This partially reverts [35738], which has shown to provide a bad user experience for users seeking to experiment with TwentySeventeen.
This will result in TwentySixteen being installed in addition to TwentySeventeen.
See #38551.
git-svn-id: https://develop.svn.wordpress.org/trunk@39064 602fd350-edb4-49c9-b593-d223f7449a82
Previously a user could remove a protected meta field by using their browser developer tools to alter the form field properties in the Custom Fields meta box, given that they know the ID of the protected meta field. This change prevents this by preventing any change to a protected meta field, including changing its key.
Props ajoah, johnbillion, peterwilsoncc
Fixes#38293
git-svn-id: https://develop.svn.wordpress.org/trunk@39062 602fd350-edb4-49c9-b593-d223f7449a82
In #38586 the ability to parse arrays as csv was introduced, however it didn't add any support for validating csv arrays. This adds such sanitization, and also a good amount of unit tests for all sanitization baed off schema.
See #38586.
git-svn-id: https://develop.svn.wordpress.org/trunk@39061 602fd350-edb4-49c9-b593-d223f7449a82
Allow history to be manipulated before DOM ready by sourcing state params from the current URL instead of from the `wp.customize.settings` object, since they will be the same anyway. This fixes a JS error since `wp.customize.settings` is not defined before DOM ready.
Amends [38810].
See #30937.
Fixes#38592.
git-svn-id: https://develop.svn.wordpress.org/trunk@39060 602fd350-edb4-49c9-b593-d223f7449a82
Previously Settings only supported "number" which meant it was possible to push floats to things like posts_per_page. This means now developers can also specify `type => ineger` in meta nad settings resgration.
Props flixos90.
Fixes#38393.
git-svn-id: https://develop.svn.wordpress.org/trunk@39058 602fd350-edb4-49c9-b593-d223f7449a82
Introduced in [37572]. The correct 'get_terms_args' filter call is in
`WP_Term_Query::get_terms()`.
Props Tkama.
Fixes#38589.
git-svn-id: https://develop.svn.wordpress.org/trunk@39057 602fd350-edb4-49c9-b593-d223f7449a82
After [39048], this changes explicitly parses the list of user roles as slugs, and adds tests.
Props jnylen0.
Fixes#38557.
git-svn-id: https://develop.svn.wordpress.org/trunk@39056 602fd350-edb4-49c9-b593-d223f7449a82
[39048] added CSV support to array types, this change explicitly parses term lists as IDs, and adds tests.
Props timmydcrawford, pento.
Fixes#38553.
git-svn-id: https://develop.svn.wordpress.org/trunk@39055 602fd350-edb4-49c9-b593-d223f7449a82
Adds a check for `window.addEventListener` support before attempting to use it. In browsers without support, the file is exited early to avoid throwing a JavaScript error.
Fixes#38585.
git-svn-id: https://develop.svn.wordpress.org/trunk@39050 602fd350-edb4-49c9-b593-d223f7449a82
The password field was incorrectly only added to "post" post types, but is supported for all post types in the Dashboard UI.
Props jnylen0.
Fixes#38582.
git-svn-id: https://develop.svn.wordpress.org/trunk@39047 602fd350-edb4-49c9-b593-d223f7449a82
By allowing more fine-grained validation and sanitisation of endpoint args, we can ensure the correct data is being passed to endpoints.
This can easily be extended to support new data types, such as CSV fields or objects.
Props joehoyle, rachelbaker, pento.
Fixes#38531.
git-svn-id: https://develop.svn.wordpress.org/trunk@39046 602fd350-edb4-49c9-b593-d223f7449a82
This prevents `wp_die()` being sent in response to an XML-RPC call that attempts to submit a duplicate comment, and correctly returns an error in response to an attempt to submit an empty comment.
Props markoheijnen, websupporter.
Fixes#14452, #38466.
See #36901
git-svn-id: https://develop.svn.wordpress.org/trunk@39045 602fd350-edb4-49c9-b593-d223f7449a82
This allows `POST` requests with a wider variety of `Content-Type' headers - `Content-Type: application/json`, for example.
Props jnylen0.
Fixes#37994.
git-svn-id: https://develop.svn.wordpress.org/trunk@39044 602fd350-edb4-49c9-b593-d223f7449a82
Editable resources in the REST API accept the `PATCH` method, but the CORS headers don't mention it.
Props jnylen0.
Fixes#38546.
git-svn-id: https://develop.svn.wordpress.org/trunk@39042 602fd350-edb4-49c9-b593-d223f7449a82
`get_user_option()` checks for both option types, site and network. Since `locale` is only a network option we can directly access the field via `WP_User`s magic getter.
Props johnjamesjacoby.
Fixes#38578.
git-svn-id: https://develop.svn.wordpress.org/trunk@39040 602fd350-edb4-49c9-b593-d223f7449a82
* Allow `WP_Customize_Nav_Menus::insert_auto_draft_post()` to take full post array to pass to `wp_insert_post()`, except for `post_status`. Require `post_title`.
* Ensure empty `post_name` gets explicitly set to slugified `post_title`.
* Explicitly allow only `post_type` and `post_title` params in `WP_Customize_Nav_Menus::ajax_insert_auto_draft_post()`.
* Use `wp_update_post()` instead of `wp_publish_post()` to ensure unique slugs are assigned to published auto-draft posts.
* Re-use `WP_Customize_Nav_Menus::insert_auto_draft_post()` when inserting stubs from starter content.
See #38114, #38013, #34923.
Fixes#38539.
git-svn-id: https://develop.svn.wordpress.org/trunk@39038 602fd350-edb4-49c9-b593-d223f7449a82
Dion Hulse
John Blackbourn
Joe Hoyle
Weston Ruter
Andrea Fercia
Boone Gorges
Gary Pendergast
Drew Jaynes
DrewAPicture
Peter Wilson
Ryan McCue
Rachel Baker
Dominik Schilling (ocean90)