WordPress/wp-includes
whyisjake ee92e93f79 Ensure that a user can publish_posts before making a post sticky.
Props: danielbachhuber, whyisjake, peterwilson, xknown.
Prevent  stored XSS through wp_targeted_link_rel().
Props: vortfu, whyisjake, peterwilsoncc, xknown,  SergeyBiryukov, flaviozavan.
Update wp_kses_bad_protocol() to recognize : on uri attributes,
wp_kses_bad_protocol() makes sure to validate that uri attributes don't contain invalid/or not allowed protocols. While this works fine in most cases, there's a risk that by using the colon html5 named entity, one is able to bypass this function.
Brings r46895 to the 5.3 branch.
Props: xknown, nickdaugherty, peterwilsoncc.
Prevent stored XSS in the block editor.
Brings r46896 to the 5.3 branch.
Prevent escaped unicode characters become unescaped in unsafe HTML during JSON decoding.
Props: aduth, epiqueras.


Built from https://develop.svn.wordpress.org/branches/5.0@46915


git-svn-id: http://core.svn.wordpress.org/branches/5.0@46715 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2019-12-12 18:52:47 +00:00
..
2019-09-04 22:06:41 +00:00
2016-12-03 03:30:42 +00:00
2017-01-11 01:23:41 +00:00
2017-10-16 22:29:48 +00:00
2019-10-14 18:26:51 +00:00
2019-10-14 18:26:51 +00:00
2019-10-14 18:26:51 +00:00
2016-12-03 04:16:38 +00:00
2019-10-14 18:26:51 +00:00
2019-10-14 18:26:51 +00:00
2016-12-03 03:51:41 +00:00
2019-10-14 20:08:38 +00:00