Gary Pendergast aec6946594 Database: Restore numbered placeholders in wpdb::prepare(). ...

[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.

This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.

Merges [41662], [42056] to the 4.4 branch.
See #41925.


Built from https://develop.svn.wordpress.org/branches/4.4@42061


git-svn-id: http://core.svn.wordpress.org/branches/4.4@41890 1a063a9b-81f0-0310-95a4-ce76da25c4cd

2017-10-31 12:46:31 +00:00

..

certificates

HTTP: Partially revert [34283] which removed the 1024bit certificates from our trust store.

2015-12-14 05:25:26 +00:00

css

Media: Reset box-sizing for input elements in the entire media modal.

2015-11-18 23:36:28 +00:00

customize

Customize: Ensure that "Change" button appears when there are only 2 themes.

2015-12-23 01:51:22 +00:00

fonts

…

ID3

…

images

Embeds: Revert [35083], as the PNG files ended up not being used in [35466].

2015-10-31 04:42:25 +00:00

js

TinyMCE: Improve the previews for shortcodes.

2017-09-19 12:43:37 +00:00

pomo

Merge the changes to GlotPress's POMO from upstream to WordPress's copy.

2015-11-20 04:34:25 +00:00

random_compat

Random_Compat: The version included with 4.4 only supports the PHP 5.2+ namespace version of libsodium, don't attempt to use it with PHP 5.2 or old libsodium versions.

2016-01-11 04:38:28 +00:00

rest-api

REST API: Core typically sends nocache headers on all auth'ed responses, as in wp, admin-ajax, etc. Because the REST API infrastructure is hooked in pre-wp, we should be setting this ourselves.

2015-12-04 23:36:25 +00:00

SimplePie

Feeds: add CEST to $timezone in SimplePie_Parse_Date.

2015-10-20 05:57:24 +00:00

Text

Fix the @author doc param encoding in Text/Diff/Engine/string so the file is recognized as UTF-8, not ISO-8859-1.

2015-10-24 22:45:25 +00:00

theme-compat

Don't use <a> in translatable strings in theme-compat/sidebar.php.

2015-10-30 10:40:26 +00:00

widgets

Widgets: Remove extra quotes from widget title in WP_Widget_RSS, accidentally added in [33814].

2015-12-23 02:00:23 +00:00

admin-bar.php

Do not pass FALSE as second parameter in variable class_exists() checks

2015-11-30 04:15:27 +00:00

atomlib.php

…

author-template.php

Remove <code> tag from translatable string in the_author().

2015-11-05 23:38:27 +00:00

bookmark-template.php

…

bookmark.php

After [35718], update the location of some files in This filter is documented in docs.

2015-11-22 03:51:28 +00:00

cache.php

Filesystem: Following the introduction of the KB|MB|GB|TB_IN_BYTES constants in [35286], use them in various places in core.

2015-10-21 14:03:25 +00:00

canonical.php

Canonical: introduce strip_fragment_from_url() and use when comparing URLs in redirect_canonical().

2015-12-04 23:11:26 +00:00

capabilities.php

When a post is scheduled for publication, treat it the same as a published post when calculating the capabilities required to edit or delete it.

2015-11-29 02:27:18 +00:00

category-template.php

Ensure that wp_list_categories() supports comma-separated lists for 'exclude' and 'exclude_tree'.

2015-12-18 18:14:21 +00:00

category.php

Simplify the include graph after work to split out classes.

2015-11-20 07:24:30 +00:00

class-feed.php

…

class-http.php

Docs: Syntax fixes for deprecating WP_Http::parse_url().

2015-10-23 15:43:24 +00:00

class-IXR.php

XMLRPC: Revert [35509] which caused a change of behviour in at least one XMLRPC client.

2015-12-31 04:07:22 +00:00

class-json.php

…

class-oembed.php

General: Backport PHP 7.1 fixes to the 4.4 branch to avoid fatal errors and warnings.

2017-07-24 22:27:31 +00:00

class-phpass.php

…

class-phpmailer.php

Update PHPMailer to 5.2.22.

2017-01-11 05:24:00 +00:00

class-pop3.php

…

class-simplepie.php

…

class-smtp.php

Update PHPMailer to 5.2.22.

