dc7409e713
WordPress 3.9.29.
...
Built from https://develop.svn.wordpress.org/branches/3.9@46521
git-svn-id: http://core.svn.wordpress.org/branches/3.9@46318 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-10-14 20:19:11 +00:00
9442d0f7e5
Backporting several bug fixes.
...
- Query: Remove the static query property.
- HTTP API: Protect against hex interpretation.
- Filesystem API: Prevent directory travelersals when creating new folders.
- Administration: Ensure that admin referer nonce is valid.
- REST API: Send a Vary: Origin header on GET requests.
- Customizer: Properly sanitize background images.
Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@46503
git-svn-id: http://core.svn.wordpress.org/branches/3.9@46300 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-10-14 19:27:12 +00:00
fab981a1cb
WordPress 3.9.28.
...
Built from https://develop.svn.wordpress.org/branches/3.9@46033
git-svn-id: http://core.svn.wordpress.org/branches/3.9@45845 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 22:02:29 +00:00
128e2430a8
Fix for URL sanitization in `wp_kses_bad_protocol_once()`.
...
Merges [45997] to the 3.9 branch.
Props irsdl, sstoqnov, whyisjake.
Built from https://develop.svn.wordpress.org/branches/3.9@46016
git-svn-id: http://core.svn.wordpress.org/branches/3.9@45827 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 21:43:16 +00:00
58a90c49c1
Improve URL validation in `wp_validate_redirect()`.
...
Merges [45971] to the 3.9 branch.
Props vortfu, whyisjake, peterwilsoncc.
Built from https://develop.svn.wordpress.org/branches/3.9@45986
git-svn-id: http://core.svn.wordpress.org/branches/3.9@45797 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 17:16:25 +00:00
2dd32a25ce
Remove _convert_urlencoded_to_entities() from the get_the_content() callback.
...
Merges [45937] to the 3.9 branch.
Props vortfu, whyisjake, peterwilsoncc
Built from https://develop.svn.wordpress.org/branches/3.9@45965
git-svn-id: http://core.svn.wordpress.org/branches/3.9@45776 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-09-04 16:48:12 +00:00
8c00811afd
WordPress 3.9.27
...
Built from https://develop.svn.wordpress.org/branches/3.9@44888
git-svn-id: http://core.svn.wordpress.org/branches/3.9@44719 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-13 03:05:12 +00:00
3fa991919a
Bump 3.9 branch to version 3.9.26.
...
Built from https://develop.svn.wordpress.org/branches/3.9@44088
git-svn-id: http://core.svn.wordpress.org/branches/3.9@43918 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 02:16:19 +00:00
69cb93fc01
Multisite: Validate activation links.
...
Merges [44048] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@44071
git-svn-id: http://core.svn.wordpress.org/branches/3.9@43901 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:58:11 +00:00
7bd9d508d8
KSES: Make the URI attributes DRY.
...
This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.
Merges [44014] and [44017] to the `3.9` branch.
Built from https://develop.svn.wordpress.org/branches/3.9@44045
git-svn-id: http://core.svn.wordpress.org/branches/3.9@43875 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:22:10 +00:00
7fb75fbac4
Multisite: Improve messaging for previously activated users.
...
Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time.
Merges [44021] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@44038
git-svn-id: http://core.svn.wordpress.org/branches/3.9@43868 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:04:11 +00:00
006095dd57
KSES: Conditionally remove the `<form>` element from `$allowedposttags`.
...
To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.
Merges [43994] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@44016
git-svn-id: http://core.svn.wordpress.org/branches/3.9@43846 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:58:11 +00:00
7fd3a9f5f7
Media: Improve verification of MIME file types.
...
Merges [43988] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@44010
git-svn-id: http://core.svn.wordpress.org/branches/3.9@43840 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:44:11 +00:00
682e48d5bd
Bump 3.9 branch to version 3.9.25
...
Built from https://develop.svn.wordpress.org/branches/3.9@43417
git-svn-id: http://core.svn.wordpress.org/branches/3.9@43245 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 16:14:11 +00:00
309d82f2bc
Media: Limit thumbnail file deletions to the same directory as the original file.
...
Merges [43393] into the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@43403
git-svn-id: http://core.svn.wordpress.org/branches/3.9@43231 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 15:14:12 +00:00
b5bae28a24
Bump 3.9 branch to version 3.9.24
...
Built from https://develop.svn.wordpress.org/branches/3.9@42943
git-svn-id: http://core.svn.wordpress.org/branches/3.9@42773 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 20:32:23 +00:00
09ddadad9c
Template: Make sure the version string is correctly escaped for use in attributes.
...
