John Blackbourn 31c811c962 Security: Always include the no-store and private directives in the Cache-Control header when setting headers that prevent caching. ...

The intention of these headers is to prevent any form of caching, whether that's in the browser or in an intermediate cache such as a proxy server. These directives instruct an intermediate cache to not store the response in their cache for any user – not just for logged-in users.

This does not affect the caching behaviour of assets within a page such as images, CSS, and JavaScript files.

Props kkmuffme, devansh2002, johnbillion.

Fixes #61942
Built from https://develop.svn.wordpress.org/trunk@59724


git-svn-id: http://core.svn.wordpress.org/trunk@59066 1a063a9b-81f0-0310-95a4-ce76da25c4cd

2025-01-28 23:22:22 +00:00

..

assets

Build/Test Tools: Update devDependencies.

2024-12-13 19:06:24 +00:00

block-bindings

…

block-patterns

Editor: Deprecate "Social links with a shared background color" pattern.

2024-09-13 05:37:16 +00:00

block-supports

Docs: Docblock improvements in .

2024-12-21 17:23:24 +00:00

blocks

Build/Test Tools: Update devDependencies.

2024-12-13 19:06:24 +00:00

certificates

…

css

Editor: Warn about empty templates on the frontend for logged in users.

2024-11-22 10:57:19 +00:00

customize

Administration: A11y: Fix accordion accessibility.

2024-10-13 19:09:12 +00:00

fonts

Editor: Load all style variation fonts within the editors.

2024-10-20 23:25:16 +00:00

html-api

HTML API: Remove nullable from get_breadcrumbs return type

2024-12-10 11:41:16 +00:00

ID3

…

images

…

interactivity-api

Interactivity API: Support length property on strings and arrays on the server

2024-12-02 08:10:17 +00:00

IXR

Code Modernization: Remove xml_set_object() in IXR_Message::parse().

2024-09-18 18:04:14 +00:00

js

Administration: Fix typo in code documentation in wp/sanitize.js.

2025-01-27 19:25:25 +00:00

l10n

I18N: Add a new way to determine whether a translation is available.

2024-09-17 20:58:15 +00:00

php-compat

…

PHPMailer

External Libraries: Upgrade PHPMailer to version 6.9.3.

2024-12-03 15:22:18 +00:00

pomo

…

Requests

…

rest-api

REST API: Introduce filter for controlling menu read access.

2025-01-28 04:09:22 +00:00

SimplePie

External Libraries: Correct the case for wp-includes/SimplePie/src/Gzdecode.php.

2024-09-30 23:27:19 +00:00

sitemaps

Coding Standards: Cast wp_count_terms() result to int before using in ceil().

2024-11-26 21:17:25 +00:00

sodium_compat

Upgrade/Install: Add missing files from the sodium_compat v1.21.1 update.

2024-07-18 13:48:15 +00:00

style-engine

Editor: Avoid unnecessary array_merge in WP_Style_Engine::parse_block_styles().

2024-11-20 21:29:22 +00:00

Text

Code Modernization: Fix trigger_error() with E_USER_ERROR deprecation in Text_Diff_Op::reverse().

2024-09-27 18:19:17 +00:00

theme-compat

…

widgets

Editor: Change the Text editor label to Code.

2025-01-23 23:54:23 +00:00

admin-bar.php

Toolbar: Allow the Learn WordPress link to be localized.

2024-11-19 22:18:21 +00:00

atomlib.php

Code Modernization: Remove xml_set_object() in AtomParser::parse().

2024-09-18 21:20:15 +00:00

author-template.php

…

block-bindings.php

…

block-editor.php

Editor: Load all style variation fonts within the editors.

2024-10-20 23:25:16 +00:00

block-i18n.json

…

block-patterns.php

Editor: Add description for Banners block pattern category.

2024-11-29 22:46:21 +00:00

block-template-utils.php

General: Expand use of wp_get_wp_version().

2024-10-03 00:25:15 +00:00

block-template.php

Editor: Warn about empty templates on the frontend for logged in users.

2024-11-22 10:57:19 +00:00

blocks.php

Block Hooks: Apply to synced patterns.

2024-12-19 13:26:28 +00:00

bookmark-template.php

Date/Time, PHP Compat: Prevent type errors using GMT offset option.

2024-09-18 22:37:15 +00:00

bookmark.php

…

cache-compat.php

…

cache.php

…

canonical.php

Docs: Correct inline comment formatting in redirect_canonical().

2024-08-22 23:47:15 +00:00

capabilities.php

Block Bindings: Fix panel not appearing in custom post types.

