f056a36272
Formatting: Fix a PHP warning in introduced in [44840].
...
Merges [44864] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@44865
git-svn-id: http://core.svn.wordpress.org/branches/4.5@44696 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-13 00:38:20 +00:00
fb7f4bf7b6
Comments: Improve comment content filtering.
...
Merges [44842] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@44849
git-svn-id: http://core.svn.wordpress.org/branches/4.5@44681 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-12 22:38:19 +00:00
4db371262e
Formatting: Improve `rel="nofollow"` handling in comments.
...
Merges [44833] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@44840
git-svn-id: http://core.svn.wordpress.org/branches/4.5@44672 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-03-12 22:25:20 +00:00
ab5c2ba564
Bump 4.5 branch to version 4.5.16.
...
Built from https://develop.svn.wordpress.org/branches/4.5@44082
git-svn-id: http://core.svn.wordpress.org/branches/4.5@43912 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 02:14:25 +00:00
ab40c9608a
Editor: Remove unwanted fields before saving posts.
...
The `meta_input`, `file`, and `guid` fields are not intended to be updated through user input.
Merges [44047] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@44060
git-svn-id: http://core.svn.wordpress.org/branches/4.5@43890 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:45:20 +00:00
baa754b110
Multisite: Validate activation links.
...
Merges [44048] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@44059
git-svn-id: http://core.svn.wordpress.org/branches/4.5@43889 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 01:44:20 +00:00
a79ebd98e8
KSES: Make the URI attributes DRY.
...
This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.
Merges [44014] and [44017] to the `4.6` branch.
Built from https://develop.svn.wordpress.org/branches/4.5@44032
git-svn-id: http://core.svn.wordpress.org/branches/4.5@43862 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 00:54:20 +00:00
42e2569843
Multisite: Improve messaging for previously activated users.
...
Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time.
Merges [44021] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@44029
git-svn-id: http://core.svn.wordpress.org/branches/4.5@43859 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-13 00:47:20 +00:00
368895642d
KSES: Conditionally remove the `<form>` element from `$allowedposttags`.
...
To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.
Merges [43994] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@44002
git-svn-id: http://core.svn.wordpress.org/branches/4.5@43834 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:29:21 +00:00
822cb35130
Media: Improve verification of MIME file types.
...
Merges [43988] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@43993
git-svn-id: http://core.svn.wordpress.org/branches/4.5@43825 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-12-12 23:11:21 +00:00
dce2bd647f
Bump 4.5 branch to version 4.5.15
...
Built from https://develop.svn.wordpress.org/branches/4.5@43411
git-svn-id: http://core.svn.wordpress.org/branches/4.5@43239 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 16:12:28 +00:00
cde3e1022a
Media: Limit thumbnail file deletions to the same directory as the original file.
...
Merges [43393] into the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@43397
git-svn-id: http://core.svn.wordpress.org/branches/4.5@43225 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-07-05 14:55:23 +00:00
fff3ef94b7
Bump 4.5 branch to version 4.5.14
...
Built from https://develop.svn.wordpress.org/branches/4.5@42937
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42767 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 20:29:32 +00:00
3465fda2e7
Template: Make sure the version string is correctly escaped for use in attributes.
...
Merge of [42893] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42921
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42751 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 16:08:10 +00:00
52e15eb4d6
Meta: Simplify the delete all meta query in `delete_metadata()`.
...
Merge of [42913] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42916
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42746 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:43:03 +00:00
764b72595b
HTTP: Don't treat `localhost` as same host by default.
...
Merge of [42894] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42912
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42742 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:37:53 +00:00
f59a558d1f
Login: Use `wp_safe_redirect()` when redirecting the login page if forced to use HTTPS.
...
Merge of [42892] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42899
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42729 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-04-03 15:31:11 +00:00
f3e648fc4b
General: Update copyright year to 2018 in license.txt.
...
Props rachelbaker.
Merges [42424] to the 4.5 branch.
Fixes #43007 .
Built from https://develop.svn.wordpress.org/branches/4.5@42556
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42385 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-23 11:27:46 +00:00
466e565a32
Bump the 4.5 branch to 4.5.13.
...
Built from https://develop.svn.wordpress.org/branches/4.5@42498
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42327 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 21:42:07 +00:00
c5126cd06a
External Libraries: Remove unnecessary / obsoleted MediaElement.js files.
...
Merges [42478] to the 4.5 branch.
Fixes #42720 for 4.5.
Built from https://develop.svn.wordpress.org/branches/4.5@42481
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42310 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 08:08:33 +00:00
fce8018006
Upgrade: When deleting old files, if deletion fails attempt to empty the file instead.
...
Props joemcgill, dd32.
Merges [42434] to the 4.5 branch.
Fixes #42963 for 4.5.
Built from https://develop.svn.wordpress.org/branches/4.5@42469
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42298 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2018-01-16 06:56:04 +00:00
c33337c395
Bump 4.5 branch to 4.5.12.
...
Built from https://develop.svn.wordpress.org/branches/4.5@42320
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42149 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 19:00:32 +00:00
db1e3afed0
Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability.
...
Merges [42261] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42283
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42112 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:27:34 +00:00
8511c84d2c
Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
...
Merges [42260] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42282
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42111 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:27:01 +00:00
cc28f09509
Hardening: Add escaping to the language attributes used on `html` elements.