Merge of [42893] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@42927
git-svn-id: http://core.svn.wordpress.org/branches/3.9@42757 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 16:11:23 +00:00
1b8cce073d
Bump the 3.9 branch to 3.9.23.
...
Built from https://develop.svn.wordpress.org/branches/3.9@42504
git-svn-id: http://core.svn.wordpress.org/branches/3.9@42333 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 21:47:15 +00:00
c46690c68b
External Libraries: Remove unnecessary / obsoleted MediaElement.js files.
...
Merges [42478] to the 3.9 branch.
Fixes #42720 for 3.9.
Built from https://develop.svn.wordpress.org/branches/3.9@42487
git-svn-id: http://core.svn.wordpress.org/branches/3.9@42316 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 08:15:17 +00:00
62423cc81f
Bump 3.9 branch to version 3.9.22.
...
Built from https://develop.svn.wordpress.org/branches/3.9@42326
git-svn-id: http://core.svn.wordpress.org/branches/3.9@42155 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 19:04:15 +00:00
2a5436237f
Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability.
...
Merges [42261] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@42307
git-svn-id: http://core.svn.wordpress.org/branches/3.9@42136 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:42:29 +00:00
a18a45296d
Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
...
Merges [42260] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@42306
git-svn-id: http://core.svn.wordpress.org/branches/3.9@42135 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:42:15 +00:00
8c9519f1e7
Hardening: Add escaping to the language attributes used on `html` elements.
...
Merges [42259] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@42305
git-svn-id: http://core.svn.wordpress.org/branches/3.9@42134 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:41:04 +00:00
80a325fda9
WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined.
...
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 3.9 branch.
Fixes #42431 and #42401 for 3.9.
Built from https://develop.svn.wordpress.org/branches/3.9@42239
git-svn-id: http://core.svn.wordpress.org/branches/3.9@42068 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-27 01:14:32 +00:00
76ec03176d
Bump 3.9 branch to version 3.9.21.
...
Built from https://develop.svn.wordpress.org/branches/3.9@42078
git-svn-id: http://core.svn.wordpress.org/branches/3.9@41907 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 13:45:15 +00:00
9b92304fd1
Database: Restore numbered placeholders in `wpdb::prepare()`.
...
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.
This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.
Merges [41662], [42056] to the 3.9 branch.
See #41925 .
Built from https://develop.svn.wordpress.org/branches/3.9@42066
git-svn-id: http://core.svn.wordpress.org/branches/3.9@41895 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 12:57:16 +00:00
79224df81a
Bump 3.9 branch to version 3.9.20.
...
Built from https://develop.svn.wordpress.org/branches/3.9@41519
git-svn-id: http://core.svn.wordpress.org/branches/3.9@41352 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 20:13:15 +00:00
f6afa94bef
Database: Hardening to bring `wpdb::prepare()` inline with documentation.
...
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.
Merges [41496] to 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@41506
git-svn-id: http://core.svn.wordpress.org/branches/3.9@41339 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 18:43:15 +00:00
30570f494f
Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`.
...
While `wpdb::prepare()` does not support null values (see #12819 ) they still appear in the wild like in the WordPress Importer and other plugins.
Merges [41483] to 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@41493
git-svn-id: http://core.svn.wordpress.org/branches/3.9@41326 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 16:27:16 +00:00
a5756e9c27
Database: Hardening for `wpdb::prepare()`
...
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.
Merges [41470] to 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@41480
git-svn-id: http://core.svn.wordpress.org/branches/3.9@41313 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 15:04:33 +00:00
435ca07747
Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog.
...
Merge of [41393] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@41409
git-svn-id: http://core.svn.wordpress.org/branches/3.9@41242 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:20:24 +00:00
66aaaa6aa8
Bump 3.9 branch to version 3.9.19.
...
Built from https://develop.svn.wordpress.org/branches/3.9@40756
git-svn-id: http://core.svn.wordpress.org/branches/3.9@40614 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 21:53:55 +00:00
73b0352cba
Media: Simplify upload error message construction.
...
Merges [40736] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@40745
git-svn-id: http://core.svn.wordpress.org/branches/3.9@40603 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 18:05:32 +00:00
9febffc6f7
Customize: Ignore invalid customization sessions.
...
Merge of [40704] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@40713
git-svn-id: http://core.svn.wordpress.org/branches/3.9@40576 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 12:21:15 +00:00
c2f264d25f
Adjust post meta checks
...
Merges [40692] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@40701
git-svn-id: http://core.svn.wordpress.org/branches/3.9@40564 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:54:15 +00:00
a81079c403
Whitelist post arguments in XML-RPC
...
