a964c2ba2e
Database: Hardening to bring `wpdb::prepare()` inline with documentation.
...
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.
Merges [41496] to 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@41503
git-svn-id: http://core.svn.wordpress.org/branches/4.2@41336 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 18:31:29 +00:00
79e0bb13d4
Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`.
...
While `wpdb::prepare()` does not support null values (see #12819 ) they still appear in the wild like in the WordPress Importer and other plugins.
Merges [41483] to 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@41490
git-svn-id: http://core.svn.wordpress.org/branches/4.2@41323 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 16:25:54 +00:00
be9edc6bc3
Database: Hardening for `wpdb::prepare()`
...
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.
Merges [41470] to 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@41477
git-svn-id: http://core.svn.wordpress.org/branches/4.2@41310 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 15:03:30 +00:00
a59dfc257f
Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues.
...
Merges [41457] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@41464
git-svn-id: http://core.svn.wordpress.org/branches/4.2@41297 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 14:43:56 +00:00
6ddef3f8ab
General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.
...
Merges [41434] with changes to the 4.2 branch.
See #13377
Built from https://develop.svn.wordpress.org/branches/4.2@41445
git-svn-id: http://core.svn.wordpress.org/branches/4.2@41278 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 13:32:30 +00:00
74df39530d
TinyMCE: Improve the previews for shortcodes.
...
Merge of [41395] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@41441
git-svn-id: http://core.svn.wordpress.org/branches/4.2@41274 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 12:44:31 +00:00
e7865eb9ae
Users: Provide a fallback for incorrect HTTP referrers.
...
Merge of [41398] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@41423
git-svn-id: http://core.svn.wordpress.org/branches/4.2@41256 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 11:14:36 +00:00
ecf502b597
Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog.
...
Merge of [41393] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@41406
git-svn-id: http://core.svn.wordpress.org/branches/4.2@41239 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:19:28 +00:00
a01117bf0d
Bump 4.2 branch to version 4.2.15.
...
Built from https://develop.svn.wordpress.org/branches/4.2@40753
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40611 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 21:52:23 +00:00
7f8136dfd7
Media: Simplify upload error message construction.
...
Merges [40736] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@40742
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40600 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 18:03:56 +00:00
566df4de1a
Add nonce for updating file system credentials.
...
Merges [40723] to 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@40729
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40587 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 14:56:24 +00:00
8f47014af6
Customize: Ignore invalid customization sessions.
...
Merge of [40704] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@40710
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40573 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 12:19:29 +00:00
92f3fdb956
Adjust post meta checks
...
Merges [40692] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@40698
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40561 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:52:55 +00:00
7fc612abfb
Whitelist post arguments in XML-RPC
...
Merges [40677] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@40683
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40546 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:24:31 +00:00
5565b98dde
Bump 4.2 branch to version 4.2.14.
...
Built from https://develop.svn.wordpress.org/branches/4.2@40492
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40368 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-04-20 16:26:30 +00:00
82c9b36ce7
Fix broken audio/video functions when sanitizing ID3 data
...
This fixes a bug where running `wp_kses_post_deep()` on all the ID3
tag data corrupted blob data.
See #40075 , #40085 .
Merges [40400] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@40465
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40341 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-04-17 13:22:30 +00:00
b9a98e7562
Bump 4.2 branch to version 4.2.13.
...
Built from https://develop.svn.wordpress.org/branches/4.2@40207
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40146 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 16:32:30 +00:00
8299a48476
Press This: Verify intent before fetching in-page resources using Press This.
...
Props vortfu
Merges [40195] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@40201
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40140 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 14:04:31 +00:00
db266e95e1
Strip control characters before validating redirect.
...
Merges [40183] to 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@40189
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40128 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 13:44:24 +00:00
2bc231688e
Plugins: Add file check to plugin deletions.
...
Merges [40169] to 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@40175
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40114 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 13:03:30 +00:00
462631b8cc
Embeds: URL encode YouTube video IDs for broader compatibility.
...
Merge of [40160] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@40166
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40105 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 12:07:35 +00:00
933f556e84
Validate video and audio metadata.
...
