WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
34,977 Commits 50 Branches 749 Tags 982 MiB
Commit Graph

34977 Commits

Author SHA1 Message Date
Gary Pendergast 6e7503eedc KSES: Conditionally remove the `<form>` element from `$allowedposttags`. 
To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.

Merges [43994] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@44001


git-svn-id: http://core.svn.wordpress.org/branches/4.6@43833 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-12 23:27:21 +00:00
Jeremy Felt bcbb4f7808 Media: Improve verification of MIME file types. 
Merges [43988] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@43992


git-svn-id: http://core.svn.wordpress.org/branches/4.6@43824 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-12 23:08:22 +00:00
Aaron Campbell 4f99911c22 Bump 4.6 branch to version 4.6.12 
Built from https://develop.svn.wordpress.org/branches/4.6@43410


git-svn-id: http://core.svn.wordpress.org/branches/4.6@43238 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-07-05 16:12:07 +00:00
John Blackbourn c656a7d373 Media: Limit thumbnail file deletions to the same directory as the original file. 
Merges [43393] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@43396


git-svn-id: http://core.svn.wordpress.org/branches/4.6@43224 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-07-05 14:53:26 +00:00
Aaron Campbell 5798a9e9ae Bump 4.6 branch to version 4.6.11 
Built from https://develop.svn.wordpress.org/branches/4.6@42936


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42766 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 20:28:04 +00:00
Dominik Schilling 1a13b0102b Template: Make sure the version string is correctly escaped for use in attributes. 
Merge of [42893] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42920


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42750 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 16:07:40 +00:00
Dominik Schilling c1af867a7c Meta: Simplify the delete all meta query in `delete_metadata()`. 
Merge of [42913] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42915


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42745 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 15:42:32 +00:00
Dominik Schilling 5a4e8a9b94 HTTP: Don't treat `localhost` as same host by default. 
Merge of [42894] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42911


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42741 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 15:37:22 +00:00
Dominik Schilling bf1163226c Login: Use `wp_safe_redirect()` when redirecting the login page if forced to use HTTPS. 
Merge of [42892] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42898


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42728 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 15:30:40 +00:00
Sergey Biryukov cf43545c07 General: Update copyright year to 2018 in license.txt. 
Props rachelbaker.
Merges [42424] to the 4.6 branch.
Fixes #43007.
Built from https://develop.svn.wordpress.org/branches/4.6@42555


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42384 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-23 11:27:13 +00:00
Dion Hulse daf7cc8b30 Bump the 4.6 branch to 4.6.10. 
Built from https://develop.svn.wordpress.org/branches/4.6@42497


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42326 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 21:41:36 +00:00
Dion Hulse ce6ffb6d25 External Libraries: Remove unnecessary / obsoleted MediaElement.js files. 
Merges [42478] to the 4.6 branch.
Fixes #42720 for 4.6.

Built from https://develop.svn.wordpress.org/branches/4.6@42480


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42309 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 08:06:35 +00:00
Dion Hulse cf61ff994d Upgrade: When deleting old files, if deletion fails attempt to empty the file instead. 
Props joemcgill, dd32.
Merges [42434] to the 4.6 branch.
Fixes #42963 for 4.6.

Built from https://develop.svn.wordpress.org/branches/4.6@42468


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42297 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 06:55:34 +00:00
John Blackbourn 8b0e75a650 Bump 4.6 branch to version 4.6.9. 
Built from https://develop.svn.wordpress.org/branches/4.6@42319


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42148 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 18:59:35 +00:00
John Blackbourn 969ac61dc4 Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability. 
Merges [42261] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42279


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42108 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:24:34 +00:00
John Blackbourn ed0c328547 Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds. 
Merges [42260] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42278


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42107 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:23:06 +00:00
John Blackbourn 22068f006c Hardening: Add escaping to the language attributes used on `html` elements. 
Merges [42259] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42277


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42106 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:22:33 +00:00
John Blackbourn 78c7ec883d Hardening: Use a properly generated hash for the `newbloguser` key instead of a determinate substring. 
Merges [42258] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@42276


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42105 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:21:34 +00:00
Dion Hulse 551d27db59 WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined. 
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.6 branch.
Fixes #42431 and #42401 for 4.6.

Built from https://develop.svn.wordpress.org/branches/4.6@42232


git-svn-id: http://core.svn.wordpress.org/branches/4.6@42061 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-27 01:09:36 +00:00
John Blackbourn 98161af28f General: Remove the version number from the readme file in the 4.6 branch. 
See #42386

Built from https://develop.svn.wordpress.org/branches/4.6@42101


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41930 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 18:07:35 +00:00
Gary Pendergast 9c29274681 Bump 4.6 branch to version 4.6.8. 
Built from https://develop.svn.wordpress.org/branches/4.6@42071


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41900 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 13:15:33 +00:00
Gary Pendergast e8617fb3a5 Database: Restore numbered placeholders in `wpdb::prepare()`. 
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.

This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.

Merges [41662], [42056] to the 4.6 branch.
See #41925.


Built from https://develop.svn.wordpress.org/branches/4.6@42059


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41888 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 12:41:33 +00:00
Dominik Schilling 8dc1cd00a1 Taxonomy/Users: Use correct escaping function for URLs. 
Merge of [41522] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@41525


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41358 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 21:28:32 +00:00
Dominik Schilling 8d5d807270 Bump 4.6 branch to version 4.6.7. 
Built from https://develop.svn.wordpress.org/branches/4.6@41512


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41345 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 19:59:33 +00:00
Aaron Campbell 2fabb6d0e2 Database: Hardening to bring `wpdb::prepare()` inline with documentation. 
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.