2024-10-15 14:13:19 +00:00

category-template.php

…

category.php

Docs: Improve @return docblock section for get_category().

2025-01-24 23:28:23 +00:00

class-avif-info.php

…

class-feed.php

External Libraries: Update the SimplePie library to version 1.8.0.

2024-09-30 22:50:19 +00:00

class-http.php

…

class-IXR.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

class-json.php

…

class-oembed.php

…

class-phpass.php

External Libraries: Update PHPass library.

2024-09-17 21:08:16 +00:00

class-phpmailer.php

…

class-pop3.php

Docs: Adjust comments about set_time_limit() per the documentation standards.

2024-10-25 20:26:20 +00:00

class-requests.php

…

class-simplepie.php

External Libraries: Update the SimplePie library to version 1.8.0.

2024-09-30 22:50:19 +00:00

class-smtp.php

…

class-snoopy.php

…

class-walker-category-dropdown.php

…

class-walker-category.php

…

class-walker-comment.php

…

class-walker-nav-menu.php

Menus: Improve performance by calling get_privacy_policy_url() once per Walker_Nav_Menu instance rather than for every nav menu item.

2025-01-21 21:26:23 +00:00

class-walker-page-dropdown.php

…

class-walker-page.php

…

class-wp-admin-bar.php

Toolbar: Move user and recovery menus to a higher priority.

2024-07-18 00:52:17 +00:00

class-wp-ajax-response.php

…

class-wp-application-passwords.php

App Passwords: Don't prevent non-unique App Password names.

2024-09-24 16:40:17 +00:00

class-wp-block-bindings-registry.php

Block Bindings: Adds context needed by sources during its processing

2024-09-23 12:35:15 +00:00

class-wp-block-bindings-source.php

Block bindings: Adds a filter to customize the output of a block bindings source.

2024-09-03 16:33:15 +00:00

class-wp-block-editor-context.php

…

class-wp-block-list.php

…

class-wp-block-metadata-registry.php

Editor: Allow registering PHP manifest file for block metadata collections for enhanced performance.

2024-09-30 17:08:26 +00:00

class-wp-block-parser-block.php

…

class-wp-block-parser-frame.php

Editor: Update packages for 6.7 Beta 1.

2024-09-20 01:55:35 +00:00

class-wp-block-parser.php

…

class-wp-block-pattern-categories-registry.php

…

class-wp-block-patterns-registry.php

Block Hooks: apply_block_hooks_to_content in Patterns, Templates.

2024-09-27 09:20:18 +00:00

class-wp-block-styles-registry.php

…

class-wp-block-supports.php

Editor: Default attribute value not used with get_block_wrapper_attributes

2024-09-26 12:47:16 +00:00

class-wp-block-template.php

Editor: Add plugin template registration API and improve theme overrides for plugin-registered templates

2024-09-20 02:07:12 +00:00

class-wp-block-templates-registry.php

Editor: Add plugin template registration API and improve theme overrides for plugin-registered templates

2024-09-20 02:07:12 +00:00

class-wp-block-type-registry.php

…

class-wp-block-type.php

…

class-wp-block.php

Editor: Improve consistency of render_block_context filter.

2025-01-17 21:37:21 +00:00

class-wp-classic-to-block-menu-converter.php

…

class-wp-comment-query.php

Docs: Document $clauses associative array in *-clauses filters.

2024-06-21 17:26:14 +00:00

class-wp-comment.php

Coding Standards: Explicitly return false in magic __isset() methods.

2024-11-03 23:03:19 +00:00

class-wp-customize-control.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

class-wp-customize-manager.php

Editor: Respect show_avatars option in block editor and Customizer.

2024-09-22 22:50:18 +00:00

class-wp-customize-nav-menus.php

Administration: A11y: Fix accordion accessibility.

2024-10-13 19:09:12 +00:00

class-wp-customize-panel.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

class-wp-customize-section.php

Administration: A11y: Fix accordion accessibility.

2024-10-13 19:09:12 +00:00

class-wp-customize-setting.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

class-wp-customize-widgets.php

Customize: Show sidebar's description below its name in Customizer Widgets sidebar list.

2025-01-21 22:38:23 +00:00

class-wp-date-query.php

Coding Standards: Cast gmdate( 'Z' ) to an integer before addition.

2024-11-27 11:40:18 +00:00

class-wp-dependencies.php

Script Loader: Refactor Etag generation for concatenated assets.

2024-08-25 23:48:13 +00:00

class-wp-dependency.php

…

class-wp-duotone.php

…

class-wp-editor.php

Editor: Change the Text editor label to Code.

