The REST API treats routes without a permission_callback as public. Because this happens without any warning to the user, if the permission callback is unintentionally omitted or misspelled, the endpoint can end up being available to the public. Such a scenario has happened multiple times in the wild, and the results can be catostrophic when it occurs.
For REST API routes that are intended to be public, it is recommended to set the permission callback to the `__return_true` built in function.
Fixes#50075.
Props rmccue, sorenbronsted, whyisjake, SergeyBiryukov, TimothyBlynJacobs.
git-svn-id: https://develop.svn.wordpress.org/trunk@48526 602fd350-edb4-49c9-b593-d223f7449a82
The REST API plugin installation tests use the `upgrader_pre_download` filter to avoid downloading the test plugin from WordPress.org. Previously, this would apply to any upgrader, which caused issues if the testing environment required a language update.
Now, the filter only overwrites the file if the `Plugin_Upgrader` is being used which should hopefully prevent the issue.
Props pfefferle, TimothyBlynJacobs.
Fixes#50671.
git-svn-id: https://develop.svn.wordpress.org/trunk@48524 602fd350-edb4-49c9-b593-d223f7449a82
If sitemaps are disabled, previously there would be a rewrite rule for the sitemap endpoint. This endpoint would display the homepage since there was a rewrite rule. Now, Sitemaps are loaded, and the proper HTTP headers are returned.
Fixes#50643.
Props swissspidy, kraftbj, donmhico.
git-svn-id: https://develop.svn.wordpress.org/trunk@48523 602fd350-edb4-49c9-b593-d223f7449a82
It doesn't make sense to be able to filter the comments list table when there are are no (trashed/spam) comments available.
Fixes#40188.
Props swissspidy, Jim_Panse, menakas, akbarhusen429, dinhtungdu, birgire, SergeyBiryukov, davidbaumwald, rebasaurus, whyisjake.
git-svn-id: https://develop.svn.wordpress.org/trunk@48521 602fd350-edb4-49c9-b593-d223f7449a82
The order of parameters in `get_metadata_default()` did not match the signature of `get_metadata()`. This could be confusing for developers who are familiar with the existing metadata API.
Fixes#43941.
Props SergeyBiryukov, spacedmonkey, johnjamesjacoby.
git-svn-id: https://develop.svn.wordpress.org/trunk@48502 602fd350-edb4-49c9-b593-d223f7449a82
When `wp_count_posts()` is cached, it does so with all statuses defaulted to 0. The problem is however, if this is called before all plugins have registered their desired statuses, they won't have that default.
Fixes#49685.
Props obliviousharmony, SergeyBiryukov.
git-svn-id: https://develop.svn.wordpress.org/trunk@48497 602fd350-edb4-49c9-b593-d223f7449a82
Adjusts the gallery shortcode handler to check for the `link` attribute when outputting to a feed.
Fixes#22101.
Props ifrins, mdgl, SergeyBiryukov, chriscct7, stevenkword, iworks, DrewAPicture, birgire, whyisjake.
git-svn-id: https://develop.svn.wordpress.org/trunk@48496 602fd350-edb4-49c9-b593-d223f7449a82
* Move default term assignment from `wp_set_object_terms()` to `wp_insert_post()`.
* Make sure the passed taxonomy list overwrites the existing list if not empty.
* Remove the default term option on `unregister_taxonomy()`.
* Prevent deletion of the default term in `wp_delete_term()`.
Props enrico.sorcinelli, TimothyBlynJacobs.
See #43517.
git-svn-id: https://develop.svn.wordpress.org/trunk@48480 602fd350-edb4-49c9-b593-d223f7449a82
If there are no pages and no static homepage, there will still be one sitemap including the homepage URL.
This change ensures that this sitemap is correctly listed in the sitemap index.
Props Chouby, pacifika, elrae.
