Some GitHub Action scripts require additional permissions to perform the desired operations. This permission is usually given by passing a personal access token (PAT) to the action as an input.
Because PATs grant access to sensitive information about the repository and actions with PATs become trusted actors, 3rd party actions should not be installed by specifying a major or minor version.
Instead, specifying a full length commit SHA will use the 3rd party action as an immutable release, ensuring the workflows within the repository are not affected by upstream security problems should they occur.
Props johnbillion.
See #52625.
Built from https://develop.svn.wordpress.org/trunk@50474
git-svn-id: http://core.svn.wordpress.org/trunk@50085 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changes the logic in `update_https_detection_errors()` to never store error messages from the actual request since they could use a different encoding, which would make storing them in an option potentially fail, leading WordPress to then falsely assume that HTTPS is supported.
While this doesn't actually fix the encoding issue, it is not crucial to do so anyway, since these messages are not used anywhere. A simple differentiation between whether the overall HTTPS request or only the SSL verification failed should be sufficient for the purpose of this function.
Props flixos90, tmatsuur, lukecarbis.
Fixes#52484.
Built from https://develop.svn.wordpress.org/trunk@50471
git-svn-id: http://core.svn.wordpress.org/trunk@50082 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Adjust the background color palette rules so they don't show up on inner containers when they're not supposed to:
- When an inner container block is present, it only applies them to direct children of the block with the background color assigned.
- Since the background color should only be applied to the Cover block's overlay, not to the inner container, it opts that specific block out of this rule.
Props dianeco, kjellr, paaljoachim.
Fixes#52676.
Built from https://develop.svn.wordpress.org/trunk@50466
git-svn-id: http://core.svn.wordpress.org/trunk@50077 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The editor uses the full height of its container, so the added margins cause the visual editor to break out of the container. This removes the top & bottom margins, and makes the left & right margins consistent with the meta box area.
Props antonlukin, paaljoachim, felipeelia.
Fixes#52646.
Built from https://develop.svn.wordpress.org/trunk@50465
git-svn-id: http://core.svn.wordpress.org/trunk@50076 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This avoids a fatal error on PHP 8 if `error_reporting()` is disabled in `php.ini`.
On systems with this function disabled, it's best to add a dummy function to the `wp-config.php` file, as there are multiple other calls in core or plugins.
However, as this call to the function is run prior to `wp-config.php` loading, it is now wrapped in a `function_exists()` check.
Props peterwilsoncc, fijisunshine, ayeshrajans.
Fixes#52226.
Built from https://develop.svn.wordpress.org/trunk@50447
git-svn-id: http://core.svn.wordpress.org/trunk@50058 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Previously, jQuery 1.12.4 was added to the WordPress SVN repo in order to backport an upstream security patch from jQuery 3.4.0.
Now that WordPress includes an unmodified version of jQuery 3.5.1 and no longer needs to maintain a fork, it can be removed from the SVN repo and installed via NPM again as part of the build.
Follow-up to [45342], [49101].
Props peterwilsoncc, SergeyBiryukov.
Fixes#52647.
Built from https://develop.svn.wordpress.org/trunk@50445
git-svn-id: http://core.svn.wordpress.org/trunk@50056 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The `external-http`, `media`, and `restapi` groups combined take roughly the same time as all the other tests combined. Splitting the test run in two speeds up the PHP 5.6 test runs which are the slowest by quite a margin. The net reduction in duration is only seen on PHP versions older than 7.0 where the reduction is greater than the time taken for the job to be set up.
Props peterwilsoncc, desrosj, johnbillion
Special shout out to manzoorwanijk whose article about running steps in parallel started me down this path.
Fixes#52645
Built from https://develop.svn.wordpress.org/trunk@50444
git-svn-id: http://core.svn.wordpress.org/trunk@50055 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Some PHPUnit tests were concerned with the state of files in the `build` directory. In order to allow the tests to run without requiring a build to be run first, these have been moved into assertions that run after the build step (and therefore cause it to fail if they do not pass), or into QUnit tests as necessary.
Various other PHPUnit tests implictly depend on built JavaScript files being present. These files are now touched during the test setup to avoid PHP warnings if the `build` files are not present.
The `wp-tests-config-sample.php` file and the GitHub Actions configuration have also been changed so `ABSPATH` uses `src` instead of `build`, therefore allowing the PHPUnit tests to be run without a build having to be run first. This means all new local installations of WordPress will use `src` for PHPUnit testing. If you would like to switch your existing installation over then change the location of `ABSPATH` in `wp-tests-config.php` to point to `src` instead of `build`.