2017-01-11 05:24:00 +00:00

class-snoopy.php

Snoopy: use escapeshellarg instead of escapeshellcmd

2016-03-30 14:03:28 +00:00

class-walker-category-dropdown.php

…

class-walker-category.php

Taxonomy: in wp_list_categories(), add an arg: separator, to allow the overriding of <br/>.

2015-10-13 17:02:25 +00:00

class-walker-comment.php

Docs: some @global object vernaculars should be converted to the actual object type.

2015-10-10 15:45:25 +00:00

class-walker-page-dropdown.php

…

class-walker-page.php

…

class-wp-admin-bar.php

Docs: Add missing file headers to two Toolbar API files: wp-includes/admin-bar.php and wp-includes/class-wp-admin-bar.php.

2015-10-14 17:27:25 +00:00

class-wp-ajax-response.php

…

class-wp-comment-query.php

Comments: Respect all post-related filters in WP_Comment_Query.

2016-01-20 08:02:26 +00:00

class-wp-comment.php

…

class-wp-customize-control.php

Customize: move WP_Customize_Control subclasses to wp-includes/customize, they load in the exact same place.

2015-10-24 18:57:25 +00:00

class-wp-customize-manager.php

Customize: Ensure valid themes in the preview.

2017-09-19 11:52:37 +00:00

class-wp-customize-nav-menus.php

Customizer: Use correct context and translator comments for menu location strings.

2015-11-20 17:46:25 +00:00

class-wp-customize-panel.php

Customize: move WP_Customize_Panel subclass to wp-includes/customize, it loads in the exact same place.

2015-10-24 18:25:24 +00:00

class-wp-customize-section.php

Customize: move WP_Customize_Section subclasses to wp-includes/customize, they load in the exact same place.

2015-10-24 18:21:25 +00:00

class-wp-customize-setting.php

Customize: Ensure that a setting (especially a multidimensional one) can still be previewed when the post value to preview is set after preview() is invoked.

2015-11-21 02:52:27 +00:00

class-wp-customize-widgets.php

Customize: Ensure that a setting (especially a multidimensional one) can still be previewed when the post value to preview is set after preview() is invoked.

2015-11-21 02:52:27 +00:00

class-wp-editor.php

Correct the parameter type for the $stylesheet parameter in the mce_css filter documentation.

2015-11-18 17:07:37 +00:00

class-wp-embed.php

Embeds: Remove the allow_insecure_embeds filter.

2015-11-19 05:02:27 +00:00

class-wp-error.php

…

class-wp-http-cookie.php

…

class-wp-http-curl.php

…

class-wp-http-encoding.php

…

class-wp-http-ixr-client.php

…

class-wp-http-proxy.php

…

class-wp-http-response.php

HTTP/REST API: move WP_HTTP_Response to wp-includes/ with the rest (ha!) of the HTTP classes. This is PHP 5.2, so this class is global, and as per @rmccue, unrelated to REST specifically.

2015-10-08 19:27:28 +00:00

class-wp-http-streams.php

…

class-wp-image-editor-gd.php

Media: add a new image size, medium_large. Bumps db version to add new options.

2015-10-31 20:50:25 +00:00

class-wp-image-editor-imagick.php

Media: add a new image size, medium_large. Bumps db version to add new options.

2015-10-31 20:50:25 +00:00

class-wp-image-editor.php

…

class-wp-meta-query.php

Docs: Add missing descriptions for the $wpdb global in DocBlocks all the places.

2015-10-14 23:44:25 +00:00

class-wp-network.php

Multisite: Clarify documentation for WP_Network::get_by_path().

2015-11-08 02:25:25 +00:00

class-wp-oembed-controller.php

oEmbed: Drop the trailing slash from the namespace.

2015-11-17 11:27:29 +00:00

class-wp-post.php

Docs: Add missing descriptions for the $wpdb global in DocBlocks all the places.

2015-10-14 23:44:25 +00:00

class-wp-rewrite.php

Docs: Add a couple of strategically-placed spaces in WP_Rewrite.

2015-10-08 22:07:24 +00:00

class-wp-role.php

…

class-wp-roles.php

Docs: Add missing descriptions for the $wpdb global in DocBlocks all the places.

2015-10-14 23:44:25 +00:00

class-wp-tax-query.php

…

class-wp-term.php

Make get_term() behave more consistently in the context of shared terms.