Fixes#50571.
git-svn-id: https://develop.svn.wordpress.org/trunk@48476 602fd350-edb4-49c9-b593-d223f7449a82
Unix vs. Windows EOL style mismatches can cause misleading failures in tests using the heredoc syntax (`<<<`) or multiline strings as the expected result.
Follow-up to [46612], [48443].
See #31432.
git-svn-id: https://develop.svn.wordpress.org/trunk@48466 602fd350-edb4-49c9-b593-d223f7449a82
This allows the theme file tests in `phpunit/tests/link/themeFile.php` to run on Windows without requiring administrative privileges.
Follow-up to [42812], [42819].
Props danielhuesken, christophherr, davidbaumwald, SergeyBiryukov.
See #40856, #39975.
git-svn-id: https://develop.svn.wordpress.org/trunk@48463 602fd350-edb4-49c9-b593-d223f7449a82
Also refreshes and fixes some of the unit tests for media, and replaces test-image-large.png with test-image-large.jpg which is larger to allow testing of `original_image` in the image meta.
Fixes#50628.
git-svn-id: https://develop.svn.wordpress.org/trunk@48454 602fd350-edb4-49c9-b593-d223f7449a82
This corrects a fragile check of the result in `wp_ajax_update_plugin()` that depended on the internal array pointer, and brings some consistency with `wp_ajax_update_theme()`.
Follow-up to [37714], [48401].
See #50448.
git-svn-id: https://develop.svn.wordpress.org/trunk@48445 602fd350-edb4-49c9-b593-d223f7449a82
Unix vs. Windows EOL style mismatches can cause misleading failures in tests using the heredoc syntax (`<<<`) or multiline strings as the expected result.
Follow-up to [46612], [48033].
Props davidbaumwald.
See #31432, #41750.
git-svn-id: https://develop.svn.wordpress.org/trunk@48443 602fd350-edb4-49c9-b593-d223f7449a82
The `menu-item-title` value is saved as a `post_title` property, so the resulting property can be checked directly, without a callback.
Follow-up to [48416].
See #48011.
git-svn-id: https://develop.svn.wordpress.org/trunk@48439 602fd350-edb4-49c9-b593-d223f7449a82
In [48069] the Block Renderer was changed to register a single route for all dynamic blocks. Validation was dynamically applied based on the requested block, but sanitization was not. This commit adds the same sanitization back to the block attributes.
Props manooweb.
Fixes#50620. See #48079.
git-svn-id: https://develop.svn.wordpress.org/trunk@48437 602fd350-edb4-49c9-b593-d223f7449a82
Additionally:
* Correct inline comments per the documentation standards.
* Correct the `@ticket` reference in `tests/feed/atom.php`.
Follow-up to [48429].
See #33591.
git-svn-id: https://develop.svn.wordpress.org/trunk@48435 602fd350-edb4-49c9-b593-d223f7449a82
If a bool/float/int is passed into wp_slash it will be coerced into a string.
This changes the behavior to only slash strings. At the same time, handles recursion a little nicer by calling array_map for arrays.
Fixes#42195, #24106.
Props johnbillion, andizer, jrf, ryotasakamoto, SergeyBiryukov, donmhico, TobiasBg, markoheijnen, ryan, nacin, devesine, whyisjake.
git-svn-id: https://develop.svn.wordpress.org/trunk@48433 602fd350-edb4-49c9-b593-d223f7449a82
Metadata that is stored on newlines has the possibility of missing values, so rather then coercing values, we can check for them and then implicity set the values.
Fixes#33591.
Props jonnybot, stevenkword, vtieu, birgire, SergeyBiryukov, davidbaumwald, rebasaurus, whyisjake.
git-svn-id: https://develop.svn.wordpress.org/trunk@48429 602fd350-edb4-49c9-b593-d223f7449a82
Improve speed and reduce the memory footprint when loading posts with many revisions.
* Use a direct query in `wp_get_post_autosave` to avoid loading all revisions.
* Query for IDs vs full objects in `register_and_do_post_meta_boxes`.
