sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
33,073 Commits 2 Branches 473 Tags 137 MiB
643499167c
Commit Graph

33073 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jonathan Desrosiers
643499167c WordPress 4.4.20. 
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@46516 602fd350-edb4-49c9-b593-d223f7449a82
 2019-10-14 20:11:31 +00:00
Jake Spurlock
3f12403dc8 Backporting several bug fixes. 
- Query: Remove the static query property.
- HTTP API: Protect against hex interpretation.
- Filesystem API: Prevent directory travelersals when creating new folders.
- Administration: Ensure that admin referer nonce is valid.
- REST API: Send a Vary: Origin header on GET requests.
- Customizer: Properly sanitize background images.

Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@46498 602fd350-edb4-49c9-b593-d223f7449a82
 2019-10-14 19:08:52 +00:00
Jake Spurlock
8ea3a07039 Add .nvmrc files to older versions of WordPress 
When jumping between branches, it would be nice to have the correct node version for the older versions of WordPress. Let's add .nvmrc files to these older branches for the supported versions.

Merges [46295] to the 4.4 branch.

Fixes #48140


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@46300 602fd350-edb4-49c9-b593-d223f7449a82
 2019-09-25 21:00:04 +00:00
Jonathan Desrosiers
91d2bb20ae WordPress 4.4.19. 
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@46038 602fd350-edb4-49c9-b593-d223f7449a82
 2019-09-04 21:20:31 +00:00
Jonathan Desrosiers
06968503f3 Fix for URL sanitization in wp_kses_bad_protocol_once(). 
Merges [45997] to the 4.4 branch.

Props irsdl, sstoqnov, whyisjake.

git-svn-id: https://develop.svn.wordpress.org/branches/4.4@46010 602fd350-edb4-49c9-b593-d223f7449a82
 2019-09-04 18:23:17 +00:00
Sergey Biryukov
fcffda2869 Improve handling the existing rel attribute in wp_rel_nofollow_callback(). 
Merges [45990] to the 4.4 branch.
Props xknown, sstoqnov.

git-svn-id: https://develop.svn.wordpress.org/branches/4.4@46001 602fd350-edb4-49c9-b593-d223f7449a82
 2019-09-04 17:56:42 +00:00
Sergey Biryukov
5182bb6ff0 Improve URL validation in wp_validate_redirect(). 
Merges [45971] to the 4.4 branch.
Props vortfu, whyisjake, peterwilsoncc.

git-svn-id: https://develop.svn.wordpress.org/branches/4.4@45981 602fd350-edb4-49c9-b593-d223f7449a82
 2019-09-04 17:12:11 +00:00
Jake Spurlock
dc2184e9b2 Remove _convert_urlencoded_to_entities() from the get_the_content() callback. 
Merges [45937] to the 4.4 branch.

Props vortfu, whyisjake, peterwilsoncc


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@45958 602fd350-edb4-49c9-b593-d223f7449a82
 2019-09-04 16:38:59 +00:00
Sergey Biryukov
c82c7fb8b6 Escape the output in wp_ajax_upload_attachment(). 
Merges [45936] to the 4.4 branch.
Props whyisjake, sstoqnov.

git-svn-id: https://develop.svn.wordpress.org/branches/4.4@45951 602fd350-edb4-49c9-b593-d223f7449a82
 2019-09-04 16:36:13 +00:00
John Blackbourn
52eb3fbe3a Build/Test tools: Backport the fixed tests for wp_normalize_path() from the 4.5 branch into 4.4. 
See #35996


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@45012 602fd350-edb4-49c9-b593-d223f7449a82
 2019-03-25 17:07:12 +00:00
John Blackbourn
25f1e5c54f Build/Test tools: Further trimming of CI jobs on the 4.4 branch. 
This removes the PHP 5.6 job which runs without an object cache in place as the likelihood of a change being backported that only breaks 5.6 environments without an object cache is small.

Merges [45010] into the 4.4 branch.

See #42387


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@45011 602fd350-edb4-49c9-b593-d223f7449a82
 2019-03-25 16:30:14 +00:00
John Blackbourn
6df4a18fee Build/Test tools: Switch npm dependency caching strategy on Travis CI. 
This switches to caching npm's local cache instead of `node_modules` in order to prevent issues caused by modules compiled using a different version of node.

Merges [44993] into the 4.4 branch.

See #46632


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@45001 602fd350-edb4-49c9-b593-d223f7449a82
 2019-03-25 00:58:34 +00:00
Gary Pendergast
5eac5cb951 WordPress 4.4.18 
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44878 602fd350-edb4-49c9-b593-d223f7449a82
 2019-03-13 01:30:17 +00:00
Sergey Biryukov
1600e3f6da Comments: Improve comment content filtering. 
Merges [44842] to the 4.4 branch.

git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44850 602fd350-edb4-49c9-b593-d223f7449a82
 2019-03-12 22:39:12 +00:00
Sergey Biryukov
b7387dfa26 Formatting: Improve rel="nofollow" handling in comments. 
Merges [44833] to the 4.4 branch.

git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44841 602fd350-edb4-49c9-b593-d223f7449a82
 2019-03-12 22:26:13 +00:00
Jeremy Felt
b9e2bd5a8b Bump 4.4 branch to version 4.4.17. 
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44083 602fd350-edb4-49c9-b593-d223f7449a82
 2018-12-13 02:12:52 +00:00
Gary Pendergast
c89bb38b9d Editor: Remove unwanted fields before saving posts. 
The `meta_input`, `file`, and `guid` fields are not intended to be updated through user input.