2025-01-23 23:54:23 +00:00

class-wp-embed.php

…

class-wp-error.php

…

class-wp-exception.php

Code Modernization: Fix trigger_error() with E_USER_ERROR deprecation in wp_trigger_error().

2024-09-27 19:28:14 +00:00

class-wp-fatal-error-handler.php

Site Health: Add a link to support forums in the message displayed for a critical error.

2024-10-22 10:16:16 +00:00

class-wp-feed-cache-transient.php

External Libraries: Update the SimplePie library to version 1.8.0.

2024-09-30 22:50:19 +00:00

class-wp-feed-cache.php

External Libraries: Update the SimplePie library to version 1.8.0.

2024-09-30 22:50:19 +00:00

class-wp-hook.php

…

class-wp-http-cookie.php

…

class-wp-http-curl.php

…

class-wp-http-encoding.php

…

class-wp-http-ixr-client.php

…

class-wp-http-proxy.php

…

class-wp-http-requests-hooks.php

…

class-wp-http-requests-response.php

…

class-wp-http-response.php

…

class-wp-http-streams.php

…

class-wp-http.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

class-wp-image-editor-gd.php

Media: improve filter to enable setting output quality by image size.

2024-11-29 23:48:15 +00:00

class-wp-image-editor-imagick.php

Media: improve Imagick handling of colors and alpha channel for PNG image uploads.

2025-01-07 22:35:23 +00:00

class-wp-image-editor.php

Media: improve filter to enable setting output quality by image size.

2024-11-29 23:48:15 +00:00

class-wp-list-util.php

…

class-wp-locale-switcher.php

I18N: Mail: Make PHPMailer messages translatable.

2025-01-08 12:54:18 +00:00

class-wp-locale.php

I18N: Add new WP_Locale::get_month_genitive() method.

2024-12-05 21:37:20 +00:00

class-wp-matchesmapregex.php

…

class-wp-meta-query.php

…

class-wp-metadata-lazyloader.php

…

class-wp-navigation-fallback.php

…

class-wp-network-query.php

Docs: Document $clauses associative array in *-clauses filters.

2024-06-21 17:26:14 +00:00

class-wp-network.php

Networks and Sites: Set WP_Network properties via setters upon creation.

2024-09-13 22:12:15 +00:00

class-wp-object-cache.php

Coding Standards: Remove unused return value for WP_Object_Cache::__set().

2024-09-19 12:12:16 +00:00

class-wp-oembed-controller.php

…

class-wp-oembed.php

Embeds: Add Canva to oEmbed provider allowlist.

2025-01-11 13:44:25 +00:00

class-wp-paused-extensions-storage.php

Options, Meta APIs: Explicitly pass $autoload parameter to when potentially adding new options.

2024-09-03 18:19:14 +00:00

class-wp-phpmailer.php

I18N: Mail: Make PHPMailer messages translatable.

2025-01-08 12:54:18 +00:00

class-wp-plugin-dependencies.php

…

class-wp-post-type.php

Posts, Post Types: Embeds: Add new embeddable argument to post types.

2025-01-24 13:32:21 +00:00

class-wp-post.php

…

class-wp-query.php

Docs: Add missing @var tag for WP_Query::$query_vars_changed.

2024-12-05 22:05:20 +00:00

class-wp-recovery-mode-cookie-service.php

…

class-wp-recovery-mode-email-service.php

…

class-wp-recovery-mode-key-service.php

Options, Meta APIs: Explicitly pass $autoload parameter to when potentially adding new options.

2024-09-03 18:19:14 +00:00

class-wp-recovery-mode-link-service.php

…

class-wp-recovery-mode.php

Docs: Add missing void to DocBlock @return types.

2024-11-02 15:01:19 +00:00

class-wp-rewrite.php

Docs: Fix typo in a comment in WP_Rewrite::refresh_rewrite_rules().

2024-10-19 23:54:18 +00:00

class-wp-role.php

…

class-wp-roles.php

Options, Meta APIs: Explicitly pass $autoload parameter to when potentially adding new options.

2024-09-03 18:19:14 +00:00

class-wp-script-modules.php

Docs: Correct formatting for script module data filter documentation examples.

2024-12-11 15:20:18 +00:00

class-wp-scripts.php

Code Quality: Clarify variable names in dependency classes.

2024-08-10 23:00:14 +00:00

class-wp-session-tokens.php

…

class-wp-simplepie-file.php

External Libraries: Update the SimplePie library to version 1.8.0.

2024-09-30 22:50:19 +00:00

class-wp-simplepie-sanitize-kses.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

class-wp-site-query.php

Docs: Various docblock improvements and corrections.