Props pdfernhout, johnnyb, miqrogroove, ocean90, senatorman, DBrumbaugh10Up, martijn-van-der-kooij, pavelevap, mackensen, mikeyarce, whyisjake.
Fixes#34560.
git-svn-id: https://develop.svn.wordpress.org/trunk@48422 602fd350-edb4-49c9-b593-d223f7449a82
Slashes and HTML encoding could cause some menus not to be updated.
Fixes#48011.
Props zaheerahmad, achyuthajoy, desrosj, pento, SergeyBiryukov, donmhico, audrasjb, birgire, mikeschroder.
git-svn-id: https://develop.svn.wordpress.org/trunk@48416 602fd350-edb4-49c9-b593-d223f7449a82
The `register_meta()` API now officially supports specifying a default metadata value. When `get_metadata()` is called for a meta key that does not yet exist for the object, this default value will be returned instead of an empty string.
A new function is introduced `get_metadata_raw` to retrieve the raw metadata value from the database, without applying the registered default.
Props spacedmonkey, flixos90, rmccue, kadamwhite, mnelson4, johnbillion, chrisvanpatten, TimothyBlynJacobs.
Fixes#43941.
git-svn-id: https://develop.svn.wordpress.org/trunk@48402 602fd350-edb4-49c9-b593-d223f7449a82
The script is not part of CI yet because the job takes 40mn to run
and it's not useful in all PRs/commits.
Fixes#50469.
git-svn-id: https://develop.svn.wordpress.org/trunk@48382 602fd350-edb4-49c9-b593-d223f7449a82
The new default_term argument is added to `register_taxonomy()` allowing a user to define the default term `name` and optionally `slug` and `description`.
Fixes#43517.
Props enrico.sorcinelli, SergeyBiryukov, desrosj, davidbaumwald, whyisjake.
git-svn-id: https://develop.svn.wordpress.org/trunk@48356 602fd350-edb4-49c9-b593-d223f7449a82
Now that more than 3 months have passed since 2020-03-23, this was causing test failures.
Follow-up to [48242].
See #50321.
git-svn-id: https://develop.svn.wordpress.org/trunk@48333 602fd350-edb4-49c9-b593-d223f7449a82
- Introduce `wp_image_file_matches_image_meta()` utility function to check whether the image meta (retrieved by attachment ID) matches an image path or URI. A mismatch may happen in some cases, for example after the posts have been exported from one website and imported in another.
- Add unit tests for the new function.
- Improve `wp_image_src_get_dimensions()` a bit and use the new function to prevent these edge cases.
Fixes#50543.
git-svn-id: https://develop.svn.wordpress.org/trunk@48329 602fd350-edb4-49c9-b593-d223f7449a82
This makes the property consistent with similar properties of other classes:
* `WP_Comment_Query::$found_comments`
* `WP_Network_Query::$found_networks`
* `WP_Site_Query::$found_sites`
* `WP_User_Query::$total_users`
Props birgire, PressLabs.
Fixes#42469.
git-svn-id: https://develop.svn.wordpress.org/trunk@48328 602fd350-edb4-49c9-b593-d223f7449a82
This test is only relevant for locales using a comma as a decimal separator, while `ja_JP` uses a dot.
Props gh640, johnjamesjacoby, SergeyBiryukov.
Fixes#49690.
git-svn-id: https://develop.svn.wordpress.org/trunk@48317 602fd350-edb4-49c9-b593-d223f7449a82
When a user has registered with incorrect data and got the account deleted immediately, it currently wasn't possible to register with the same login or email address again due to the existing signup entry. They had to wait for two days until the entry gets automatically deleted. Now the associated signup entry gets deleted as part of the account deletion.
Fixes#43232.
git-svn-id: https://develop.svn.wordpress.org/trunk@48315 602fd350-edb4-49c9-b593-d223f7449a82
This further makes the function more consistent with `get_the_ID()` or `wp_get_post_parent_id()`, both returning `false` for a non-existing post.