Props peterwilsoncc, iandunn, gziolo, desroj, johnbillion
Fixes#51734
See #45863
Built from https://develop.svn.wordpress.org/trunk@50441
git-svn-id: http://core.svn.wordpress.org/trunk@50052 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The `actions/cache` GitHub action uses a `key` input to find the desired cache in storage. Currently, this is defined as a combination of the operating system being used, the software being cached (NPM or Composer), PHP version (Composer only), and a hash of the relevant lock file.
The `cache` action also supports a `restore-keys` input, which is an ordered list of keys to use for restoring a cache if no cache hit occurred for the specified key.
However, this means that every time a lock file is updated, the cache is being recreated by first restoring a previous one (when available), and then installing new versions of dependencies on top of that. This results in old, unused versions of dependencies never being removed from the cache.
In this change, the `restore-keys` are removed. This will force a new, fresh cache to be generated when the desired `key` is not matched. In testing, this results in a ~40% reduction in cache size when compared to the latest successful workflow runs. Since there is no way to manually flush the cache in GHA, the benefits of this change will not be seen until the `package-lock.json` and `composer.lock` files are updated, or the cache at the desired key is evicted.
Props johbillion.
See #52660.
Built from https://develop.svn.wordpress.org/trunk@50436
git-svn-id: http://core.svn.wordpress.org/trunk@50047 1a063a9b-81f0-0310-95a4-ce76da25c4cd
In GitHub Actions, there is a `fail-fast` option that will cancel all incomplete jobs within a workflow as soon as one failure is encountered. This defaults to `true`.
This is great for alerting you of a failure faster, but does not give you the full picture of what is failing. For example, it’s possible that there is a failing test on 2 versions of PHP, but not others. If `fail-fast` is enabled, it’s impossible to know this.
Even with `fail-fast` disabled, the workflow will still report a failure if one or more jobs produce a failing result.
Props johbillion, jorbin.
Fixes#52612.
Built from https://develop.svn.wordpress.org/trunk@50435
git-svn-id: http://core.svn.wordpress.org/trunk@50046 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Different branches have support for different types of testing based on the tooling that was in place at the time each version was branched. The workflows currently in place have patterns configured to match the relevant `branches` and `tags` for each workflow, but only for `push` events.
This copies the patterns for matching supported `branches` over to the `pull_request` event to prevent workflows from running for a pull request to a branch that does not support that workflow.
Fixes#52643.
Built from https://develop.svn.wordpress.org/trunk@50432
git-svn-id: http://core.svn.wordpress.org/trunk@50043 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This ensures a transparent logo remains visible while focused. Also cleans up dark mode CSS, consolidating styles and removing overrides that are no longer needed.
Follow up to [50154].
Props poena, sabernhardt, ryelle.
Fixes#52257.
Built from https://develop.svn.wordpress.org/trunk@50423
git-svn-id: http://core.svn.wordpress.org/trunk@50034 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This includes many minor adjustments to a wide array of core files to replace shorthands with full declarations.
Follow-up to [50001], [50270], [50367].
Props Clorith, hellofromTonya, peterwilsoncc, adamsilverstein, aristath.
See #51812.
Built from https://develop.svn.wordpress.org/trunk@50420
git-svn-id: http://core.svn.wordpress.org/trunk@50031 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Add a reference to `WP_Block_Type::__construct()` for information on accepted arguments in `register_block_type()`.
Synchronize the documentation between several places, use `WP_Block_Type::__construct()` as the canonical source.
Props ediamin, audrasjb, peterwilsoncc.
Fixes#48640.
Built from https://develop.svn.wordpress.org/trunk@50419
git-svn-id: http://core.svn.wordpress.org/trunk@50030 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Move `wp_get_script_tag()`, `wp_print_script_tag()`, `wp_print_inline_script_tag()` and `wp_get_inline_script_tag()` functions from `functions.php` to `script-loader.php`.
Relocate related tests to `dependencies` sub-directory.
Follow up to [50167].
Props adamsilverstein, hellofromTonya, SergeyBiryukov.
Fixes#39941.
Built from https://develop.svn.wordpress.org/trunk@50409
git-svn-id: http://core.svn.wordpress.org/trunk@50020 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Prevent `wp_localize_script()` (via `WP_Scripts::localize()`) throwing warnings in PHP 8 when the translation data is passed as a string. This maintains backward compatibility with earlier versions of PHP.