Merges [40677] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@40686
git-svn-id: http://core.svn.wordpress.org/branches/3.9@40549 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:29:15 +00:00
063e974bd7
Bump 3.9 branch to version 3.9.18.
...
Built from https://develop.svn.wordpress.org/branches/3.9@40495
git-svn-id: http://core.svn.wordpress.org/branches/3.9@40371 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-04-20 16:28:15 +00:00
f2ef35f4a9
Bump 3.9 branch to version 3.9.17.
...
Built from https://develop.svn.wordpress.org/branches/3.9@40210
git-svn-id: http://core.svn.wordpress.org/branches/3.9@40149 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 16:42:15 +00:00
244804028c
Strip control characters before validating redirect.
...
Merges [40183] to 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@40192
git-svn-id: http://core.svn.wordpress.org/branches/3.9@40131 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-03-06 13:45:58 +00:00
946d349b71
Bump 3.9 branch to version 3.9.16.
...
Built from https://develop.svn.wordpress.org/branches/3.9@40004
git-svn-id: http://core.svn.wordpress.org/branches/3.9@39941 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 18:29:15 +00:00
13a15e6e07
Query: Ensure that queries work correctly with post type names with special characters.
...
Merge of [39952] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@39964
git-svn-id: http://core.svn.wordpress.org/branches/3.9@39901 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-26 13:53:00 +00:00
ec5bf14855
Bump 3.9 branch to version 3.9.15.
...
Built from https://develop.svn.wordpress.org/branches/3.9@39868
git-svn-id: http://core.svn.wordpress.org/branches/3.9@39805 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 16:59:32 +00:00
e2ef6cefbe
Media: Fix exif_imagetype check in wp_get_image_mime
...
This is a follow up to [39831].
Merges [39850] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@39859
git-svn-id: http://core.svn.wordpress.org/branches/3.9@39796 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 16:45:15 +00:00
c47e0b66a2
Media: Improve image filetype checking.
...
This adds a new function `wp_get_image_mime()` which is used by
`wp_check_filetype_and_ext()` to validate image files using
`exif_imagetype()` if available instead of `getimagesize()`.
`getimagesize()` is less performant than `exif_imagetype()` and is
dependent on GD. If `exif_imagetype()` is not available, it falls back to
`getimagesize()` as before.
If `wp_check_filetype_and_ext()` can't validate the filetype, we now return
`false` for ext/MIME values.
Merges [39831] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@39840
git-svn-id: http://core.svn.wordpress.org/branches/3.9@39778 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 13:20:15 +00:00
d9f0c45795
Themes: Fix markup for theme name fallbacks.
...
Merge of [39807] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@39817
git-svn-id: http://core.svn.wordpress.org/branches/3.9@39755 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 11:12:53 +00:00
8d2a900277
Multisite: Use `wp_rand()` in signup key creation.
...
Merges [39795] to the 3.9 branch.
Built from https://develop.svn.wordpress.org/branches/3.9@39804
git-svn-id: http://core.svn.wordpress.org/branches/3.9@39742 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:36:32 +00:00
924f935cb3
Update PHPMailer to 5.2.22.
...
The full list of changes is available here:
https://github.com/PHPMailer/PHPMailer/compare/v5.2.21...v5.2.22
Merges [39759] to the 3.9 branch.
Fixes #37210 for 3.9.
Built from https://develop.svn.wordpress.org/branches/3.9@39792
git-svn-id: http://core.svn.wordpress.org/branches/3.9@39730 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-11 05:26:32 +00:00
40ce4b29b1
Mail: Upgrade PHPMailer to 5.2.21.
...
Merges [39645], [36083], [33142], [33124], [29783] to the 3.9 branch.
See #37210 .
Built from https://develop.svn.wordpress.org/branches/3.9@39729
git-svn-id: http://core.svn.wordpress.org/branches/3.9@39669 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-01-06 22:06:55 +00:00
ca27550a35
Bump 3.9 branch to 3.9.14.
...
Built from https://develop.svn.wordpress.org/branches/3.9@38556
git-svn-id: http://core.svn.wordpress.org/branches/3.9@38499 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-07 15:02:18 +00:00
41276a8b92
Bump 3.9 branch to 3.9.13.
...
Built from https://develop.svn.wordpress.org/branches/3.9@37834
git-svn-id: http://core.svn.wordpress.org/branches/3.9@37799 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-21 16:44:14 +00:00
desrosj
whyisjake
Sergey Biryukov
Gary Pendergast
Jeremy Felt
Peter Wilson
iandunn
Aaron Campbell
John Blackbourn
Dominik Schilling
Dion Hulse
Pascal Birchler
James Nylen
Joe McGill
Boone Gorges