Merges [44047] to the 4.4 branch.



git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44062 602fd350-edb4-49c9-b593-d223f7449a82
 2018-12-13 01:48:36 +00:00
Peter Wilson
d93e052b68 Multisite: Validate activation links. 
Merges [44048] to the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44061 602fd350-edb4-49c9-b593-d223f7449a82
 2018-12-13 01:46:24 +00:00
Ian Dunn
0569f5592a KSES: Make the URI attributes DRY. 
This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.

Merges [44014] and [44017] to the `4.4` branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44035 602fd350-edb4-49c9-b593-d223f7449a82
 2018-12-13 00:58:21 +00:00
Peter Wilson
82651e0340 Multisite: Improve messaging for previously activated users. 
Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time.

Merges [44021] to the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44030 602fd350-edb4-49c9-b593-d223f7449a82
 2018-12-13 00:49:34 +00:00
Gary Pendergast
290e58884b KSES: Conditionally remove the <form> element from $allowedposttags. 
To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.

Merges [43994] to the 4.4 branch.



git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44003 602fd350-edb4-49c9-b593-d223f7449a82
 2018-12-12 23:35:11 +00:00
Jeremy Felt
5fa5872aa5 Media: Improve verification of MIME file types. 
Merges [43988] to the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@43995 602fd350-edb4-49c9-b593-d223f7449a82
 2018-12-12 23:13:21 +00:00
Aaron D. Campbell
e66ccb02cd Bump 4.4 branch to version 4.4.16 
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@43412 602fd350-edb4-49c9-b593-d223f7449a82
 2018-07-05 16:10:39 +00:00
John Blackbourn
3c2dcf0021 Media: Limit thumbnail file deletions to the same directory as the original file. 
Merges [43393] into the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@43398 602fd350-edb4-49c9-b593-d223f7449a82
 2018-07-05 14:56:26 +00:00
Aaron D. Campbell
39ae3931f2 Bump 4.4 branch to version 4.4.15 
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42938 602fd350-edb4-49c9-b593-d223f7449a82
 2018-04-03 20:27:28 +00:00
Dominik Schilling (ocean90)
112b3f76f1 Template: Make sure the version string is correctly escaped for use in attributes. 
Merge of [42893] to the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42922 602fd350-edb4-49c9-b593-d223f7449a82
 2018-04-03 16:05:50 +00:00
Dominik Schilling (ocean90)
da1678ed50 Login: Use wp_safe_redirect() when redirecting the login page if forced to use HTTPS. 
Merge of [42892] to the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42900 602fd350-edb4-49c9-b593-d223f7449a82
 2018-04-03 15:28:50 +00:00
Sergey Biryukov
76b5dc7950 General: Update copyright year to 2018 in license.txt. 
Props rachelbaker.
Merges [42424] to the 4.4 branch.
Fixes #43007.

git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42557 602fd350-edb4-49c9-b593-d223f7449a82
 2018-01-23 11:25:50 +00:00
Dion Hulse
ea3d4e7cb5 Bump the 4.4 branch to 4.4.14. 
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42499 602fd350-edb4-49c9-b593-d223f7449a82
 2018-01-16 21:40:51 +00:00
Dion Hulse
676b0f9ea3 External Libraries: Remove unnecessary / obsoleted MediaElement.js files. 
Merges [42478] to the 4.4 branch.
Fixes #42720 for 4.4.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42482 602fd350-edb4-49c9-b593-d223f7449a82
 2018-01-16 08:08:20 +00:00
Dion Hulse
711b833087 Upgrade: When deleting old files, if deletion fails attempt to empty the file instead. 
Props joemcgill, dd32.
Merges [42434] to the 4.4 branch.
Fixes #42963 for 4.4.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42470 602fd350-edb4-49c9-b593-d223f7449a82
 2018-01-16 06:54:44 +00:00
John Blackbourn
06ce00cf68 Bump 4.4 branch to version 4.4.13. 
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42321 602fd350-edb4-49c9-b593-d223f7449a82
 2017-11-29 19:00:08 +00:00
John Blackbourn
5af11cbd7d Hardening: Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability. 
Merges [42261] to the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42287 602fd350-edb4-49c9-b593-d223f7449a82
 2017-11-29 16:28:05 +00:00
John Blackbourn
68a5d321f5 Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds. 
Merges [42260] to the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42286 602fd350-edb4-49c9-b593-d223f7449a82
 2017-11-29 16:27:19 +00:00
John Blackbourn
b6548aecc7 Hardening: Add escaping to the language attributes used on html elements. 
Merges [42259] to the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42285 602fd350-edb4-49c9-b593-d223f7449a82
 2017-11-29 16:26:49 +00:00
John Blackbourn
9292420e68 Hardening: Use a properly generated hash for the newbloguser key instead of a determinate substring. 
Merges [42258] to the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42284 602fd350-edb4-49c9-b593-d223f7449a82
 2017-11-29 16:26:15 +00:00
Dion Hulse
23a4b44d35 WPDB: Check that AUTH_SALT is not empty, Fix a PHP notice when AUTH_SALT is undefined. 
Props jsonfry, mkomar, pento.
Merges [42119] and [42120] to the 4.4 branch.
Fixes #42431 and #42401 for 4.4.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42234 602fd350-edb4-49c9-b593-d223f7449a82
 2017-11-27 01:09:38 +00:00
John Blackbourn
cd94945baf General: Remove the version number from the readme file in the 4.4 branch. 
See #42386