Introduce a `_doing_it_wrong()` notice to `WP_Scripts::localize()` if the translation data is not passed as an array.
Props jrf, peterwilsoncc, SergeyBiryukov.
Fixes#52534.
Built from https://develop.svn.wordpress.org/trunk@50408
git-svn-id: http://core.svn.wordpress.org/trunk@50019 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Replace loopback health check URL with a `POST` request to `wp-cron.php` in the WordPress install directory. This more closely represents how WordPress uses loopback requests.
A `POST` request is used to cause `wp-cron.php` to exit prior to running any cron jobs. This allows the test to indicate success quicker and accounts for sites that set the `DISABLE_WP_CRON` constant to avoid running cron jobs on loopback requests.
Props clorith, peterwilsoncc, TimothyBlynJacobs.
Fixes#52547.
Built from https://develop.svn.wordpress.org/trunk@50399
git-svn-id: http://core.svn.wordpress.org/trunk@50010 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This is a maintenance release. Changes include:
* Handle early connection errors such as 421 during connection and EHLO states.
* Make the `mail()` and sendmail transports set the envelope sender the same way as SMTP does, i.e. use whatever `From` is set to, only falling back to the `sendmail_from` php.ini setting if `From` is unset. This avoids errors from the `mail()` function if `Sender` is not set explicitly and php.ini is not configured. This is a minor functionality change, so bumps the minor version number.
* Extend `parseAddresses` to decode encoded names.
Release notes: https://github.com/PHPMailer/PHPMailer/releases/tag/v6.3.0
For a full list of changes in this update, see the PHPMailer GitHub:
https://github.com/PHPMailer/PHPMailer/compare/v6.2.0...v6.3.0
Props ayeshrajans.
Fixes#52577.
Built from https://develop.svn.wordpress.org/trunk@50397
git-svn-id: http://core.svn.wordpress.org/trunk@50008 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This avoids an "Undefined index" PHP notice in `wp_resource_hints()` tests when running the full test suite.
Remove the unused global from `get_home_url()`.
Follow-up to [25443], [38100], [38174], [50156], [50164].
Props peterwilsoncc.
Fixes#52566.
Built from https://develop.svn.wordpress.org/trunk@50393
git-svn-id: http://core.svn.wordpress.org/trunk@50004 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When deleting a term, it has to be removed individually from each object it's connected to, which can take some significant time when there are a lot of objects.
By calling `wp_remove_object_terms()` when no default term is required, we can skip the terms fetch/diff step and significantly speed up the deletion process.
Props dd32.
Fixes#52549.
Built from https://develop.svn.wordpress.org/trunk@50389
git-svn-id: http://core.svn.wordpress.org/trunk@50000 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The admin bar height custom property is used in `calc` functions, which require consistent unit use, even when the value is zero. A unitless value returns an invalid value for the "height" property, where this variable is used. This also changes the stylelint rule in the theme to allow zero values with a unit, just in custom properties.
Props nico23.
Fixes#52564.
Built from https://develop.svn.wordpress.org/trunk@50388
git-svn-id: http://core.svn.wordpress.org/trunk@49999 1a063a9b-81f0-0310-95a4-ce76da25c4cd
In #50547, the admin color schemes were added to the customizer UI, but at some point specificity changed and the colors were overridden by the defaults. This brings the color schemes back into the customizer, using the button color as a highlight, with the link color for text to keep things readable.
Follow up to [48371].
Props audrasjb, peterwilsoncc.
Fixes#52230.
Built from https://develop.svn.wordpress.org/trunk@50386
git-svn-id: http://core.svn.wordpress.org/trunk@49997 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The `blur()` method there is not the jQuery method, but is an HTML DOM method instead.
This makes the Close button on the "View details" modal on Plugins screen functional again.
Follow-up to [50367].
Props afragen.
See #51812.
Built from https://develop.svn.wordpress.org/trunk@50383
git-svn-id: http://core.svn.wordpress.org/trunk@49994 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Ensure that subsequent renders of a reusable block will render correctly and that recursively inserting a reusable block into itself does not cause an internal server (500) error.
Props bernhard-reiter, SergeyBiryukov.
Fixes#52364.
