cde3e1022a
Media: Limit thumbnail file deletions to the same directory as the original file.
...
Merges [43393] into the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@43397
git-svn-id: http://core.svn.wordpress.org/branches/4.5@43225 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 14:55:23 +00:00
fff3ef94b7
Bump 4.5 branch to version 4.5.14
...
Built from https://develop.svn.wordpress.org/branches/4.5@42937
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42767 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 20:29:32 +00:00
3465fda2e7
Template: Make sure the version string is correctly escaped for use in attributes.
...
Merge of [42893] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42921
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42751 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 16:08:10 +00:00
52e15eb4d6
Meta: Simplify the delete all meta query in `delete_metadata()`.
...
Merge of [42913] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42916
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42746 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:43:03 +00:00
764b72595b
HTTP: Don't treat `localhost` as same host by default.
...
Merge of [42894] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42912
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42742 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:37:53 +00:00
466e565a32
Bump the 4.5 branch to 4.5.13.
...
Built from https://develop.svn.wordpress.org/branches/4.5@42498
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42327 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 21:42:07 +00:00
c5126cd06a
External Libraries: Remove unnecessary / obsoleted MediaElement.js files.
...
Merges [42478] to the 4.5 branch.
Fixes #42720 for 4.5.
Built from https://develop.svn.wordpress.org/branches/4.5@42481
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42310 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 08:08:33 +00:00
c33337c395
Bump 4.5 branch to 4.5.12.
...
Built from https://develop.svn.wordpress.org/branches/4.5@42320
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42149 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 19:00:32 +00:00
db1e3afed0
Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability.
...
Merges [42261] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42283
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42112 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:27:34 +00:00
8511c84d2c
Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
...
Merges [42260] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42282
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42111 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:27:01 +00:00
cc28f09509
Hardening: Add escaping to the language attributes used on `html` elements.
...
Merges [42259] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42281
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42110 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:26:31 +00:00
4d65d6de5b
WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined.
...
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.5 branch.
Fixes #42431 and #42401 for 4.5.
Built from https://develop.svn.wordpress.org/branches/4.5@42233
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42062 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-27 01:10:32 +00:00
512427a740
Bump 4.5 branch to version 4.5.11.
...
Built from https://develop.svn.wordpress.org/branches/4.5@42072
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41901 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 13:16:30 +00:00
84b702009b
Database: Restore numbered placeholders in `wpdb::prepare()`.
...
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.
This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.
Merges [41662], [42056] to the 4.5 branch.
See #41925 .
Built from https://develop.svn.wordpress.org/branches/4.5@42060
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41889 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 12:44:32 +00:00
5047d9b8db
Bump 4.5 branch to version 4.5.10.
...
Built from https://develop.svn.wordpress.org/branches/4.5@41513
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41346 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 20:01:31 +00:00
9007b3117b
Database: Hardening to bring `wpdb::prepare()` inline with documentation.
...
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.
Merges [41496] to 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41500
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41333 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 18:14:31 +00:00
4b09915583
Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`.
...
While `wpdb::prepare()` does not support null values (see #12819 ) they still appear in the wild like in the WordPress Importer and other plugins.
Merges [41483] to 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41487
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41320 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 16:23:33 +00:00
644434666e
Database: Hardening for `wpdb::prepare()`
...
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.
Merges [41470] to 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41474
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41307 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 15:01:07 +00:00
f1c76c5532
oEmbed: Add extra hardening around allowed HTML for improved sandboxing.
...
Merges [41448] to 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41454
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41287 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 13:50:32 +00:00
c3844666a2
TinyMCE: Improve the previews for shortcodes.
...
Merge of [41395] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41438
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41271 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 12:43:08 +00:00
cda7d5bac0
Customize: Ensure valid themes in the preview.
...
Merge of [41397] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41432
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41265 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 11:52:08 +00:00
0d5353afbc
Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog.
...
