Tag 3.7.7.

Built from https://develop.svn.wordpress.org/@32291 git-svn-id: http://core.svn.wordpress.org/tags/3.7.7@32262 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The 3.7 branch is now 3.7.7.
2015-04-23 22:39:30 +00:00 · 2015-04-23 21:36:10 +00:00 · 2015-04-23 11:56:10 +00:00 · 2015-04-21 07:06:10 +00:00 · 2015-04-20 17:33:09 +00:00 · 2015-04-20 17:32:10 +00:00
41 changed files with 1238 additions and 177 deletions
--- a/license.txt
+++ b/license.txt
@@ -1,6 +1,6 @@
 WordPress - Web publishing software

-Copyright 2013 by the contributors
+Copyright 2015 by the contributors

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
--- a/readme.html
+++ b/readme.html
@@ -8,7 +8,7 @@
 <body>
 <h1 id="logo">
 	<a href="http://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
-	<br /> Version 3.7
+	<br /> Version 3.7.7
 </h1>
 <p style="text-align: center">Semantic Personal Publishing Platform</p>

--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -36,7 +36,31 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 </h2>

 <div class="changelog point-releases">
-	<h3><?php echo _n( 'Maintenance Release', 'Maintenance Releases', 1 ); ?></h3>
+	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 7 ); ?></h3>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed %2$s bug.',
+         '<strong>Version %1$s</strong> addressed %2$s bugs.', 1 ), '3.7.7', number_format_i18n( 1 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.7.7' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 8 ), '3.7.6' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.7.6' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 8 ), '3.7.5', number_format_i18n( 8 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.7.5' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 5 ), '3.7.4', number_format_i18n( 5 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.7.4' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed %2$s bug.',
+		'<strong>Version %1$s</strong> addressed %2$s bugs.', 2 ), '3.7.3', number_format_i18n( 2 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.7.3' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
+         '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 9 ), '3.7.2', number_format_i18n( 9 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.7.2' ); ?>
+ 	</p>
 	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed %2$s bug.',
 		'<strong>Version %1$s</strong> addressed %2$s bugs.', 11 ), '3.7.1', number_format_i18n( 11 ) ); ?>
 		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.7.1' ); ?>
--- a/wp-admin/includes/class-wp-comments-list-table.php
+++ b/wp-admin/includes/class-wp-comments-list-table.php
@@ -493,9 +493,9 @@ class WP_Comments_List_Table extends WP_List_Table {

 		if ( current_user_can( 'edit_post', $post->ID ) ) {
 			$post_link = "<a href='" . get_edit_post_link( $post->ID ) . "'>";
-			$post_link .= get_the_title( $post->ID ) . '</a>';
+			$post_link .= esc_html( get_the_title( $post->ID ) ) . '</a>';
 		} else {
-			$post_link = get_the_title( $post->ID );
+			$post_link = esc_html( get_the_title( $post->ID ) );
 		}

 		echo '<div class="response-links"><span class="post-com-count-wrapper">';
--- a/wp-admin/includes/class-wp-posts-list-table.php
+++ b/wp-admin/includes/class-wp-posts-list-table.php
@@ -832,7 +832,7 @@ class WP_Posts_List_Table extends WP_List_Table {
 	<?php if ( !$bulk ) echo $authors_dropdown;
 	endif; // post_type_supports author

-	if ( !$bulk ) :
+	if ( !$bulk && $can_publish ) :
 	?>

 			<div class="inline-edit-group">
--- a/wp-admin/includes/class-wp-upgrader.php
+++ b/wp-admin/includes/class-wp-upgrader.php
@@ -1314,7 +1314,9 @@ class Core_Upgrader extends WP_Upgrader {
 	}

 	function upgrade( $current, $args = array() ) {
-		global $wp_filesystem, $wp_version;
+		global $wp_filesystem;
+
+		include ABSPATH . WPINC . '/version.php'; // $wp_version;

 		$start_time = time();

@@ -1333,8 +1335,9 @@ class Core_Upgrader extends WP_Upgrader {
 			return new WP_Error('up_to_date', $this->strings['up_to_date']);

 		$res = $this->fs_connect( array(ABSPATH, WP_CONTENT_DIR) );
-		if ( is_wp_error($res) )
+		if ( ! $res || is_wp_error( $res ) ) {
 			return $res;
+		}

 		$wp_dir = trailingslashit($wp_filesystem->abspath());

@@ -1421,6 +1424,7 @@ class Core_Upgrader extends WP_Upgrader {
 				'fs_method'        => $wp_filesystem->method,
 				'fs_method_forced' => defined( 'FS_METHOD' ) || has_filter( 'filesystem_method' ),
 				'time_taken'       => time() - $start_time,
+				'reported'         => $wp_version,
 				'attempted'        => $current->version,
 			);

@@ -1868,18 +1872,21 @@ class WP_Automatic_Updater {
 		if ( ! $this->should_update( $type, $item, $context ) )
 			return false;

