These tests no longer test anything that WordPress core has control over. YouTube now serves everything
over HTTPS by default, so the tests for #23149 will always pass, and the tests for #32714 aren't testing
anything that core has control over.
Tests for the responses from oEmbed providers has been attempted and reverted in #32360.
Props johnbillion.
Merges [41712] to the 4.4 branch.
See #42076, #32714, #23149.
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@47483 602fd350-edb4-49c9-b593-d223f7449a82
`wp_kses_bad_protocol()` makes sure to validate that uri attributes don’t contain invalid/or not allowed protocols. While this works fine in most cases, there’s a risk that by using the colon html5 named entity, one is able to bypass this function.
Brings r46895 to the 4.4 branch.
Props: xknown, nickdaugherty, peterwilsoncc.
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@46912 602fd350-edb4-49c9-b593-d223f7449a82
When jumping between branches, it would be nice to have the correct node version for the older versions of WordPress. Let's add .nvmrc files to these older branches for the supported versions.
Merges [46295] to the 4.4 branch.
Fixes#48140
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@46300 602fd350-edb4-49c9-b593-d223f7449a82
This removes the PHP 5.6 job which runs without an object cache in place as the likelihood of a change being backported that only breaks 5.6 environments without an object cache is small.
Merges [45010] into the 4.4 branch.
See #42387
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@45011 602fd350-edb4-49c9-b593-d223f7449a82
This switches to caching npm's local cache instead of `node_modules` in order to prevent issues caused by modules compiled using a different version of node.
Merges [44993] into the 4.4 branch.
See #46632
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@45001 602fd350-edb4-49c9-b593-d223f7449a82
The `meta_input`, `file`, and `guid` fields are not intended to be updated through user input.
Merges [44047] to the 4.4 branch.
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44062 602fd350-edb4-49c9-b593-d223f7449a82
This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes.
Merges [44014] and [44017] to the `4.4` branch.
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44035 602fd350-edb4-49c9-b593-d223f7449a82
Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time.
Merges [44021] to the 4.4 branch.
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44030 602fd350-edb4-49c9-b593-d223f7449a82
To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.
Merges [43994] to the 4.4 branch.
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44003 602fd350-edb4-49c9-b593-d223f7449a82
[41496] removed support for numbered placeholders in queries send through `wpdb::prepare()`, which, despite being undocumented, were quite commonly used.
This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to `wpdb::prepare()`, given the number of placeholders.
Merges [41662], [42056] to the 4.4 branch.
See #41925.
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42061 602fd350-edb4-49c9-b593-d223f7449a82
PHPUnit 6.4.1 and earlier versions ignored the `'0'` value, causing the issue to go unnoticed.
Merge of [41870] to the 4.4 branch.
Props SergeyBiryukov.
Fixes#42232.
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@42055 602fd350-edb4-49c9-b593-d223f7449a82
`wpdb::prepare()` supports %s, %d, and %F as placeholders in the query string. Any other non-escaped % will be escaped.
Merges [41496] to 4.4 branch.
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@41501 602fd350-edb4-49c9-b593-d223f7449a82
While `wpdb::prepare()` does not support null values (see #12819) they still appear in the wild like in the WordPress Importer and other plugins.
Merges [41483] to 4.4 branch.
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@41488 602fd350-edb4-49c9-b593-d223f7449a82
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.
Merges [41470] to 4.4 branch.
git-svn-id: https://develop.svn.wordpress.org/branches/4.4@41475 602fd350-edb4-49c9-b593-d223f7449a82
