.wordpress.org/branches/3.7@39671 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-06 22:07:14 +00:00
4afbabc9ca
Bump 3.7 branch to 3.7.16.
...
Built from https://develop.svn.wordpress.org/branches/3.7@38558
git-svn-id: http://core.svn.wordpress.org/branches/3.7@38501 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-07 15:02:36 +00:00
afe460ad19
Bump 3.7 branch to 3.7.15.
...
Built from https://develop.svn.wordpress.org/branches/3.7@37836
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37801 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 16:52:09 +00:00
eab4230e88
Media: Improve handling of extensionless filenames.
...
Merge of [37756] to the 3.7 branch.
See #37111 .
Built from https://develop.svn.wordpress.org/branches/3.7@37825
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37790 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 15:02:09 +00:00
361dc33680
Admin: Escape attachment name in case it contains special characters
...
Merge of [37774] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@37795
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37760 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:30:09 +00:00
5e739be4f6
Admin: Allow for the consistent filtering of `auth_redirect_scheme`
...
Merge of [37651] to the 3.7 branch.
See #37047 .
Built from https://develop.svn.wordpress.org/branches/3.7@37766
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37731 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:14:10 +00:00
5543fabff3
Bump 3.7 branch to 3.7.14.
...
Built from https://develop.svn.wordpress.org/branches/3.7@37392
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37358 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-05-06 18:16:17 +00:00
b3887842de
External Libaries: missed SWF file changes from [37368]
...
Built from https://develop.svn.wordpress.org/branches/3.7@37369
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37335 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-05-06 17:51:08 +00:00
f5195ba547
External Libraries: Disable Flash backend for Plupload
...
Built from https://develop.svn.wordpress.org/branches/3.7@37368
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37334 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-05-06 17:36:10 +00:00
3d1fc411a1
Taxonomies: make sure taxonomy functions work correctly with taxonomy names with special characters
...
The codex says that taxonomy names "should only contain lowercase letters and the underscore character", but that's not enforced. It's too late to enforce it, since some plugins haven't been following it and the official phpdoc doesn't mention this restriction.
Merge of [37133] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@37142
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37109 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-03-30 17:43:08 +00:00
fa21da538e
HTTP: Improve detection of valid IP addresses.
...
Merge of [37115] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@37123
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37090 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-03-30 15:54:08 +00:00
9bf06fa83b
Snoopy: use escapeshellarg instead of escapeshellcmd
...
We are escaping arguments, not commands, so we'd better use the semantically correct function, even though they are similar.
Merges [37094] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@37102
git-svn-id: http://core.svn.wordpress.org/branches/3.7@37069 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-03-30 14:16:09 +00:00
iandunn
Peter Wilson
Gary Pendergast
Jeremy Felt
Aaron Campbell
John Blackbourn
Dominik Schilling
Dion Hulse
Pascal Birchler
James Nylen
Joe McGill
Boone Gorges
Nikolay Bachiyski