WordPress-C/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2025-03-04 12:29:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
28,633 Commits 50 Branches 750 Tags
Commit Graph

15864 Commits

Author SHA1 Message Date
Sergey Biryukov
d9e1193af0 Update wp_kses_bad_protocol() to recognize : on uri attributes, 
`wp_kses_bad_protocol()` makes sure to validate that uri attributes don’t contain invalid/or not allowed protocols. While this works fine in most cases, there’s a risk that by using the colon html5 named entity, one is able to bypass this function.

Brings r46895 to the 4.1 branch.

Props: xknown, nickdaugherty, peterwilsoncc.
Built from https://develop.svn.wordpress.org/branches/4.1@46909


git-svn-id: http://core.svn.wordpress.org/branches/4.1@46709 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-12-12 18:40:17 +00:00
desrosj
4d74fad193 WordPress 4.1.28. 
Built from https://develop.svn.wordpress.org/branches/4.1@46519


git-svn-id: http://core.svn.wordpress.org/branches/4.1@46316 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-10-14 20:16:18 +00:00
whyisjake
d1e2b35359 Backporting several bug fixes. 
- Query: Remove the static query property.
- HTTP API: Protect against hex interpretation.
- Filesystem API: Prevent directory travelersals when creating new folders.
- Administration: Ensure that admin referer nonce is valid.
- REST API: Send a Vary: Origin header on GET requests.
- Customizer: Properly sanitize background images.

Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@46501


git-svn-id: http://core.svn.wordpress.org/branches/4.1@46298 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-10-14 19:17:19 +00:00
desrosj
d117cdceaa WordPress 4.1.27. 
Built from https://develop.svn.wordpress.org/branches/4.1@46035


git-svn-id: http://core.svn.wordpress.org/branches/4.1@45847 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 22:03:00 +00:00
desrosj
ae46b28ecb Fix for URL sanitization in wp_kses_bad_protocol_once(). 
Merges [45997] to the 4.1 branch.

Props irsdl, sstoqnov, whyisjake.
Built from https://develop.svn.wordpress.org/branches/4.1@46013


git-svn-id: http://core.svn.wordpress.org/branches/4.1@45824 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 21:41:53 +00:00
Sergey Biryukov
7f5532e6cd Improve URL validation in wp_validate_redirect(). 
Merges [45971] to the 4.1 branch.
Props vortfu, whyisjake, peterwilsoncc.
Built from https://develop.svn.wordpress.org/branches/4.1@45984


git-svn-id: http://core.svn.wordpress.org/branches/4.1@45795 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 17:15:16 +00:00
whyisjake
0c72c0b629 Remove _convert_urlencoded_to_entities() from the get_the_content() callback. 
Merges [45937] to the 4.1 branch.

Props vortfu, whyisjake, peterwilsoncc

Built from https://develop.svn.wordpress.org/branches/4.1@45962


git-svn-id: http://core.svn.wordpress.org/branches/4.1@45773 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-09-04 16:43:37 +00:00
Gary Pendergast
2af2b726c3 WordPress 4.1.26 
Built from https://develop.svn.wordpress.org/branches/4.1@44884


git-svn-id: http://core.svn.wordpress.org/branches/4.1@44715 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2019-03-13 01:49:17 +00:00
Jeremy Felt
841733a905 Bump 4.1 branch to version 4.1.25. 
Built from https://develop.svn.wordpress.org/branches/4.1@44086


git-svn-id: http://core.svn.wordpress.org/branches/4.1@43916 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 02:15:53 +00:00
Peter Wilson
c41ec66e1d Multisite: Validate activation links. 
Merges [44048] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@44067


git-svn-id: http://core.svn.wordpress.org/branches/4.1@43897 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 01:54:18 +00:00
iandunn
8e2414d6b1 KSES: Make the URI attributes DRY. 
This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.

Merges [44014] and [44017] to the `4.1` branch.

