WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
23,872 Commits 50 Branches 749 Tags 981 MiB
Commit Graph

23872 Commits

Author SHA1 Message Date
desrosj c8b76218dd WordPress 3.7.30. 
Built from https://develop.svn.wordpress.org/branches/3.7@46031


git-svn-id: http://core.svn.wordpress.org/branches/3.7@45843 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 21:51:40 +00:00
desrosj 96a812ec6d Fix for URL sanitization in `wp_kses_bad_protocol_once()`. 
Merges [45997] to the 3.7 branch.

Props irsdl, sstoqnov, whyisjake.
Built from https://develop.svn.wordpress.org/branches/3.7@46023


git-svn-id: http://core.svn.wordpress.org/branches/3.7@45834 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 21:46:55 +00:00
Sergey Biryukov 5d6dd8aa78 Improve URL validation in `wp_validate_redirect()`. 
Merges [45971] to the 3.7 branch.
Props vortfu, whyisjake, peterwilsoncc.
Built from https://develop.svn.wordpress.org/branches/3.7@45988


git-svn-id: http://core.svn.wordpress.org/branches/3.7@45799 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 17:19:08 +00:00
Sergey Biryukov d4b0390117 Escape the output in `wp_ajax_upload_attachment()`. 
Merges [45936] to the 3.7 branch.
Props whyisjake, sstoqnov.
Built from https://develop.svn.wordpress.org/branches/3.7@45970


git-svn-id: http://core.svn.wordpress.org/branches/3.7@45781 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 16:50:08 +00:00
whyisjake b7f612eb71 Remove _convert_urlencoded_to_entities() from the get_the_content() callback. 
Merges [45937] to the 3.7  branch.

Props vortfu, whyisjake, peterwilsoncc

Built from https://develop.svn.wordpress.org/branches/3.7@45969


git-svn-id: http://core.svn.wordpress.org/branches/3.7@45780 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 16:48:52 +00:00
Gary Pendergast c03ffe42a1 WordPress 3.7.29 
Built from https://develop.svn.wordpress.org/branches/3.7@44892


git-svn-id: http://core.svn.wordpress.org/branches/3.7@44723 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-03-13 03:14:08 +00:00
Sergey Biryukov d2398ee562 Comments: Improve comment content filtering. 
Merges [44842] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@44857


git-svn-id: http://core.svn.wordpress.org/branches/3.7@44689 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-03-12 22:52:08 +00:00
Jeremy Felt 093a17d3c8 Bump 3.7 branch to version 3.7.28 
Built from https://develop.svn.wordpress.org/branches/3.7@44090


git-svn-id: http://core.svn.wordpress.org/branches/3.7@43920 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 02:17:18 +00:00
Gary Pendergast e51c9b1ce2 Editor: Remove unwanted fields before saving posts. 
The `meta_input`, `file`, and `guid` fields are not intended to be updated through user input.

Merges [44047] to the 3.7 branch.


Built from https://develop.svn.wordpress.org/branches/3.7@44076


git-svn-id: http://core.svn.wordpress.org/branches/3.7@43906 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 02:05:08 +00:00
Peter Wilson e06de9c2e5 Multisite: Validate activation links. 
Merges [44048] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@44075


git-svn-id: http://core.svn.wordpress.org/branches/3.7@43905 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 02:03:08 +00:00
iandunn a2d1cee61d KSES: Make the URI attributes DRY. 
This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.

Merges [44014] and [44017] to the `3.7` branch.

Built from https://develop.svn.wordpress.org/branches/3.7@44049


git-svn-id: http://core.svn.wordpress.org/branches/3.7@43879 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 01:27:08 +00:00
Peter Wilson 81fb9c10a2 Multisite: Improve messaging for previously activated users. 
Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time.

Merges [44021] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@44040


git-svn-id: http://core.svn.wordpress.org/branches/3.7@43870 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 01:14:07 +00:00
Gary Pendergast c36f3a8be3 KSES: Conditionally remove the `<form>` element from `$allowedposttags`. 
To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.

Merges [43994] to the 3.7 branch.