2015-11-05 16:45:25 +00:00

class-wp-theme.php

Themes: Fix markup for theme name fallbacks.

2017-01-11 11:10:35 +00:00

class-wp-user-query.php

Correct documentation for 'fields' param of WP_User_Query.

2015-11-16 19:04:55 +00:00

class-wp-user.php

Docs: Move an inline comment that was preventing the hook docs for the user_has_cap filter from being parsed.

2015-11-10 06:45:25 +00:00

class-wp-walker.php

Avoid a PHP notice when trying to access the post_parent property of hierarchical post type nav menu items.

2015-12-21 03:53:25 +00:00

class-wp-widget-factory.php

…

class-wp-widget.php

Widgets: when getting settings, and none exist, set them to empty to avoid extraneous database queries on subsequent requests.

2015-10-13 01:13:24 +00:00

class-wp-xmlrpc-server.php

Adjust post meta checks

2017-05-16 08:51:31 +00:00

class-wp.php

In WP::handle_404(), make sure $wp_query->post is a WP_Post object before cloning it.

2015-12-23 01:42:25 +00:00

class.wp-dependencies.php

…

class.wp-scripts.php

…

class.wp-styles.php

…

comment-template.php

Comments: Ignore hierarchy in pagination calculation when comment threading is disabled.

2016-01-20 08:32:27 +00:00

comment.php

Comments: Ensure only approved comments trigger post author notifications

2016-01-02 03:35:21 +00:00

compat.php

Use PHP7's random_int() CSPRNG functionality in wp_rand() with a fallback to the random_compat library for PHP 5.x.

2015-10-09 04:28:24 +00:00

cron.php

…

date.php

Ensure that WP_Date_Query accepts a value of 0 for 'hour'.

2015-10-09 16:33:25 +00:00

default-constants.php

Set Twenty Sixteen as the default theme.

2015-11-25 21:52:26 +00:00

default-filters.php

Embeds: Improve performance when embedding a post from the current site.

2016-06-21 14:42:29 +00:00

default-widgets.php

…

deprecated.php

Template: Un-deprecate wp_title().

2015-11-11 23:50:25 +00:00

embed-template.php

Embeds: Change attachment metadata condition to prevent a warning in the embeds template.

2016-01-02 03:36:21 +00:00

embed.php

oEmbed: Add extra hardening around allowed HTML for improved sandboxing.

2017-09-19 13:51:01 +00:00

feed-atom-comments.php

Themes: Improve document title output.

2015-10-20 16:21:25 +00:00

feed-atom.php

Feeds: <comments> is optional in RSS2, so don't include it when comments aren't present or open. Same for <wfw:commentRss> and <slash:comments>

2015-11-04 17:47:25 +00:00

feed-rdf.php

Themes: Improve document title output.

2015-10-20 16:21:25 +00:00

feed-rss2-comments.php

Themes: Improve document title output.

2015-10-20 16:21:25 +00:00

feed-rss2.php

Feeds: <comments> is optional in RSS2, so don't include it when comments aren't present or open. Same for <wfw:commentRss> and <slash:comments>

2015-11-04 17:47:25 +00:00

feed-rss.php

Themes: Improve document title output.

2015-10-20 16:21:25 +00:00

feed.php

Use correct placeholders for translator comments added in [35303].

2015-10-24 18:50:24 +00:00

formatting.php

Media: Improve handling of extensionless filenames.

2016-06-21 14:53:31 +00:00

functions.php

Media: Fix exif_imagetype check in wp_get_image_mime

2017-01-11 16:42:31 +00:00

functions.wp-scripts.php

…

functions.wp-styles.php

…

general-template.php

Template: Always display the site title on the front page.

2016-01-04 17:19:27 +00:00

http.php

HTTP: Improve detection of valid IP addresses.

2016-03-30 15:51:26 +00:00

kses.php

Media: In wp_read_image_metadata() make sure that IPTC keywords are UTF8 encoded.

2016-02-01 14:58:28 +00:00

l10n.php

…

link-template.php

Canonical: Output correct canonical links for paged posts when not using pretty permalinks.

2015-12-27 02:12:23 +00:00

load.php

Multisite: The networks group should be global.