Built from https://develop.svn.wordpress.org/trunk@50382
git-svn-id: http://core.svn.wordpress.org/trunk@49993 1a063a9b-81f0-0310-95a4-ce76da25c4cd
In `unstick_post()` if a post ID is duplicated in the `sticky_posts` option remove all instances.
In both `stick_post()` and `unstick_post()` check for duplicate IDs already stored in the `sticky_post` option and remove them if the option is updated.
Props rahmohn, archon810.
Fixes#52007.
Built from https://develop.svn.wordpress.org/trunk@50380
git-svn-id: http://core.svn.wordpress.org/trunk@49991 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Updates older themes to fix alignment, spacing, and font issues to better match the frontend display. Applies to themes: Twenty Eleven, Twenty Thirteen, Twenty Fourteen, Twenty Sixteen, Twenty Seventeen, and Twenty Twenty.
Props burnuser, talldanwp, cristinasoponar, poena, kjellr
Fixes#52009.
Built from https://develop.svn.wordpress.org/trunk@50358
git-svn-id: http://core.svn.wordpress.org/trunk@49969 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Adds an explicit relationship between the upload button and the maximum upload limit, moves focus to the error dismiss button if an error occurs, and adds a call to wp.a11y.speak to report the error after it occurs.
Props afercia, anevins, antpb, adamsilverstein, poena
Fixes#47120
Built from https://develop.svn.wordpress.org/trunk@50352
git-svn-id: http://core.svn.wordpress.org/trunk@49963 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The WordPress Importer plugin is now downloaded to the `tests/phpunit/data/plugins` directory when running `npm run env:install`.
This ensures that the PHPUnit test suite will not fail when the plugin is missing.
This also introduces a new `WP_IMPORTER_REVISION` variable to the `.env` file, to control the SVN revision that is checked out.
Props johnbillion.
Fixes#49720.
Built from https://develop.svn.wordpress.org/trunk@50285
git-svn-id: http://core.svn.wordpress.org/trunk@49930 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This ensures that not only the return values match the expected results, but also that their type is the same.
Going forward, stricter type checking by using `assertSame()` should generally be preferred to `assertEquals()` where appropriate, to make the tests more reliable.
Follow-up to [49904], [49925], [49992], [50012], [50013], [50065], [50075], [50131], [50150], [50157].
See #38266, #52482.
Built from https://develop.svn.wordpress.org/trunk@50284
git-svn-id: http://core.svn.wordpress.org/trunk@49929 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The color palette changes in #49999 introduced some contrast issues on buttons, input elements, and links. This change ensures that all interactive elements have an appropriate contrast ratio.
Follow-up to [50025].
Props audrasjb, joedolson.
Fixes#52402.
Built from https://develop.svn.wordpress.org/trunk@50278
git-svn-id: http://core.svn.wordpress.org/trunk@49923 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Some files ignored within the `.gitignore` file were not included in the `svn:ignore` property.
This also removed `wp-config.php` and `wp-tests-config.php` from the `svn:ignore` property. It’s already specified in `svn:global-ignores`.
Props johnbillion.
Fixes#49784.
Built from https://develop.svn.wordpress.org/trunk@50277
git-svn-id: http://core.svn.wordpress.org/trunk@49922 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When using the `adjacent_image_link()` function there is a condition that will return a linked image. Previously, the returned image was sent without alt attributes.
Now, `adjacent_image_link()` will include alt attributes of the image's title when an image is returned.
Props joedolson, Mista-Flo, sabernhardt.
Fixes#52387.
Built from https://develop.svn.wordpress.org/trunk@50274
git-svn-id: http://core.svn.wordpress.org/trunk@49919 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This extension is necessary because the comment approval notification opt-in form introduced in [47887] uses the same mechanism, and the previous limit of one minute meant that users on a slow connection, using assistive technology, with limited motor skills, or who are generally indecisive may not complete the opt-in action within one minute, and therefore not see the confirmation message.
Props joedolson, imath, hellofromTonya, peterwilsoncc, alexstine, davidbaumwald
Fixes#52406
Built from https://develop.svn.wordpress.org/trunk@50271
git-svn-id: http://core.svn.wordpress.org/trunk@49916 1a063a9b-81f0-0310-95a4-ce76da25c4cd
desrosj
Mike Schroder
Sergey Biryukov
ryelle
John Blackbourn
Aaron Jorbin
TimothyBlynJacobs
noisysocks
Peter Wilson
Adam Silverstein
Felix Arntz
joedolson
youknowriad
Dominik Schilling
gziolo
antpb