Built from https://develop.svn.wordpress.org/branches/3.7@44019


git-svn-id: http://core.svn.wordpress.org/branches/3.7@43849 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 00:06:07 +00:00
Jeremy Felt a1d2eb2c85 Media: Improve verification of MIME file types. 
Merges [43988] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@44012


git-svn-id: http://core.svn.wordpress.org/branches/3.7@43842 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-12 23:50:09 +00:00
Aaron Campbell 216ea4f2d0 Bump 3.7 branch to version 3.7.27 
Built from https://develop.svn.wordpress.org/branches/3.7@43419


git-svn-id: http://core.svn.wordpress.org/branches/3.7@43247 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-07-05 16:14:30 +00:00
John Blackbourn 32bf48628e Media: Limit thumbnail file deletions to the same directory as the original file. 
Merges [43393] into the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@43405


git-svn-id: http://core.svn.wordpress.org/branches/3.7@43233 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-07-05 15:19:09 +00:00
Aaron Campbell 71f5f5fe6a Bump 3.7 branch to version 3.7.26 
Built from https://develop.svn.wordpress.org/branches/3.7@42945


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42775 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 20:32:43 +00:00
Dominik Schilling 505af40a68 Template: Make sure the version string is correctly escaped for use in attributes. 
Merge of [42893] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@42929


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42759 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 16:11:43 +00:00
Dominik Schilling 4cad77d676 Login: Use `wp_safe_redirect()` when redirecting the login page if forced to use HTTPS. 
Merge of [42892] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@42907


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42737 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 15:34:47 +00:00
Sergey Biryukov e3c8323406 General: Update copyright year to 2018 in license.txt. 
Props rachelbaker.
Merges [42424] to the 3.7 branch.
Fixes #43007.
Built from https://develop.svn.wordpress.org/branches/3.7@42564


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42393 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-23 11:30:48 +00:00
Dion Hulse ae9bfeddd3 Bump the 3.7 branch to 3.7.25. 
Built from https://develop.svn.wordpress.org/branches/3.7@42506


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42335 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 21:47:35 +00:00
Dion Hulse b572e86a4a External Libraries: Remove unnecessary / obsoleted MediaElement.js files. 
Merges [42478] to the 3.7 branch.
Fixes #42720 for 3.7.

Built from https://develop.svn.wordpress.org/branches/3.7@42489


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42318 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 08:16:11 +00:00
Dion Hulse f1b5da36be Upgrade: When deleting old files, if deletion fails attempt to empty the file instead. 
Props joemcgill, dd32.
Merges [42434] to the 3.7 branch.
Fixes #42963 for 3.7.

Built from https://develop.svn.wordpress.org/branches/3.7@42477


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42306 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 06:59:35 +00:00
John Blackbourn 8698e8339a Bump 3.7 branch to version 3.7.24. 
Built from https://develop.svn.wordpress.org/branches/3.7@42328


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42157 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 19:06:09 +00:00
John Blackbourn 9f7b91d4bc Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability. 
Merges [42261] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@42315


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42144 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:53:09 +00:00
John Blackbourn d7915c3e73 Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds. 
Merges [42260] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@42314


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42143 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:52:10 +00:00
John Blackbourn 149cdb0766 Hardening: Add escaping to the language attributes used on `html` elements. 
Merges [42259] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@42313


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42142 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:50:09 +00:00
John Blackbourn 82f8529ad5 Hardening: Use a properly generated hash for the `newbloguser` key instead of a determinate substring. 
Merges [42258] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@42312


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42141 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:49:10 +00:00
Dion Hulse 94278eddb6 WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined. 
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 3.7 branch.
Fixes #42431 and #42401 for 3.7.

Built from https://develop.svn.wordpress.org/branches/3.7@42241


git-svn-id: http://core.svn.wordpress.org/branches/3.7@42070 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-27 01:15:10 +00:00
John Blackbourn 009b1b4257 General: Remove the version number from the readme file in the 3.7 branch. 
See #42386

Built from https://develop.svn.wordpress.org/branches/3.7@42099


git-svn-id: http://core.svn.wordpress.org/branches/3.7@41928 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 18:06:09 +00:00
Gary Pendergast 2fd667487f Bump 3.7 branch to version 3.7.23. 
Built from https://develop.svn.wordpress.org/branches/3.7@42080


git-svn-id: http://core.svn.wordpress.org/branches/3.7@41909 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 13:47:10 +00:00
Gary Pendergast 083e886cf7 Database: Restore numbered placeholders in `wpdb::prepare()`. 
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.

This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.

Merges [41662], [42056] to the 3.7 branch.
See #41925.


Built from https://develop.svn.wordpress.org/branches/3.7@42068


git-svn-id: http://core.svn.wordpress.org/branches/3.7@41897 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 13:02:10 +00:00
Dominik Schilling 99d97c76b0 Users: Use correct escaping function for URLs. 
Merge of [41522] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@41534


git-svn-id: http://core.svn.wordpress.org/branches/3.7@41367 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 21:40:34 +00:00
Aaron Campbell 67bf4cd7e1 Bump 3.7 branch to version 3.7.22. 
Built from https://develop.svn.wordpress.org/branches/3.7@41521


git-svn-id: http://core.svn.wordpress.org/branches/3.7@41354 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 20:14:20 +00:00
Aaron Campbell 7b03bfc16f Database: Hardening to bring `wpdb::prepare()` inline with documentation. 
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.