2016-01-11 05:06:27 +00:00

locale.php

Revert [35336] and [35337].

2015-11-18 20:30:25 +00:00

media-template.php

Accessibility: add missing alt attributes to a gaggle of <img>s.

2015-11-07 16:12:27 +00:00

media.php

Responsive images: fix the check whether the attachment meta matches the image src to work with http/https and CDNs.

2016-01-02 03:56:22 +00:00

meta.php

After [35718], update the location of some files in This filter is documented in docs.

2015-11-22 03:51:28 +00:00

ms-blogs.php

Multisite: Add the global cache group networks to restore_current_blog().

2016-01-27 13:48:27 +00:00

ms-default-constants.php

Docs: Add missing descriptions for the $wpdb global in DocBlocks all the places.

2015-10-14 23:44:25 +00:00

ms-default-filters.php

…

ms-deprecated.php

Docs: Add missing descriptions for the $wpdb global in DocBlocks all the places.

2015-10-14 23:44:25 +00:00

ms-files.php

…

ms-functions.php

Multisite: Use wp_rand() in signup key creation.

2017-01-11 05:34:02 +00:00

ms-load.php

I18N: Move translatable Codex URLs to separate strings in wp-includes/ms-load.php.

2015-11-18 17:42:26 +00:00

ms-settings.php

…

nav-menu-template.php

Menus: Bring back line break between menu items.

2015-12-24 00:26:22 +00:00

nav-menu.php

Don't use <strong> in translatable string in wp-includes/nav-menu.php.

2015-10-30 08:57:26 +00:00

option.php

Rename internal variable in set_transient().

2015-10-29 11:52:28 +00:00

pluggable-deprecated.php

…

pluggable.php

Strip control characters before validating redirect.

2017-03-06 13:43:31 +00:00

plugin.php

…

post-formats.php

…

post-template.php

Admin: Escape attachment name in case it contains special characters

2016-06-21 14:24:27 +00:00

post-thumbnail-template.php

Docs: Adjust documentation for the $size parameter in the_post_thumbnail_url() to clarify the required order of width and height values when passing an array.

2015-10-12 17:00:26 +00:00

post.php

Database: Restore numbered placeholders in wpdb::prepare().

2017-10-31 12:46:31 +00:00

query.php

Query: Ensure that queries work correctly with post type names with special characters.

2017-01-26 13:51:03 +00:00

registration-functions.php

…

registration.php

…

rest-api.php

Simplify the include graph after work to split out classes.

2015-11-20 07:24:30 +00:00

revision.php

Docs: Correct description for _wp_post_revision_fields() arguments.

2015-10-22 12:17:28 +00:00

rewrite.php

Simplify the include graph after work to split out classes.

2015-11-20 07:24:30 +00:00

rss-functions.php

…

rss.php

…

script-loader.php

TinyMCE: Improve the previews for shortcodes.

2017-09-19 12:43:37 +00:00

session.php

…

shortcodes.php

Shortcodes: = is a reserved character in shortcode names, mark it as such.

2015-12-26 04:48:23 +00:00

taxonomy.php

Taxonomies: make sure taxonomy functions work correctly with taxonomy names with special characters

2016-03-30 17:17:28 +00:00

template-loader.php

…

template.php

List the possible values for the dynamic portion of the {type}_template hook.

2015-10-28 14:06:27 +00:00

theme.php

Upgrade: New themes are not automatically installed on upgrade. This can still be explicitly asked for by defining CORE_UPGRADE_SKIP_NEW_BUNDLED as false.

2015-11-25 21:45:25 +00:00

update.php

Background Updates: Remove the 7am/7pm background update check.

2016-01-06 13:24:33 +00:00

user.php

General: Backport PHP 7.1 fixes to the 4.4 branch to avoid fatal errors and warnings.

2017-07-24 22:27:31 +00:00

vars.php

…

version.php

Bump 4.4 branch to version 4.4.11.

2017-09-19 20:02:00 +00:00

widgets.php

Widgets: Revert [34465], as it introduced a regression, making the $index argument of dynamic_sidebar() case-sensitive.

2016-01-02 03:39:21 +00:00

wlwmanifest.xml

…

wp-db.php

Database: Restore numbered placeholders in wpdb::prepare().

2017-10-31 12:46:31 +00:00

wp-diff.php

…