Additionally, document that `get_post_thumbnail_id()` returns `0` if the thumbnail image is not set.
Follow-up to [47160].
Props theMikeD, dingo_d, netpassprodsr, SergeyBiryukov.
Fixes#49832. See #40096.
git-svn-id: https://develop.svn.wordpress.org/trunk@48310 602fd350-edb4-49c9-b593-d223f7449a82
A multi-type schema is a schema where the `type` keyword is an array of possible types instead of a single type. For instance, `[ 'object', 'string' ]` would allow objects or string values.
In [46249] basic support for these schemas was introduced. The validator would loop over each schema type trying to find a version that matched. This worked for valid values, but for invalid values it provided unhelpful error messages. The sanitizer also had its utility restricted.
In this commit, the validators and sanitizers will first determine the best type of the passed value and then apply the schema with that set type. In the case that a value could match multiple types, the schema of the first matching type will be used.
To maintain backward compatibility, if unsupported schema types are used, the value will always pass validation. A doing it wrong notice is issued in this case.
Fixes#50300.
Props pentatonicfunk, dlh, TimothyBlynJacobs.
git-svn-id: https://develop.svn.wordpress.org/trunk@48306 602fd350-edb4-49c9-b593-d223f7449a82
This allows for using multi-type support with a string that has a format. For backwards compatibility support, the format validation will still apply if the type is not specified, or it is invalid.
Two new doing it wrong notices are issued when omitting a type, or using an invalid type.
Props ryotsun.
Fixes#50189.
git-svn-id: https://develop.svn.wordpress.org/trunk@48300 602fd350-edb4-49c9-b593-d223f7449a82
This commit adds a unique ID attribute to script loader generated <script> tags as well as related <script> tags for inline JavaScript, translations, or parameters.
This is a first step in adding support for lazy loading scripts and styles, but for now is only used to assist in debugging generated output.
Props dd32, spacedmonkey.
See #48654.
git-svn-id: https://develop.svn.wordpress.org/trunk@48295 602fd350-edb4-49c9-b593-d223f7449a82
To facilitate inline image editing in Gutenberg, a new endpoint at wp/v2/media/<id>/edit has been introduced. This is functionally similar to the existing ajax image editor, however the REST API editor creates a new attachment record instead of updating an existing attachment.
Fixes#44405.
Props ajlende, ellatrix, spacedmonkey, azaozz.
git-svn-id: https://develop.svn.wordpress.org/trunk@48291 602fd350-edb4-49c9-b593-d223f7449a82
* Make sure `test_wp_list_pages_number()` sorts by ID, as there are several pages with the same title.
* Limit `test_wp_list_pages_sort_column()` to one level, as the child page fixtures don't have an author and cannot be reliably sorted by `post_author`.
Follow-up to [48157].
Props afercia.
See #50466.
git-svn-id: https://develop.svn.wordpress.org/trunk@48280 602fd350-edb4-49c9-b593-d223f7449a82
After working on support for register_block_type_args filter in #49615, it became clear that we need to use init action for core blocks to make it possible to use this filter.
Fixes#50263.
git-svn-id: https://develop.svn.wordpress.org/trunk@48279 602fd350-edb4-49c9-b593-d223f7449a82
This allows for programatically determining the REST version of the current page. The links also aid human discovery of the REST API in general.
Props dshanske, tfrommen, TimothyBlynJacobs.
Fixes#49116.
git-svn-id: https://develop.svn.wordpress.org/trunk@48273 602fd350-edb4-49c9-b593-d223f7449a82
With this changeset, in addition to the already present `wp_lazy_loading_enabled` filter, developers can now opt out of lazy-loading template images via `wp_get_attachment_image()` by passing a `loading` attribute with boolean value `false`. This can be used e.g. by theme developers on images which are very likely to be in the initial viewport.