Merges [41496] to 3.7 branch.


Built from https://develop.svn.wordpress.org/branches/3.7@41508


git-svn-id: http://core.svn.wordpress.org/branches/3.7@41341 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 18:46:09 +00:00
Aaron Campbell 0a541104e3 Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`. 
While `wpdb::prepare()` does not support null values (see #12819) they still appear in the wild like in the WordPress Importer and other plugins.

Merges [41483] to 3.7 branch.


Built from https://develop.svn.wordpress.org/branches/3.7@41495


git-svn-id: http://core.svn.wordpress.org/branches/3.7@41328 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 16:30:22 +00:00
Aaron Campbell 029d279155 Database: Hardening for `wpdb::prepare()` 
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

Merges [41470] to 3.7 branch.


Built from https://develop.svn.wordpress.org/branches/3.7@41482


git-svn-id: http://core.svn.wordpress.org/branches/3.7@41315 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 15:06:09 +00:00
John Blackbourn 1d5a7892f2 Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues. 
Merges [41457] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@41469


git-svn-id: http://core.svn.wordpress.org/branches/3.7@41302 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 14:47:09 +00:00
John Blackbourn 8d241beedb General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area. 
Merges [41434] with changes to the 3.7 branch.

See #13377

Built from https://develop.svn.wordpress.org/branches/3.7@41456


git-svn-id: http://core.svn.wordpress.org/branches/3.7@41289 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 13:52:09 +00:00
Dominik Schilling 774f81b780 Users: Provide a fallback for incorrect HTTP referrers. 
Merge of [41398] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@41428


git-svn-id: http://core.svn.wordpress.org/branches/3.7@41261 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 11:15:50 +00:00
Dominik Schilling 86b3a35dd7 Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog. 
Merge of [41393] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@41411


git-svn-id: http://core.svn.wordpress.org/branches/3.7@41244 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 10:20:44 +00:00
Aaron Campbell fe080e84db Bump 3.7 branch to version 3.7.21. 
Built from https://develop.svn.wordpress.org/branches/3.7@40758


git-svn-id: http://core.svn.wordpress.org/branches/3.7@40616 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 21:54:15 +00:00
Pascal Birchler 8ae6705fd2 Media: Simplify upload error message construction. 
Merges [40736] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@40747


git-svn-id: http://core.svn.wordpress.org/branches/3.7@40605 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 18:05:51 +00:00
Aaron Campbell f5fca82e63 Add nonce for updating file system credentials. 
Merges [40723] to 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@40734


git-svn-id: http://core.svn.wordpress.org/branches/3.7@40592 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 14:58:09 +00:00
Dominik Schilling 303264210a Customize: Ignore invalid customization sessions. 
Merge of [40704] to the 3.7 branch.
Built from https://develop.svn.wordpress.org/branches/3.7@40715


git-svn-id: http://core.svn.wordpress.org/branches/3.7@40578 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 12:23:10 +00:00
Pascal Birchler b89aca0478 Adjust post meta checks 
Merges [40692] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@40703


git-svn-id: http://core.svn.wordpress.org/branches/3.7@40566 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:54:35 +00:00
Pascal Birchler 1ab98bf52d Whitelist post arguments in XML-RPC 
Merges [40677] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@40688


git-svn-id: http://core.svn.wordpress.org/branches/3.7@40551 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:31:09 +00:00
Pascal Birchler a2797f26d2 Bump 3.7 branch to version 3.7.20. 
Built from https://develop.svn.wordpress.org/branches/3.7@40497


git-svn-id: http://core.svn.wordpress.org/branches/3.7@40373 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-04-20 16:30:10 +00:00
Pascal Birchler 63b4b6a006 Fix broken audio/video functions when sanitizing ID3 data 
This fixes a bug where running `wp_kses_post_deep()` on all the ID3
tag data corrupted blob data.

See #40075, #40085.

Merges [40400] to the 3.7 branch.

Built from https://develop.svn.wordpress.org/branches/3.7@40470


git-svn-id: http://core.svn.wordpress.org/branches/3.7@40346 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-04-17 13:48:09 +00:00
James Nylen 85e61d7921 Bump 3.7 branch to version 3.7.19. 
Built from https://develop.svn.wordpress.org/branches/3.7@40212


git-svn-id: http://core.svn.wordpress.org/branches/3.7@40151 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 16:50:09 +00:00