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42103 602fd350-edb4-49c9-b593-d223f7449a82
 2017-10-31 18:07:23 +00:00
Gary Pendergast
ecc013ea94 Bump 4.4 branch to version 4.4.12. 
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42073 602fd350-edb4-49c9-b593-d223f7449a82
 2017-10-31 13:25:20 +00:00
Gary Pendergast
ad4bd52b18 Database: Restore numbered placeholders in wpdb::prepare(). 
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.

This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.

Merges [41662], [42056] to the 4.4 branch.
See #41925.



git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42061 602fd350-edb4-49c9-b593-d223f7449a82
 2017-10-31 12:45:48 +00:00
Gary Pendergast
3e606ecd3f Build/Test Tools: Pass correct $message argument to WP_UnitTestCase::setExpectedException() in Tests_Ajax_CompressionTest::test_logged_out() and Tests_Ajax_TagSearch::test_no_results(). 
PHPUnit 6.4.1 and earlier versions ignored the `'0'` value, causing the issue to go unnoticed.

Merge of [41870] to the 4.4 branch.

Props SergeyBiryukov.
Fixes #42232.



git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42055 602fd350-edb4-49c9-b593-d223f7449a82
 2017-10-31 09:13:09 +00:00
Dominik Schilling (ocean90)
3d7914ac8e Taxonomy/Users: Use correct escaping function for URLs. 
Merge of [41522] to the 4.4 branch.

git-svn-id: https://develop.svn.wordpress.org/branches/4.4@41527 602fd350-edb4-49c9-b593-d223f7449a82
 2017-09-19 21:32:43 +00:00
Dominik Schilling (ocean90)
ecb05e589e Bump 4.4 branch to version 4.4.11. 
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@41514 602fd350-edb4-49c9-b593-d223f7449a82
 2017-09-19 20:00:56 +00:00
Aaron D. Campbell
a003655113 Database: Hardening to bring wpdb::prepare() inline with documentation. 
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.

Merges [41496] to 4.4 branch.



git-svn-id: https://develop.svn.wordpress.org/branches/4.4@41501 602fd350-edb4-49c9-b593-d223f7449a82
 2017-09-19 18:14:33 +00:00
Aaron D. Campbell
4ca6de4825 Database: Don’t trigger _doing_it_wrong() for null values in wpdb::prepare(). 
While `wpdb::prepare()` does not support null values (see #12819) they still appear in the wild like in the WordPress Importer and other plugins.

Merges [41483] to 4.4 branch.



git-svn-id: https://develop.svn.wordpress.org/branches/4.4@41488 602fd350-edb4-49c9-b593-d223f7449a82
 2017-09-19 16:22:48 +00:00
Aaron D. Campbell
a577ca8fcd Database: Hardening for wpdb::prepare() 
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

Merges [41470] to 4.4 branch.



git-svn-id: https://develop.svn.wordpress.org/branches/4.4@41475 602fd350-edb4-49c9-b593-d223f7449a82
 2017-09-19 15:00:28 +00:00
John Blackbourn
16be4fffbf Filesystem API: Ensure filenames are valid before attempting to unzip them to ensure malformed file paths don't cause issues. 
Merges [41457] to the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@41462 602fd350-edb4-49c9-b593-d223f7449a82
 2017-09-19 14:40:54 +00:00
Aaron D. Campbell
edd2fd87fe oEmbed: Add extra hardening around allowed HTML for improved sandboxing. 
Merges [41448] to 4.4 branch.



git-svn-id: https://develop.svn.wordpress.org/branches/4.4@41455 602fd350-edb4-49c9-b593-d223f7449a82
 2017-09-19 13:49:40 +00:00
Dominik Schilling (ocean90)
4bed6cc652 TinyMCE: Improve the previews for shortcodes. 
Merge of [41395] to the 4.4 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@41439 602fd350-edb4-49c9-b593-d223f7449a82
 2017-09-19 12:40:20 +00:00
John Blackbourn
bcd3697770 General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area. 
Merges [41415] and [41416] into the 4.4 branch.

See #13377


git-svn-id: https://develop.svn.wordpress.org/branches/4.4@41434 602fd350-edb4-49c9-b593-d223f7449a82
 2017-09-19 12:12:15 +00:00