Merge of [41393] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41403
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41236 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:17:14 +00:00
030d6166f9
General: Backport PHP 7.1 fixes to the 4.5 branch to avoid fatal errors and warnings.
...
Props simonvik, ayeshrajans
See #41135
Built from https://develop.svn.wordpress.org/branches/4.5@41128
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40968 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-07-24 22:25:32 +00:00
9ab481b9e5
Bump 4.7 branch to version 4.5.9.
...
Built from https://develop.svn.wordpress.org/branches/4.5@40750
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40608 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 21:50:02 +00:00
c2adcb9aec
Media: Simplify upload error message construction.
...
Merges [40736] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40739
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40597 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 18:02:32 +00:00
5046262be3
Customize: Ignore invalid customization sessions.
...
Merge of [40704] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40707
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40570 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 12:16:31 +00:00
62983e1dd2
Adjust post meta checks
...
Merges [40692] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40695
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40558 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:50:31 +00:00
8ce7f49c8d
Whitelist post arguments in XML-RPC
...
Merges [40677] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40680
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40543 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:20:31 +00:00
26c585efa7
Bump 4.5 branch to version 4.5.8.
...
Built from https://develop.svn.wordpress.org/branches/4.5@40489
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40365 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-04-20 16:23:33 +00:00
5d48102386
Bump 4.5 branch to version 4.5.7.
...
Built from https://develop.svn.wordpress.org/branches/4.5@40204
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40143 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 16:18:31 +00:00
a9f9235d88
Strip control characters before validating redirect.
...
Merges [40183] to 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40186
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40125 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 13:42:04 +00:00
4c805032cb
Embeds: URL encode YouTube video IDs for broader compatibility.
...
Merge of [40160] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40163
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40102 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 12:06:05 +00:00
5697303ab4
Bump 4.5 branch to version 4.5.6.
...
Built from https://develop.svn.wordpress.org/branches/4.5@39998
git-svn-id: http://core.svn.wordpress.org/branches/4.5@39935 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 18:21:32 +00:00
aa2ad2c3dd
Query: Ensure that queries work correctly with post type names with special characters.
...
Merge of [39952] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@39958
git-svn-id: http://core.svn.wordpress.org/branches/4.5@39895 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 13:50:32 +00:00
438fd7f3bb
Bump 4.5 branch to version 4.5.5.
...
Built from https://develop.svn.wordpress.org/branches/4.5@39862
git-svn-id: http://core.svn.wordpress.org/branches/4.5@39799 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 16:55:29 +00:00
a1d67608bf
Media: Fix exif_imagetype check in wp_get_image_mime
...
This is a follow up to [39831].
Merges [39850] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@39853
git-svn-id: http://core.svn.wordpress.org/branches/4.5@39790 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 16:40:32 +00:00
a8dcdd4fd5
Media: Improve image filetype checking.
...
This adds a new function `wp_get_image_mime()` which is used by
`wp_check_filetype_and_ext()` to validate image files using
`exif_imagetype()` if available instead of `getimagesize()`.
`getimagesize()` is less performant than `exif_imagetype()` and is
dependent on GD. If `exif_imagetype()` is not available, it falls back to
`getimagesize()` as before.
If `wp_check_filetype_and_ext()` can't validate the filetype, we now return
`false` for ext/MIME values.
Merges [39831] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@39834
git-svn-id: http://core.svn.wordpress.org/branches/4.5@39772 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 13:15:31 +00:00
c1684e38b0
Themes: Fix markup for theme name fallbacks.
...
Merge of [39807] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@39811
git-svn-id: http://core.svn.wordpress.org/branches/4.5@39749 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 11:10:05 +00:00
13d318d196
Multisite: Use `wp_rand()` in signup key creation.
...
Merges [39795] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@39798
git-svn-id: http://core.svn.wordpress.org/branches/4.5@39736 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:33:32 +00:00
440b7b387f
Update PHPMailer to 5.2.22.
...