Merge of [40148] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@40154
git-svn-id: http://core.svn.wordpress.org/branches/4.2@40093 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 08:09:31 +00:00
f449b0a0ce
Bump 4.2 branch to version 4.2.12.
...
Built from https://develop.svn.wordpress.org/branches/4.2@40001
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39938 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 18:25:29 +00:00
22688ca8c6
Posts, Post Types: When using Excerpt mode on the Posts list table, ensure the excerpt output matches what was manually entered into the Excerpt field.
...
Merges [39956] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@39984
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39921 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 14:17:17 +00:00
afc91088f4
Press This: Do not show Categories & Tags UI for users who cannot assign terms to posts anyways.
...
Merge of [39968] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@39975
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39912 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 14:13:31 +00:00
b7509648b8
Query: Ensure that queries work correctly with post type names with special characters.
...
Merge of [39952] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@39961
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39898 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 13:52:00 +00:00
ab64033700
Bump 4.2 branch to version 4.2.11.
...
Built from https://develop.svn.wordpress.org/branches/4.2@39865
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39802 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 16:58:29 +00:00
073c7e6092
Media: Fix exif_imagetype check in wp_get_image_mime
...
This is a follow up to [39831].
Merges [39850] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@39856
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39793 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 16:43:32 +00:00
99f9d45c10
Media: Improve image filetype checking.
...
This adds a new function `wp_get_image_mime()` which is used by
`wp_check_filetype_and_ext()` to validate image files using
`exif_imagetype()` if available instead of `getimagesize()`.
`getimagesize()` is less performant than `exif_imagetype()` and is
dependent on GD. If `exif_imagetype()` is not available, it falls back to
`getimagesize()` as before.
If `wp_check_filetype_and_ext()` can't validate the filetype, we now return
`false` for ext/MIME values.
Merges [39831] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@39837
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39775 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 13:18:29 +00:00
87912afcf6
Updates: Translate plugin data on the Updates screen.
...
Merge of [39808] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@39825
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39763 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 11:42:26 +00:00
76d93255d6
Themes: Fix markup for theme name fallbacks.
...
Merge of [39807] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@39814
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39752 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 11:11:56 +00:00
ed1586d7ff
Multisite: Use `wp_rand()` in signup key creation.
...
Merges [39795] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@39801
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39739 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:34:56 +00:00
4873f1b139
Update PHPMailer to 5.2.22.
...
The full list of changes is available here:
https://github.com/PHPMailer/PHPMailer/compare/v5.2.21...v5.2.22
Merges [39759] to the 4.2 branch.
Fixes #37210 for 4.2.
Built from https://develop.svn.wordpress.org/branches/4.2@39789
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39727 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:25:28 +00:00
516cd7a86c
Mail: Disable wp-mail.php when `mailserver_url` is mail.example.com.
...
Merges [39772] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@39778
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39716 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:19:26 +00:00
9f4a883e2f
Add nonce for widget accessibility mode.
...
Props vortfu.
See #23328 .
Merges [39765] to 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@39766
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39704 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 01:49:32 +00:00
755a765d49
Mail: Upgrade PHPMailer to 5.2.21.
...
Merges [39645], [36083], [33142], [33124] to the 4.2 branch.
See #37210 .
Built from https://develop.svn.wordpress.org/branches/4.2@39726
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39666 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-06 22:06:00 +00:00
8afdd2be32
Media: Improved media titles when created from filename.
...
Preserves spaces and generally creates more accurate, cleaner titles from filenames of uploaded media.
Merge of [38615] to the 4.2 branch.
Fixes #37989 .
Built from https://develop.svn.wordpress.org/branches/4.2@39714
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39654 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-06 22:01:02 +00:00
fe2cc48d0e
General: Update copyright year to 2017 in license.txt.
...
Props Nikschavan.
Merges [39659] to the 4.2 branch.
Fixes #39433 .
Built from https://develop.svn.wordpress.org/branches/4.2@39702
git-svn-id: http://core.svn.wordpress.org/branches/4.2@39642 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-05 08:44:31 +00:00
e57416e1d7
Bump 4.2 branch to 4.2.10.
...
Built from https://develop.svn.wordpress.org/branches/4.2@38553
git-svn-id: http://core.svn.wordpress.org/branches/4.2@38496 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-07 15:00:32 +00:00
f7adf3c9d2
Media: Sanitize upload filename.