+		$upgrader_item = $item;
 		switch ( $type ) {
 			case 'core':
 				$skin->feedback( __( 'Updating to WordPress %s' ), $item->version );
 				$item_name = sprintf( __( 'WordPress %s' ), $item->version );
 				break;
 			case 'theme':
-				$theme = wp_get_theme( $item );
+				$upgrader_item = $item->theme;
+				$theme = wp_get_theme( $upgrader_item );
 				$item_name = $theme->Get( 'Name' );
 				$skin->feedback( __( 'Updating theme: %s' ), $item_name );
 				break;
 			case 'plugin':
-				$plugin_data = get_plugin_data( $context . '/' . $item );
+				$upgrader_item = $item->plugin;
+				$plugin_data = get_plugin_data( $context . '/' . $upgrader_item );
 				$item_name = $plugin_data['Name'];
 				$skin->feedback( __( 'Updating plugin: %s' ), $item_name );
 				break;
@@ -1891,12 +1898,17 @@ class WP_Automatic_Updater {
 		}

 		// Boom, This sites about to get a whole new splash of paint!
-		$upgrade_result = $upgrader->upgrade( $item, array(
+		$upgrade_result = $upgrader->upgrade( $upgrader_item, array(
 			'clear_update_cache' => false,
 			'pre_check_md5'      => false, /* always use partial builds if possible for core updates */
 			'attempt_rollback'   => true, /* only available for core updates */
 		) );

+		// if the filesystem is unavailable, false is returned.
+		if ( false === $upgrade_result ) {
+			$upgrade_result = new WP_Error( 'fs_unavailable', __( 'Could not access filesystem.' ) );
+		}
+
 		// Core doesn't output this, so lets append it so we don't get confused
 		if ( 'core' == $type ) {
 			if ( is_wp_error( $upgrade_result ) ) {
@@ -1960,7 +1972,7 @@ class WP_Automatic_Updater {
 		wp_update_plugins(); // Check for Plugin updates
 		$plugin_updates = get_site_transient( 'update_plugins' );
 		if ( $plugin_updates && !empty( $plugin_updates->response ) ) {
-			foreach ( array_keys( $plugin_updates->response ) as $plugin ) {
+			foreach ( $plugin_updates->response as $plugin ) {
 				$this->update( 'plugin', $plugin );
 			}
 			// Force refresh of plugin update information
@@ -1971,8 +1983,8 @@ class WP_Automatic_Updater {
 		wp_update_themes();  // Check for Theme updates
 		$theme_updates = get_site_transient( 'update_themes' );
 		if ( $theme_updates && !empty( $theme_updates->response ) ) {
-			foreach ( array_keys( $theme_updates->response ) as $theme ) {
-				$this->update( 'theme', $theme );
+			foreach ( $theme_updates->response as $theme ) {
+				$this->update( 'theme', (object) $theme );
 			}
 			// Force refresh of theme update information
 			wp_clean_themes_cache();
@@ -1987,8 +1999,21 @@ class WP_Automatic_Updater {

 		// Clean up, and check for any pending translations
 		// (Core_Upgrader checks for core updates)
-		wp_update_themes();  // Check for Theme updates
-		wp_update_plugins(); // Check for Plugin updates
+		$theme_stats = array();
+		if ( isset( $this->update_results['theme'] ) ) {
+			foreach ( $this->update_results['theme'] as $upgrade ) {
+				$theme_stats[ $upgrade->item->theme ] = ( true === $upgrade->result );
+			}
+		}
+		wp_update_themes( $theme_stats );  // Check for Theme updates
+
+		$plugin_stats = array();
+		if ( isset( $this->update_results['plugin'] ) ) {
+			foreach ( $this->update_results['plugin'] as $upgrade ) {
+				$plugin_stats[ $upgrade->item->plugin ] = ( true === $upgrade->result );
+			}
+		}
+		wp_update_plugins( $plugin_stats ); // Check for Plugin updates

 		// Finally, Process any new translations
 		$language_updates = wp_get_translation_updates();
--- a/wp-admin/includes/dashboard.php
+++ b/wp-admin/includes/dashboard.php
@@ -658,7 +658,7 @@ function _wp_dashboard_recent_comments_row( &$comment, $show_date = true ) {
 	$GLOBALS['comment'] =& $comment;

 	$comment_post_url = get_edit_post_link( $comment->comment_post_ID );
-	$comment_post_title = strip_tags(get_the_title( $comment->comment_post_ID ));
+	$comment_post_title = _draft_or_post_title( $comment->comment_post_ID );
 	$comment_post_link = "<a href='$comment_post_url'>$comment_post_title</a>";
 	$comment_link = '<a class="comment-link" href="' . esc_url(get_comment_link()) . '">#</a>';

--- a/wp-admin/includes/image.php
+++ b/wp-admin/includes/image.php
@@ -314,6 +314,12 @@ function wp_read_image_metadata( $file ) {
 			$meta[ $key ] = utf8_encode( $meta[ $key ] );
 	}

+	foreach ( $meta as &$value ) {
+		if ( is_string( $value ) ) {
+			$value = wp_kses_post( $value );
+		}
+	}
+
 	return apply_filters( 'wp_read_image_metadata', $meta, $file, $sourceImageType );