The full list of changes is available here:
https://github.com/PHPMailer/PHPMailer/compare/v5.2.21...v5.2.22
Merges [39759] to the 4.5 branch.
Fixes #37210 for 4.5.
Built from https://develop.svn.wordpress.org/branches/4.5@39786
git-svn-id: http://core.svn.wordpress.org/branches/4.5@39724 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:23:31 +00:00
f991d9356c
Mail: Upgrade PHPMailer to 5.2.21.
...
Merges [39645] to the 4.5 branch.
See #37210 .
Built from https://develop.svn.wordpress.org/branches/4.5@39723
git-svn-id: http://core.svn.wordpress.org/branches/4.5@39663 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-06 22:04:36 +00:00
34ea4c35f4
Bump 4.5 branch to 4.5.4.
...
Built from https://develop.svn.wordpress.org/branches/4.5@38550
git-svn-id: http://core.svn.wordpress.org/branches/4.5@38493 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-07 14:58:31 +00:00
ff1790b8e8
Media: Sanitize upload filename.
...
Merge of [38538] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@38540
git-svn-id: http://core.svn.wordpress.org/branches/4.5@38483 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-07 13:57:58 +00:00
b7bb8822d7
Upgrade/Install: Sanitize file name in `File_Upload_Upgrader`.
...
Merge of [38524] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@38526
git-svn-id: http://core.svn.wordpress.org/branches/4.5@38467 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-06 17:34:33 +00:00
c1e4d25350
The 4.5 branch is now 4.5.4-alpha.
...
Built from https://develop.svn.wordpress.org/branches/4.5@38000
git-svn-id: http://core.svn.wordpress.org/branches/4.5@37941 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-07-07 12:07:32 +00:00
b15f7577d3
Bump 4.5 branch to 4.5.3.
...
Built from https://develop.svn.wordpress.org/branches/4.5@37826
git-svn-id: http://core.svn.wordpress.org/branches/4.5@37791 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 15:53:29 +00:00
47e67b7d33
Media: Fix rendering of incorrect toolbar in the Edit view.
...
This switches event binding in `wp.media.controller.EditImage` to use `on`
instead of `listenTo` to restore rendering of the correct toolbar when the
`toolbar:render:edit-image` event fires. The existing listeners broke
when we upgraded Backbone in [36546].
Merge of [37678] to the 4.5 branch.
Props adamsilverstein.
Fixes #36861 .
Built from https://develop.svn.wordpress.org/branches/4.5@37813
git-svn-id: http://core.svn.wordpress.org/branches/4.5@37778 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:55:30 +00:00
b747172c20
Media: Improve handling of extensionless filenames.
...
Merge of [37756] to the 4.5 branch.
See #37111 .
Built from https://develop.svn.wordpress.org/branches/4.5@37809
git-svn-id: http://core.svn.wordpress.org/branches/4.5@37774 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:52:06 +00:00
df44f6cbc4
Admin: escape URL-encoded permalinks
...
Merge of [37801] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@37806
git-svn-id: http://core.svn.wordpress.org/branches/4.5@37771 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:50:03 +00:00
63325a253e
Media: Restore keyboard navigation of the media grid.
...
This changes the binding of event listeners in the Attachments Browser
to use `on` instead of `listenTo` for the `attachment:keydown:arrow` and
`attachment:details:shift-tab` events. The existing listeners broke
when we upgraded Backbone in [36546].
Merge of [37755] to the 4.5 branch.
Props adamsilverstein.
Fixes #36900 .
Built from https://develop.svn.wordpress.org/branches/4.5@37804
git-svn-id: http://core.svn.wordpress.org/branches/4.5@37769 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 14:49:28 +00:00
John Blackbourn
Aaron Campbell
Dominik Schilling
Dion Hulse
Gary Pendergast
Pascal Birchler
James Nylen
Joe McGill
Jeremy Felt
Boone Gorges
Nikolay Bachiyski