...
Merge of [38538] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@38543
git-svn-id: http://core.svn.wordpress.org/branches/4.2@38486 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-07 13:59:32 +00:00
0e5485fe33
Upgrade/Install: Sanitize file name in `File_Upload_Upgrader`.
...
Merge of [38524] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@38529
git-svn-id: http://core.svn.wordpress.org/branches/4.2@38470 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-06 17:55:29 +00:00
2c40eb4cf2
Database: `dbDelta()` will no longer try to downgrade the size of `TEXT` and `BLOB` columns.
...
When upgrading to `utf8mb4`, `TEXT` fields will be upgraded to `MEDIUMTEXT` (and likewise for all other `*TEXT` and `*BLOB` fields). This is to allow for the additional space requirements of `utf8mb4`.
On the subsequent upgrade, `dbDelta()` would try and downgrade the fields to their original size again. At best, this it a waste of time, at worst, this could truncate any data larger than the original size. There's no harm in leaving them at their new size, so let's do that.
The `FULLTEXT` indexes are removed from the tests, as `dbDelta()`'s `FULLTEXT` support was added in WordPress 4.4.
This also includes the `setUp()` and `tearDown()` parts of [32270], to allow the tests to run, and fixes a typo them.
Merge of [37525] to the 4.2 branch.
Partial merge of [36552] to the 4.2 branch.
Partial merge of [32270] to the 4.2 branch.
See #36748 .
Built from https://develop.svn.wordpress.org/branches/4.2@37939
git-svn-id: http://core.svn.wordpress.org/branches/4.2@37880 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-07-01 11:51:28 +00:00
3042245749
Bump 4.2 branch to 4.2.9.
...
Built from https://develop.svn.wordpress.org/branches/4.2@37831
git-svn-id: http://core.svn.wordpress.org/branches/4.2@37796 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 16:36:27 +00:00
754a809bfb
Media: Improve handling of extensionless filenames.
...
Merge of [37756] to the 4.2 branch.
See #37111 .
Built from https://develop.svn.wordpress.org/branches/4.2@37816
git-svn-id: http://core.svn.wordpress.org/branches/4.2@37781 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:56:48 +00:00
3c1876e6c5
Admin: escape URL-encoded permalinks
...
Merge of [37801] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@37812
git-svn-id: http://core.svn.wordpress.org/branches/4.2@37777 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:54:28 +00:00
d5a6676eb2
Revisions: Change the capability needed to view revision diffs to `edit_post`.
...
Merge of [37779] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@37799
git-svn-id: http://core.svn.wordpress.org/branches/4.2@37764 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:44:29 +00:00
437f727e8f
Admin: Escape attachment name in case it contains special characters
...
Merge of [37774] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@37789
git-svn-id: http://core.svn.wordpress.org/branches/4.2@37754 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:26:11 +00:00
b4bf158d3a
Taxonomy: More specific cap check when processing category data on post save.
...
Ports [37691] to the 4.2 branch.
Props dlh.
Fixes #36379 .
Built from https://develop.svn.wordpress.org/branches/4.2@37776
git-svn-id: http://core.svn.wordpress.org/branches/4.2@37741 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:21:38 +00:00
569f0c90fc
Customize: Make sure that preview and return URLs are URLs.
...
Merge of [37527] to the 4.2 branch.
Built from https://develop.svn.wordpress.org/branches/4.2@37772
git-svn-id: http://core.svn.wordpress.org/branches/4.2@37737 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:19:48 +00:00
0ba49c4a4c
Admin: Allow for the consistent filtering of `auth_redirect_scheme`
...
Merge of [37651] to the 4.2 branch.
See #37047 .
Built from https://develop.svn.wordpress.org/branches/4.2@37761
git-svn-id: http://core.svn.wordpress.org/branches/4.2@37726 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:12:47 +00:00
Aaron Campbell
John Blackbourn
Dominik Schilling
Pascal Birchler
James Nylen
Jeremy Felt
Joe McGill
Dion Hulse
Gary Pendergast
Boone Gorges
Nikolay Bachiyski
Rachel Baker