Built from https://develop.svn.wordpress.org/branches/4.1@44043


git-svn-id: http://core.svn.wordpress.org/branches/4.1@43873 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 01:17:17 +00:00
Peter Wilson
1fa7b145d1 Multisite: Improve messaging for previously activated users. 
Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time.

Merges [44021] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@44036


git-svn-id: http://core.svn.wordpress.org/branches/4.1@43866 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-13 00:59:36 +00:00
Gary Pendergast
1a074d093a KSES: Conditionally remove the <form> element from $allowedposttags. 
To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.

Merges [43994] to the 4.1 branch.


Built from https://develop.svn.wordpress.org/branches/4.1@44013


git-svn-id: http://core.svn.wordpress.org/branches/4.1@43843 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-12 23:52:17 +00:00
Jeremy Felt
9ba26aa950 Media: Improve verification of MIME file types. 
Merges [43988] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@44007


git-svn-id: http://core.svn.wordpress.org/branches/4.1@43837 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-12-12 23:40:20 +00:00
Aaron Campbell
4456704ad8 Bump 4.1 branch to version 4.1.24 
Built from https://develop.svn.wordpress.org/branches/4.1@43415


git-svn-id: http://core.svn.wordpress.org/branches/4.1@43243 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-07-05 16:13:45 +00:00
John Blackbourn
79f09bd32f Media: Limit thumbnail file deletions to the same directory as the original file. 
Merges [43393] into the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@43401


git-svn-id: http://core.svn.wordpress.org/branches/4.1@43229 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-07-05 15:08:20 +00:00
Aaron Campbell
7773c57a7b Bump 4.1 branch to version 4.1.23 
Built from https://develop.svn.wordpress.org/branches/4.1@42941


git-svn-id: http://core.svn.wordpress.org/branches/4.1@42771 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 20:31:53 +00:00
Dominik Schilling
95a4707db6 Template: Make sure the version string is correctly escaped for use in attributes. 
Merge of [42893] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@42925


git-svn-id: http://core.svn.wordpress.org/branches/4.1@42755 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-04-03 16:10:52 +00:00
Dion Hulse
0ef34e30c2 Bump the 4.1 branch to 4.1.22. 
Built from https://develop.svn.wordpress.org/branches/4.1@42502


git-svn-id: http://core.svn.wordpress.org/branches/4.1@42331 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 21:45:56 +00:00
Dion Hulse
7683fc66cb External Libraries: Remove unnecessary / obsoleted MediaElement.js files. 
Merges [42478] to the 4.1 branch.
Fixes #42720 for 4.1.

Built from https://develop.svn.wordpress.org/branches/4.1@42485


git-svn-id: http://core.svn.wordpress.org/branches/4.1@42314 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2018-01-16 08:13:27 +00:00
John Blackbourn
f3529cb89d Bump 4.1 branch to version 4.1.21. 
Built from https://develop.svn.wordpress.org/branches/4.1@42324


git-svn-id: http://core.svn.wordpress.org/branches/4.1@42153 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 19:02:55 +00:00
John Blackbourn
7f0c6cb620 Hardening: Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability. 
Merges [42261] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@42299


git-svn-id: http://core.svn.wordpress.org/branches/4.1@42128 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:38:28 +00:00
John Blackbourn
348148eee2 Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds. 
Merges [42260] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@42298


git-svn-id: http://core.svn.wordpress.org/branches/4.1@42127 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:37:18 +00:00
John Blackbourn
e16db41a65 Hardening: Add escaping to the language attributes used on html elements. 
Merges [42259] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@42297


git-svn-id: http://core.svn.wordpress.org/branches/4.1@42126 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-29 16:36:53 +00:00
Dion Hulse
3c4befe52b WPDB: Check that AUTH_SALT is not empty, Fix a PHP notice when AUTH_SALT is undefined. 
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.1 branch.
Fixes #42431 and #42401 for 4.1.