...
Merges [42259] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42281
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42110 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:26:31 +00:00
f19b2b4635
Hardening: Use a properly generated hash for the `newbloguser` key instead of a determinate substring.
...
Merges [42258] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@42280
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42109 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-29 16:25:07 +00:00
4d65d6de5b
WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined.
...
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.5 branch.
Fixes #42431 and #42401 for 4.5.
Built from https://develop.svn.wordpress.org/branches/4.5@42233
git-svn-id: http://core.svn.wordpress.org/branches/4.5@42062 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-11-27 01:10:32 +00:00
53e10c441b
General: Remove the version number from the readme file in the 4.5 branch.
...
See #42386
Built from https://develop.svn.wordpress.org/branches/4.5@42102
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41931 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 18:08:07 +00:00
512427a740
Bump 4.5 branch to version 4.5.11.
...
Built from https://develop.svn.wordpress.org/branches/4.5@42072
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41901 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 13:16:30 +00:00
84b702009b
Database: Restore numbered placeholders in `wpdb::prepare()`.
...
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.
This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.
Merges [41662], [42056] to the 4.5 branch.
See #41925 .
Built from https://develop.svn.wordpress.org/branches/4.5@42060
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41889 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-10-31 12:44:32 +00:00
df3d5cd1af
Taxonomy/Users: Use correct escaping function for URLs.
...
Merge of [41522] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41526
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41359 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 21:30:32 +00:00
5047d9b8db
Bump 4.5 branch to version 4.5.10.
...
Built from https://develop.svn.wordpress.org/branches/4.5@41513
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41346 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 20:01:31 +00:00
9007b3117b
Database: Hardening to bring `wpdb::prepare()` inline with documentation.
...
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.
Merges [41496] to 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41500
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41333 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 18:14:31 +00:00
4b09915583
Database: Don’t trigger `_doing_it_wrong()` for null values in `wpdb::prepare()`.
...
While `wpdb::prepare()` does not support null values (see #12819 ) they still appear in the wild like in the WordPress Importer and other plugins.
Merges [41483] to 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41487
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41320 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 16:23:33 +00:00
644434666e
Database: Hardening for `wpdb::prepare()`
...
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.
Merges [41470] to 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41474
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41307 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 15:01:07 +00:00
6208a0780c
Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues.
...
Merges [41457] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41461
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41294 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 14:41:31 +00:00
f1c76c5532
oEmbed: Add extra hardening around allowed HTML for improved sandboxing.
...
Merges [41448] to 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41454
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41287 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 13:50:32 +00:00
c3844666a2
TinyMCE: Improve the previews for shortcodes.
...
Merge of [41395] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41438
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41271 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 12:43:08 +00:00
cda7d5bac0
Customize: Ensure valid themes in the preview.
...
Merge of [41397] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41432
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41265 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 11:52:08 +00:00
b38f64fe94
Taxonomy/Users: Provide a fallback for incorrect HTTP referrers.
...
Merge of [41398] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41420
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41253 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 11:13:13 +00:00
367007e79a
General: Remove context added in [41414] in order to avoid a string change in a point release.
...
See #13377
Built from https://develop.svn.wordpress.org/branches/4.5@41416
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41249 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:46:31 +00:00
9d2e40d699
General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.
...
Merges [41414] into the 4.5. branch
See #13377
Built from https://develop.svn.wordpress.org/branches/4.5@41415
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41248 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:32:31 +00:00
0d5353afbc
Editor: Prevent adding `javascript:` and `data:` URLs through the inline link dialog.
...
Merge of [41393] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@41403
git-svn-id: http://core.svn.wordpress.org/branches/4.5@41236 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-09-19 10:17:14 +00:00
030d6166f9
General: Backport PHP 7.1 fixes to the 4.5 branch to avoid fatal errors and warnings.
...
Props simonvik, ayeshrajans
See #41135
Built from https://develop.svn.wordpress.org/branches/4.5@41128
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40968 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-07-24 22:25:32 +00:00
668efc78c0
Import Twenty Sixteen, default theme for 2016.
...
See #36497 .
Merges [40851] and [40852] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40858
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40709 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-31 01:29:32 +00:00
9ab481b9e5
Bump 4.7 branch to version 4.5.9.
...
Built from https://develop.svn.wordpress.org/branches/4.5@40750
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40608 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 21:50:02 +00:00
c2adcb9aec
Media: Simplify upload error message construction.
...
Merges [40736] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40739
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40597 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 18:02:32 +00:00
a6878209f8
Add nonce for updating file system credentials.
...
Merges [40723] to 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40726
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40584 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 14:54:03 +00:00
5046262be3
Customize: Ignore invalid customization sessions.
...
Merge of [40704] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40707
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40570 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 12:16:31 +00:00
62983e1dd2
Adjust post meta checks
...
Merges [40692] to the 4.5 branch.
Built from https://develop.svn.wordpress.org/branches/4.5@40695
git-svn-id: http://core.svn.wordpress.org/branches/4.5@40558 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2017-05-16 08:50:31 +00:00
Sergey Biryukov
Jeremy Felt
Gary Pendergast
Peter Wilson
iandunn
Aaron Campbell
John Blackbourn
Dominik Schilling
Dion Hulse
Konstantin Obenland
Pascal Birchler