Merges [41496] to 4.6 branch.


Built from https://develop.svn.wordpress.org/branches/4.6@41499


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41332 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 18:13:34 +00:00
Aaron Campbell ce78b2a4fb Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`. 
While `wpdb::prepare()` does not support null values (see #12819) they still appear in the wild like in the WordPress Importer and other plugins.

Merges [41483] to 4.6 branch.


Built from https://develop.svn.wordpress.org/branches/4.6@41486


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41319 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 16:21:34 +00:00
Aaron Campbell 22f3d4e600 Database: Hardening for `wpdb::prepare()` 
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

Merges [41470] to 4.6 branch.


Built from https://develop.svn.wordpress.org/branches/4.6@41473


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41306 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 15:00:35 +00:00
John Blackbourn 4733856aee Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues. 
Merges [41457] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@41460


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41293 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 14:39:34 +00:00
Aaron Campbell 77b60a60a0 oEmbed: Add extra hardening around allowed HTML for improved sandboxing. 
Merges [41448] to 4.6 branch.



Built from https://develop.svn.wordpress.org/branches/4.6@41453


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41286 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 13:49:46 +00:00
Dominik Schilling 441a970ecd TinyMCE: Improve the previews for shortcodes. 
Merge of [41395] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@41437


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41270 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 12:42:38 +00:00
Dominik Schilling e684cc66cd Customize: Ensure valid themes in the preview. 
Merge of [41397] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@41431


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41264 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 11:51:38 +00:00
Dominik Schilling acd952f9c7 Taxonomy/Users: Provide a fallback for incorrect HTTP referrers. 
Merge of [41398] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@41419


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41252 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 11:12:41 +00:00
John Blackbourn f12b16a291 General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area. 
Merges [41413] to the 4.6 branch

See #13377

Built from https://develop.svn.wordpress.org/branches/4.6@41414


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41247 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 10:22:34 +00:00
Dominik Schilling 7e0de7a0e3 Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog. 
Merge of [41393] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@41402


git-svn-id: http://core.svn.wordpress.org/branches/4.6@41235 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 10:16:42 +00:00
Konstantin Obenland f5fff9f3f9 Import Twenty Sixteen for the 4.6 branch. 
See #36497.

Built from https://develop.svn.wordpress.org/branches/4.6@40857


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40708 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-31 01:13:37 +00:00
Aaron Campbell bacf919c26 Bump 4.7 branch to version 4.6.6. 
Built from https://develop.svn.wordpress.org/branches/4.6@40749


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40607 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 21:49:33 +00:00
Pascal Birchler 600e9f1b49 Media: Simplify upload error message construction. 
Merges [40736] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40738


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40596 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 18:01:08 +00:00
Aaron Campbell e07088f06e Add nonce for updating file system credentials. 
Merges [40723] to 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40725


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40583 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 14:53:33 +00:00
Dominik Schilling f2f9b5e493 Customize: Ignore invalid customization sessions. 
Merge of [40704] to the 4.6 branch.
Built from https://develop.svn.wordpress.org/branches/4.6@40706


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40569 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 12:15:34 +00:00
Pascal Birchler 687f87a4e6 Adjust post meta checks 
Merges [40692] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40694


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40557 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:49:34 +00:00
Pascal Birchler 81a5ef373a Improve redirect handling 
Merges[40689] to the 4.7 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40691


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40554 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:41:33 +00:00
Pascal Birchler 5c4b703f38 Whitelist post arguments in XML-RPC 
Merges [40677] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40679


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40542 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:19:35 +00:00
Pascal Birchler 43c3b11cee Bump 4.6 branch to version 4.6.5. 
Built from https://develop.svn.wordpress.org/branches/4.6@40488


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40364 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-04-20 16:22:35 +00:00
Pascal Birchler 98c13fefb2 Fix broken audio/video functions when sanitizing ID3 data 
This fixes a bug where running `wp_kses_post_deep()` on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40461


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40337 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-04-17 13:07:36 +00:00
James Nylen 299bfe429c Bump 4.6 branch to version 4.6.4. 
Built from https://develop.svn.wordpress.org/branches/4.6@40203


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40142 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 16:08:34 +00:00
John Blackbourn 70a97d6789 Press This: Verify intent before fetching in-page resources using Press This. 
Props vortfu

Merges [40195] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40197


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40136 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 13:58:33 +00:00
Aaron Campbell 0e1bc61b1f Strip control characters before validating redirect. 
Merges [40183] to 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40185


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40124 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 13:41:33 +00:00
Aaron Campbell b67b8d56d9 Plugins: Add file check to plugin deletions. 
Merges [40169] to 4.6 branch.


Built from https://develop.svn.wordpress.org/branches/4.6@40171


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40110 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 12:59:34 +00:00
Dominik Schilling e61cac5d13 Embeds: URL encode YouTube video IDs for broader compatibility. 
Merge of [40160] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40162


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40101 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 12:05:34 +00:00
Jeremy Felt fe1162e5f1 Validate video and audio metadata. 
Merge of [40148] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40150


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40089 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 08:04:35 +00:00