Built from https://develop.svn.wordpress.org/branches/4.1@42237


git-svn-id: http://core.svn.wordpress.org/branches/4.1@42066 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-11-27 01:13:21 +00:00
Gary Pendergast
1466683d48 Bump 4.1 branch to version 4.1.20. 
Built from https://develop.svn.wordpress.org/branches/4.1@42076


git-svn-id: http://core.svn.wordpress.org/branches/4.1@41905 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 13:43:26 +00:00
Gary Pendergast
16391a9641 Database: Restore numbered placeholders in wpdb::prepare(). 
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.

This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.

Merges [41662], [42056] to the 4.2 branch.
See #41925.


Built from https://develop.svn.wordpress.org/branches/4.1@42064


git-svn-id: http://core.svn.wordpress.org/branches/4.1@41893 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-10-31 12:53:27 +00:00
Aaron Campbell
6b3afa9678 Bump 4.1 branch to version 4.1.19. 
Built from https://develop.svn.wordpress.org/branches/4.1@41517


git-svn-id: http://core.svn.wordpress.org/branches/4.1@41350 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 20:07:25 +00:00
Aaron Campbell
89333247c9 Database: Hardening to bring wpdb::prepare() inline with documentation. 
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.

Merges [41496] to 4.1 branch.


Built from https://develop.svn.wordpress.org/branches/4.1@41504


git-svn-id: http://core.svn.wordpress.org/branches/4.1@41337 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 18:33:25 +00:00
Aaron Campbell
68b9288c14 Database: Don’t trigger _doing_it_wrong() for null values in wpdb::prepare(). 
While `wpdb::prepare()` does not support null values (see #12819) they still appear in the wild like in the WordPress Importer and other plugins.

Merges [41483] to 4.1 branch.


Built from https://develop.svn.wordpress.org/branches/4.1@41491


git-svn-id: http://core.svn.wordpress.org/branches/4.1@41324 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 16:26:18 +00:00
Aaron Campbell
688d186ddd Database: Hardening for wpdb::prepare() 
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

Merges [41470] to 4.1 branch.


Built from https://develop.svn.wordpress.org/branches/4.1@41478


git-svn-id: http://core.svn.wordpress.org/branches/4.1@41311 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 15:03:53 +00:00
Dominik Schilling
acc424ed10 TinyMCE: Improve the previews for shortcodes. 
Merge of [41395] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@41442


git-svn-id: http://core.svn.wordpress.org/branches/4.1@41275 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 12:44:54 +00:00
Dominik Schilling
900cd482a4 Editor: Prevent adding javascript: and data: URLs through the inline link dialog. 
Merge of [41393] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@41407


git-svn-id: http://core.svn.wordpress.org/branches/4.1@41240 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-09-19 10:19:51 +00:00
Aaron Campbell
9eb95c11ff Bump 4.1 branch to version 4.1.18. 
Built from https://develop.svn.wordpress.org/branches/4.1@40754


git-svn-id: http://core.svn.wordpress.org/branches/4.1@40612 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 21:53:24 +00:00
Pascal Birchler
f4aa87318c Media: Simplify upload error message construction. 
Merges [40736] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@40743


git-svn-id: http://core.svn.wordpress.org/branches/4.1@40601 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 18:04:19 +00:00
Dominik Schilling
f1dd14eb48 Customize: Ignore invalid customization sessions. 
Merge of [40704] to the 4.1 branch.
Built from https://develop.svn.wordpress.org/branches/4.1@40711


git-svn-id: http://core.svn.wordpress.org/branches/4.1@40574 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 12:20:25 +00:00
Pascal Birchler
03ff944f46 Adjust post meta checks 
Merges [40692] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@40699


git-svn-id: http://core.svn.wordpress.org/branches/4.1@40562 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:53:19 +00:00
Pascal Birchler
c17688406b Whitelist post arguments in XML-RPC 
Merges [40677] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@40684


git-svn-id: http://core.svn.wordpress.org/branches/4.1@40547 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-05-16 08:26:26 +00:00
Pascal Birchler
d4a45dc58d Bump 4.1 branch to version 4.1.17. 
Built from https://develop.svn.wordpress.org/branches/4.1@40493


