Gary Pendergast 722f25cd97 KSES: Allow the download attribute on <a> tags. ...

To avoid this being a vector for bypassing the filetypes that are allowed to be uploaded, this attribute is only allowed to be added without a value.

Props kalpshit, arshidkv12, welcher, peterwilsoncc, marina_wp, pento.
See #44724.


Built from https://develop.svn.wordpress.org/branches/5.0@43813


git-svn-id: http://core.svn.wordpress.org/branches/5.0@43642 1a063a9b-81f0-0310-95a4-ce76da25c4cd

2018-10-24 01:19:39 +00:00

..

blocks

…

certificates

…

css

…

customize

…

fonts

…

ID3

…

images

…

IXR

…

js

…

pomo

…

random_compat

…

Requests

…

rest-api

…

SimplePie

…

Text

…

theme-compat

…

widgets

…

admin-bar.php

…

atomlib.php

…

author-template.php

…

blocks.php

…

bookmark-template.php

…

bookmark.php

…

cache.php

…

canonical.php

…

capabilities.php

…

category-template.php

…

category.php

…

class-feed.php

…

class-http.php

…

class-IXR.php

…

class-json.php

…

class-oembed.php

Embeds: Filter HTML response in oEmbed proxy controller.

2018-10-23 17:48:39 +00:00

class-phpass.php

…

class-phpmailer.php

…

class-pop3.php

…

class-requests.php

…

class-simplepie.php

…

class-smtp.php

…

class-snoopy.php

…

class-walker-category-dropdown.php

…

class-walker-category.php

…

class-walker-comment.php

…

class-walker-nav-menu.php

…

class-walker-page-dropdown.php

…

class-walker-page.php

…

class-wp-admin-bar.php

…

class-wp-ajax-response.php

…

class-wp-block-parser.php

…

class-wp-block-type-registry.php

…

class-wp-block-type.php

…

class-wp-comment-query.php

…

class-wp-comment.php

…

class-wp-customize-control.php

…

class-wp-customize-manager.php

…

class-wp-customize-nav-menus.php

…

class-wp-customize-panel.php

…

class-wp-customize-section.php

…

class-wp-customize-setting.php

…

class-wp-customize-widgets.php

…

class-wp-dependency.php

…

class-wp-editor.php

…

class-wp-embed.php

…

class-wp-error.php

…

class-wp-feed-cache-transient.php

…

class-wp-feed-cache.php

…

class-wp-hook.php

…

class-wp-http-cookie.php

…

class-wp-http-curl.php

…

class-wp-http-encoding.php

…

class-wp-http-ixr-client.php

…

class-wp-http-proxy.php

…

class-wp-http-requests-hooks.php

…

class-wp-http-requests-response.php

…

class-wp-http-response.php

…

class-wp-http-streams.php

…

class-wp-image-editor-gd.php

…

class-wp-image-editor-imagick.php

…

class-wp-image-editor.php

…

class-wp-list-util.php

…

class-wp-locale-switcher.php

…

class-wp-locale.php

…

class-wp-matchesmapregex.php

…

class-wp-meta-query.php

…

class-wp-metadata-lazyloader.php

…

class-wp-network-query.php

…

class-wp-network.php

…

class-wp-oembed-controller.php

Embeds: Filter HTML response in oEmbed proxy controller.

2018-10-23 17:48:39 +00:00

class-wp-post-type.php

…

class-wp-post.php

…

class-wp-query.php

…

class-wp-rewrite.php

…

class-wp-role.php

…

class-wp-roles.php

…

class-wp-session-tokens.php

…

class-wp-simplepie-file.php

…

class-wp-simplepie-sanitize-kses.php

…

class-wp-site-query.php

…

class-wp-site.php

…

class-wp-tax-query.php

…

class-wp-taxonomy.php

…

class-wp-term-query.php

…

class-wp-term.php

…

class-wp-text-diff-renderer-inline.php

…

class-wp-text-diff-renderer-table.php

…

class-wp-theme.php

Bundled Theme: Make twentynineteen the default theme.

2018-10-23 16:51:39 +00:00

class-wp-user-meta-session-tokens.php

…

class-wp-user-query.php

…

class-wp-user.php

…

class-wp-walker.php

…

class-wp-widget-factory.php

…

class-wp-widget.php

…

class-wp-xmlrpc-server.php

…

class-wp.php

…

class.wp-dependencies.php

…

class.wp-scripts.php

…

class.wp-styles.php

…

comment-template.php

…

comment.php

…

compat.php

…

cron.php

…

date.php

…

default-constants.php

Bundled Theme: Make twentynineteen the default theme.

2018-10-23 16:51:39 +00:00

default-filters.php

Styles: Add helper functions for loading block styles.

2018-10-24 00:36:39 +00:00

default-widgets.php

…

deprecated.php

…

embed-template.php

…

embed.php

Embeds: Filter HTML response in oEmbed proxy controller.

2018-10-23 17:48:39 +00:00

feed-atom-comments.php

…

feed-atom.php

…

feed-rdf.php

…

feed-rss2-comments.php

…

feed-rss2.php

…

feed-rss.php

…

feed.php

…

formatting.php

…

functions.php

…

functions.wp-scripts.php

…

functions.wp-styles.php

…

general-template.php

…

http.php

…

kses.php

KSES: Allow the download attribute on <a> tags.

2018-10-24 01:19:39 +00:00

l10n.php

…

link-template.php

…

load.php

…

locale.php

…

media-template.php

…

media.php

…

meta.php

…

ms-blogs.php

…

ms-default-constants.php

…

ms-default-filters.php

…

ms-deprecated.php

…

ms-files.php

…

ms-functions.php

…

ms-load.php

…

ms-settings.php

…

nav-menu-template.php

…

nav-menu.php

…

option.php

…

pluggable-deprecated.php

…

pluggable.php

…

plugin.php

…

post-formats.php

…

post-template.php

…

post-thumbnail-template.php

…

post.php

…

query.php

…

registration-functions.php

…

registration.php

…

rest-api.php

…

revision.php

…

rewrite.php

…

rss-functions.php

…

rss.php

…

script-loader.php

Styles: Add helper functions for loading block styles.

2018-10-24 00:36:39 +00:00

session.php

…

shortcodes.php

…

spl-autoload-compat.php

…

taxonomy.php

…

template-loader.php

…

template.php

…

theme.php

…

update.php

…

user.php

…

vars.php

…

version.php

KSES: Allow the download attribute on <a> tags.

2018-10-24 01:19:39 +00:00

widgets.php

…

wlwmanifest.xml

…

wp-db.php

…

wp-diff.php

…