This changeset also improves related test coverage.
Props adamsilverstein, azaozz, joemcgill, johnbillion.
See #50425, #44427.
git-svn-id: https://develop.svn.wordpress.org/trunk@48272 602fd350-edb4-49c9-b593-d223f7449a82
Adds possibility to filter the settings of a block type during its registration.
Props aduth, azaozz.
Fixes#49615.
git-svn-id: https://develop.svn.wordpress.org/trunk@48263 602fd350-edb4-49c9-b593-d223f7449a82
These endpoints facilitate the Block Directory Inserter feature in Gutenberg. Users can now install, activate, deactivate, and delete plugins over the REST API. The block directoryendpoint allows searching for available blocks from the WordPress.org block directory.
Props cklee, talldanwp, noisysocks, joen, soean, youknowriad, dufresnesteven, gziolo, dd32, tellyworth, ryelle, spacedmonkey, TimothyBlynJacobs.
Fixes#50321.
git-svn-id: https://develop.svn.wordpress.org/trunk@48242 602fd350-edb4-49c9-b593-d223f7449a82
Following up on [48170], this changeset moves the new logic to add missing `img` dimension attributes into a separate function that is run first within `wp_filter_content_tags()`. It also adds a utility function `wp_image_src_get_dimensions()` with logic reused from `wp_image_add_srcset_and_sizes()`, and it ensures that `width` and `height` attributes only get added if both of the attributes are missing on the original `img` tag.
This changeset furthermore improves test coverage and separates tests for the different aspects of `img` tag modification.
Props azaozz.
Fixes#50367. See #44427.
git-svn-id: https://develop.svn.wordpress.org/trunk@48237 602fd350-edb4-49c9-b593-d223f7449a82
This addresses an inconsistency where 0 could mean one of the three scenarios:
* Invalid comment ID.
* Invalid comment post ID.
* No DB rows updated. This is not an error and should not be treated as one.
With this change, `wp_update_comment()` always returns either `false` or a `WP_Error` object on failure, depending on the value of the `$wp_error` parameter.
Follow-up to [48154], [48215], [48216], [48218], [48230].
Props dd32, jnylen0, enrico.sorcinelli.
Fixes#39732. See #38700, #39735.
git-svn-id: https://develop.svn.wordpress.org/trunk@48235 602fd350-edb4-49c9-b593-d223f7449a82
Restoring the hook-related globals to their state at `setUp()` is addressed by `WP_UnitTestCase_Base::_restore_hooks()`.
Follow-up to [48154].
See #39732.
git-svn-id: https://develop.svn.wordpress.org/trunk@48222 602fd350-edb4-49c9-b593-d223f7449a82
This makes the behavior consistent with that of locked posts, which can't be deleted via the list tables when another user is editing them.
Props dlh.
Fixes#50501.
git-svn-id: https://develop.svn.wordpress.org/trunk@48211 602fd350-edb4-49c9-b593-d223f7449a82
* `get_header()`
* `get_footer()`
* `get_sidebar()`
* `get_template_part()`
These functions now return false if the template file could not be found, to allow for easier debugging.
Props tferry, sphakka, johnbillion, pento, davidbinda, desrosj, birgire, garrett-eclipse, williampatton, davidbaumwald, SergeyBiryukov.
Fixes#40969.
git-svn-id: https://develop.svn.wordpress.org/trunk@48209 602fd350-edb4-49c9-b593-d223f7449a82
This endpoint allows a user to retrieve the block type definition for all server-side registered block types.
Props spacedmonkey, aduth, gziolo, ocean90, TimothyBlynJacobs.
Fixes#47620.
git-svn-id: https://develop.svn.wordpress.org/trunk@48173 602fd350-edb4-49c9-b593-d223f7449a82
Currently themes can declare support for a given feature by using add_theme_support(). This commit adds a register_theme_feature() API that allows plugins and WordPress Core to declare a list of available features that themes can support.