2024-09-11 12:08:19 +00:00

class-wp-site.php

…

class-wp-styles.php

Code Quality: Clarify variable names in dependency classes.

2024-08-10 23:00:14 +00:00

class-wp-tax-query.php

…

class-wp-taxonomy.php

…

class-wp-term-query.php

Taxonomy: Remove count references from WP_Term_Query.

2024-10-30 22:34:19 +00:00

class-wp-term.php

…

class-wp-text-diff-renderer-inline.php

…

class-wp-text-diff-renderer-table.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

class-wp-textdomain-registry.php

i18n: Account for load_*_textdomain() after JIT loading.

2024-11-20 02:50:24 +00:00

class-wp-theme-json-data.php

…

class-wp-theme-json-resolver.php

Theme JSON Resolver: remove theme json merge in resolve_theme_file_uris

2024-11-04 02:34:16 +00:00

class-wp-theme-json-schema.php

…

class-wp-theme-json.php

Editor: Update docblocks for wp_get_global_stylesheet and WP_Theme_JSON::get_stylesheet.

2024-12-09 02:55:18 +00:00

class-wp-theme.php

Docs/Bundled Themes: Add @since annotation for introduction of TT5.

2024-10-07 22:28:15 +00:00

class-wp-token-map.php

HTML API: Add PHP type annotations.

2024-07-19 23:44:16 +00:00

class-wp-user-meta-session-tokens.php

…

class-wp-user-query.php

Docs: Add missing single quote in WP_User_Query::prepare_query() DocBlock.

2024-12-19 10:24:23 +00:00

class-wp-user-request.php

…

class-wp-user.php

…

class-wp-walker.php

General: Cast $max_depth and $depth to an integer in the Walker class.

2024-07-26 07:56:13 +00:00

class-wp-widget-factory.php

…

class-wp-widget.php

Docs: Add missing void to DocBlock @return types.

2024-11-02 15:01:19 +00:00

class-wp-xmlrpc-server.php

Coding Standards: Use strict comparison in wp_xmlrpc_server::mw_editPost().

2025-01-28 22:45:21 +00:00

class-wp.php

Canonical: Revert redirect when front page's paginated states not found.

2024-09-30 18:18:16 +00:00

class-wpdb.php

General: Expand use of wp_get_wp_version().

2024-10-03 00:25:15 +00:00

class.wp-dependencies.php

…

class.wp-scripts.php

…

class.wp-styles.php

…

comment-template.php

Coding Standards: Use strict comparison in wp-includes/comment-template.php.

2024-12-08 23:43:21 +00:00

comment.php

Options/Meta APIs: Document type juggling of meta data.

2025-01-17 00:12:26 +00:00

compat.php

Coding Standards: Explicitly return null instead of coercing void.

2024-11-22 19:19:20 +00:00

cron.php

Options, Meta APIs: Explicitly pass $autoload parameter to when potentially adding new options.

2024-09-03 18:19:14 +00:00

date.php

…

default-constants.php

Bundled Themes: Initial import of the Twenty Twenty-Five default theme.

2024-09-30 23:58:16 +00:00

default-filters.php

Security: Enable the referrer policy header on the login screen.

2025-01-27 14:41:22 +00:00

default-widgets.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

deprecated.php

Editor: Update docblocks for wp_get_global_stylesheet and WP_Theme_JSON::get_stylesheet.

2024-12-09 02:55:18 +00:00

embed-template.php

…

embed.php

Posts, Post Types: Embeds: Add new embeddable argument to post types.

2025-01-24 13:32:21 +00:00

error-protection.php

…

feed-atom-comments.php

…

feed-atom.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

feed-rdf.php

…

feed-rss2-comments.php

…

feed-rss2.php

…

feed-rss.php

…

feed.php

Feeds: Avoid fatal error with empty blog_charset value.

2024-11-11 17:50:17 +00:00

fonts.php

Editor: Update Google Fonts API endpoint for WordPress 6.7.

2024-10-23 22:39:17 +00:00

formatting.php

Formatting: Check the result of preg_split() in convert_smilies().

2024-12-14 23:53:24 +00:00

functions.php

Security: Always include the no-store and private directives in the Cache-Control header when setting headers that prevent caching.

2025-01-28 23:22:22 +00:00

functions.wp-scripts.php

…

functions.wp-styles.php

…

general-template.php

General: Get rid of title attributes used by get_calendar().

2025-01-26 22:22:24 +00:00

global-styles-and-settings.php

Editor: Update docblocks for wp_get_global_stylesheet and WP_Theme_JSON::get_stylesheet.

2024-12-09 02:55:18 +00:00

http.php

Tests: Use better domain for HTTP API invalid hostname test.