git-svn-id: http://core.svn.wordpress.org/branches/4.1@40369 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-04-20 16:27:26 +00:00
James Nylen
d19df5f1e4 Bump 4.1 branch to version 4.1.16. 
Built from https://develop.svn.wordpress.org/branches/4.1@40208


git-svn-id: http://core.svn.wordpress.org/branches/4.1@40147 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 16:35:25 +00:00
Aaron Campbell
0d1be6d9ca Strip control characters before validating redirect. 
Merges [40183] to 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@40190


git-svn-id: http://core.svn.wordpress.org/branches/4.1@40129 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 13:45:27 +00:00
Dominik Schilling
c5c1dce809 Embeds: URL encode YouTube video IDs for broader compatibility. 
Merge of [40160] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@40167


git-svn-id: http://core.svn.wordpress.org/branches/4.1@40106 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-03-06 12:08:26 +00:00
Aaron Campbell
c0abe8d804 Bump 4.1 branch to version 4.1.15. 
Built from https://develop.svn.wordpress.org/branches/4.1@40002


git-svn-id: http://core.svn.wordpress.org/branches/4.1@39939 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-26 18:26:25 +00:00
Dominik Schilling
0a69a201ad Query: Ensure that queries work correctly with post type names with special characters. 
Merge of [39952] to the 4.1 branch.
Built from https://develop.svn.wordpress.org/branches/4.1@39962


git-svn-id: http://core.svn.wordpress.org/branches/4.1@39899 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-26 13:52:26 +00:00
Aaron Campbell
edd582c69e Bump 4.1 branch to version 4.1.14. 
Built from https://develop.svn.wordpress.org/branches/4.1@39866


git-svn-id: http://core.svn.wordpress.org/branches/4.1@39803 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 16:58:53 +00:00
Joe McGill
8dd8485f19 Media: Fix exif_imagetype check in wp_get_image_mime 
This is a follow up to [39831].

Merges [39850] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@39857


git-svn-id: http://core.svn.wordpress.org/branches/4.1@39794 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 16:44:24 +00:00
Joe McGill
6fd71daf13 Media: Improve image filetype checking. 
This adds a new function `wp_get_image_mime()` which is used by
`wp_check_filetype_and_ext()` to validate image files using
`exif_imagetype()` if available instead of `getimagesize()`.

`getimagesize()` is less performant than `exif_imagetype()` and is
dependent on GD. If `exif_imagetype()` is not available, it falls back to
`getimagesize()` as before.

If `wp_check_filetype_and_ext()` can't validate the filetype, we now return
`false` for ext/MIME values.

Merges [39831] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@39838


git-svn-id: http://core.svn.wordpress.org/branches/4.1@39776 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 13:18:53 +00:00
Dominik Schilling
cf41259781 Themes: Fix markup for theme name fallbacks. 
Merge of [39807] to the 4.1 branch.
Built from https://develop.svn.wordpress.org/branches/4.1@39815


git-svn-id: http://core.svn.wordpress.org/branches/4.1@39753 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 11:12:20 +00:00
Jeremy Felt
335301e8f6 Multisite: Use wp_rand() in signup key creation. 
Merges [39795] to the 4.1 branch.

Built from https://develop.svn.wordpress.org/branches/4.1@39802


git-svn-id: http://core.svn.wordpress.org/branches/4.1@39740 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 05:35:19 +00:00
Dion Hulse
e68653dd45 Update PHPMailer to 5.2.22. 
The full list of changes is available here:
https://github.com/PHPMailer/PHPMailer/compare/v5.2.21...v5.2.22

Merges [39759] to the 4.1 branch.
Fixes #37210 for 4.1.

Built from https://develop.svn.wordpress.org/branches/4.1@39790


git-svn-id: http://core.svn.wordpress.org/branches/4.1@39728 1a063a9b-81f0-0310-95a4-ce76da25c4cd
 2017-01-11 05:25:51 +00:00