The REST API uses this to expose a theme's supported features if the feature has been registered with "show_in_rest" set to true.
Props kadamwhite, spacedmonkey, williampatton, desrosj, TimothyBlynJacobs.
Fixes#49406.
git-svn-id: https://develop.svn.wordpress.org/trunk@48171 602fd350-edb4-49c9-b593-d223f7449a82
This changeset ensures that attachment images which are inserted without `width` and `height` attributes still receive them in the frontend, to reduce cumulative layout shift. Adding the dimensions happens as part of the logic for adding `srcset` and `sizes` attributes, which already assume the specific width and height of the respective image.
Images are now only lazy-loaded if they have `width` and `height` attributes present. While missing these attributes itself is what causes layout shifts, lazy-loading such images can make this problem more apparent to the user.
Props adamsilverstein, westonruter.
Fixes#50367. See #44427.
git-svn-id: https://develop.svn.wordpress.org/trunk@48170 602fd350-edb4-49c9-b593-d223f7449a82
The `wp_update_comment_data` filter introduced in 4.7 allows comment data to be filtered before it is updated in the database.
The patch aims to handle `WP_Error` as the filter above return value in a similar manner as is done for `wp_new_comment()`.
Fixes#39732.
Props: enricosorcinelli, swissspidy, gkloveweb, jnylen0, jbpaul17, afercia, SergeyBiryukov, audrasjb, imath, davidbaumwald.
git-svn-id: https://develop.svn.wordpress.org/trunk@48154 602fd350-edb4-49c9-b593-d223f7449a82
This makes the API a little more clear, whereas setting `false` used to mean `asc` and `true` meant `desc`, you can now use those directly, while maintaining back-compat.
Fixes#45089.
Props Tkama, SergeyBiryukov, shital-patel, desrosj, birgire, davidbaumwald.
git-svn-id: https://develop.svn.wordpress.org/trunk@48151 602fd350-edb4-49c9-b593-d223f7449a82
Also, remove the `version` argument from the `wp.deprecated()` call in `password-strength-meter.js`. This argument is for specifying the version a feature will be removed, not when the feature was removed.
Props hareesh-pillai.
Fixes#50413.
git-svn-id: https://develop.svn.wordpress.org/trunk@48124 602fd350-edb4-49c9-b593-d223f7449a82
“The WordPress open source community cares about diversity. We strive to maintain a welcoming environment where everyone can feel included.”
With this commit, all occurrences of “whitelist” and “blacklist” (with the single exception of the `$new_whitelist_options` global variable) are removed. A new ticket has been opened to explore renaming the `$new_whitelist_options` variable (#50434).
Changing to more specific names or rewording sentences containing these terms not only makes the code more inclusive, but also helps provide clarity. These terms are often ambiguous. What is being blocked or allowed is not always immediately clear. This can make it more difficult for non-native English speakers to read through the codebase.
Words matter. If one contributor feels more welcome because these terms are removed, this was worth the effort.
Props strangerstudios, jorbin, desrosj, joemcgill, timothyblynjacobs, ocean90, ayeshrajans, davidbaumwald, earnjam.
See #48900, #50434.
Fixes#50413.
git-svn-id: https://develop.svn.wordpress.org/trunk@48121 602fd350-edb4-49c9-b593-d223f7449a82
The merging behavior which assigns the `layout` attribute in `WP_Block_Type` gets removed.
Props aduth, TimothyBlynJacobs.
Fixes#50257.
git-svn-id: https://develop.svn.wordpress.org/trunk@48118 602fd350-edb4-49c9-b593-d223f7449a82
Timothy Jacobs
Jake Spurlock
Sergey Biryukov
Andrew Ozz
swissspidy
Pascal Birchler
SergeyBiryukov
Adam Silverstein
Riad Benguella
Dominik Schilling
Greg Ziółkowski
Felix Arntz
Andrea Fercia
Ella van Durpe
Jonathan Desrosiers