2024-10-27 19:05:18 +00:00

https-detection.php

Site Health: Remove use of deprecated function from wp_is_https_supported().

2024-12-16 14:08:24 +00:00

https-migration.php

…

kses.php

Formatting: Preserve target="_blank" in Biographical Info and Category Description.

2025-01-21 22:59:18 +00:00

l10n.php

Coding Standards: Add missing global variable in determine_locale() docblock.

2025-01-28 09:46:29 +00:00

link-template.php

Posts, Post Types: Remove title attribute from the_shortlink().

2025-01-24 23:00:22 +00:00

load.php

Networks and Sites: Relocate defintion of absint().

2024-10-15 23:41:16 +00:00

locale.php

…

media-template.php

General: Remove noopener from links opening in a new tab.

2024-09-30 05:19:16 +00:00

media.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

meta.php

Options/Meta APIs: Document type juggling of meta data.

2025-01-17 00:12:26 +00:00

ms-blogs.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

ms-default-constants.php

…

ms-default-filters.php

…

ms-deprecated.php

…

ms-files.php

Upload: Remove redundant check for ABSPATH in wp-admin/async-upload.php.

2025-01-16 16:18:24 +00:00

ms-functions.php

Coding Standards: Replace loose comparison in wpmu_welcome_notification().

2025-01-04 10:27:21 +00:00

ms-load.php

…

ms-network.php

…

ms-settings.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

ms-site.php

Options/Meta APIs: Document type juggling of meta data.

2025-01-17 00:12:26 +00:00

nav-menu-template.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

nav-menu.php

Menus: Check if taxonomy term exists in wp_update_nav_menu_item().

2024-08-05 19:00:19 +00:00

option.php

Options/Meta APIs: Optimize cache hits for non-existent options.

2025-01-15 22:13:24 +00:00

pluggable-deprecated.php

…

pluggable.php

Docs: Correct a translator comment that was added in [59578].

2025-01-14 11:38:24 +00:00

plugin.php

…

post-formats.php

…

post-template.php

Themes: Add wp-theme-<name> and wp-child-theme-<name> classes to body_class.

2025-01-24 10:58:24 +00:00

post-thumbnail-template.php

Docs: Update parameter type hints to include null for post thumbnail functions.

2024-12-20 23:35:23 +00:00

post.php

Posts, Post Types: Embeds: Add new embeddable argument to post types.

2025-01-24 13:32:21 +00:00

query.php

…

registration-functions.php

…

registration.php

…

rest-api.php

REST API: Remove trailing slashes when preloading requests and there is a query string.

2024-11-25 10:10:17 +00:00

revision.php

Revisions: Use WP_Query in wp_get_post_autosave.

2025-01-27 23:07:23 +00:00

rewrite.php

Docs: The $feedname parameter in add_feed() should not start with an underscore.

2024-09-18 19:08:11 +00:00

robots-template.php

…

rss-functions.php

…

rss.php

Code Modernization: Remove xml_set_object() in MagpieRSS::__construct().

2024-09-18 21:40:12 +00:00

script-loader.php

Media: improve error messages for unsupported uploads.

2025-01-07 22:53:22 +00:00

script-modules.php

Docs: Fix typos in a comment in wp_default_script_modules().

2024-10-13 18:49:16 +00:00

session.php

…

shortcodes.php

…

sitemaps.php

…

spl-autoload-compat.php

…

style-engine.php

…

taxonomy.php

Options/Meta APIs: Document type juggling of meta data.

2025-01-17 00:12:26 +00:00

template-canvas.php

…

template-loader.php

…

template.php

…

theme-i18n.json

I18N: Update theme.json i18n schema with latest changes from Gutenberg.

2025-01-08 12:36:23 +00:00

theme-previews.php

…

theme-templates.php

Themes: Add an ID to the block theme skip link.

2024-12-23 23:03:30 +00:00

theme.json

…

theme.php

Options, Meta APIs: Explicitly pass $autoload parameter to when potentially adding new options.

2024-09-03 18:19:14 +00:00

update.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

user.php

Options/Meta APIs: Document type juggling of meta data.

2025-01-17 00:12:26 +00:00

vars.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00

version.php

Security: Always include the no-store and private directives in the Cache-Control header when setting headers that prevent caching.

2025-01-28 23:22:22 +00:00

widgets.php

Docs: Various Docblock fixes in wp-includes/widgets.php, as per WP Docs standards;

2025-01-24 21:20:23 +00:00

wp-db.php

…

wp-diff.php

General: Stop direct loading of files in /wp-includes that should only be included.

2025-01-22 19:48:25 +00:00