 }
--- a/wp-admin/includes/post.php
+++ b/wp-admin/includes/post.php
@@ -100,6 +100,10 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
 		$post_id = false;
 	$previous_status = $post_id ? get_post_field( 'post_status', $post_id ) : false;

+	if ( isset( $post_data['post_status'] ) && 'private' == $post_data['post_status'] && ! current_user_can( $ptype->cap->publish_posts ) ) {
+		$post_data['post_status'] = $previous_status ? $previous_status : 'pending';
+	}
+
 	$published_statuses = array( 'publish', 'future' );

 	// Posts 'submitted for approval' present are submitted to $_POST the same as if they were being published.
@@ -111,6 +115,10 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
 	if ( ! isset($post_data['post_status']) )
 		$post_data['post_status'] = $previous_status;

+	if ( isset( $post_data['post_password'] ) && ! current_user_can( $ptype->cap->publish_posts ) ) {
+		unset( $post_data['post_password'] );
+	}
+
 	if (!isset( $post_data['comment_status'] ))
 		$post_data['comment_status'] = 'closed';

@@ -158,6 +166,7 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
 * @return int Post ID.
 */
 function edit_post( $post_data = null ) {
+	global $wpdb;

 	if ( empty($post_data) )
 		$post_data = &$_POST;
@@ -170,6 +179,14 @@ function edit_post( $post_data = null ) {
 	$post_data['post_type'] = $post->post_type;
 	$post_data['post_mime_type'] = $post->post_mime_type;

+	if ( ! empty( $post_data['post_status'] ) ) {
+		$post_data['post_status'] = sanitize_key( $post_data['post_status'] );
+
+		if ( 'inherit' == $post_data['post_status'] ) {
+			unset( $post_data['post_status'] );
+		}
+	}
+
 	$ptype = get_post_type_object($post_data['post_type']);
 	if ( !current_user_can( 'edit_post', $post_ID ) ) {
 		if ( 'page' == $post_data['post_type'] )
@@ -187,13 +204,6 @@ function edit_post( $post_data = null ) {
 			_wp_upgrade_revisions_of_post( $post, wp_get_post_revisions( $post_ID ) );
 	}

-	$post_data = _wp_translate_postdata( true, $post_data );
-	if ( is_wp_error($post_data) )
-		wp_die( $post_data->get_error_message() );
-	if ( ( empty( $post_data['action'] ) || 'autosave' != $post_data['action'] ) && 'auto-draft' == $post_data['post_status'] ) {
-		$post_data['post_status'] = 'draft';
-	}
-
 	if ( isset($post_data['visibility']) ) {
 		switch ( $post_data['visibility'] ) {
 			case 'public' :
@@ -210,6 +220,14 @@ function edit_post( $post_data = null ) {
 		}
 	}

+	$post_data = _wp_translate_postdata( true, $post_data );
+	if ( is_wp_error($post_data) )
+		wp_die( $post_data->get_error_message() );
+
+	if ( ( empty( $post_data['action'] ) || 'autosave' != $post_data['action'] ) && 'auto-draft' == $post_data['post_status'] ) {
+		$post_data['post_status'] = 'draft';
+	}
+
 	// Post Formats
 	if ( isset( $post_data['post_format'] ) )
 		set_post_format( $post_ID, $post_data['post_format'] );
@@ -278,7 +296,19 @@ function edit_post( $post_data = null ) {

 	update_post_meta( $post_ID, '_edit_last', get_current_user_id() );

-	wp_update_post( $post_data );
+	$success = wp_update_post( $post_data );
+	// If the save failed, see if we can sanity check the main fields and try again
+	if ( ! $success && is_callable( array( $wpdb, 'strip_invalid_text_for_column' ) ) ) {
+		$fields = array( 'post_title', 'post_content', 'post_excerpt' );
+
+		foreach( $fields as $field ) {
+			if ( isset( $post_data[ $field ] ) ) {
+				$post_data[ $field ] = $wpdb->strip_invalid_text_for_column( $wpdb->posts, $field, $post_data[ $field ] );
+			}
+		}
+
+		wp_update_post( $post_data );
+	}

 	// Now that we have an ID we can fix any attachment anchor hrefs
 	_fix_attachment_links( $post_ID );
@@ -332,6 +362,14 @@ function bulk_edit_posts( $post_data = null ) {
 	}
 	unset($post_data['_status']);

+	if ( ! empty( $post_data['post_status'] ) ) {
+		$post_data['post_status'] = sanitize_key( $post_data['post_status'] );
+
+		if ( 'inherit' == $post_data['post_status'] ) {
+			unset( $post_data['post_status'] );
+		}
+	}
+
 	$post_IDs = array_map( 'intval', (array) $post_data['post'] );

 	$reset = array(
@@ -386,7 +424,12 @@ function bulk_edit_posts( $post_data = null ) {
 	}

 	$updated = $skipped = $locked = array();
+	$shared_post_data = $post_data;
+
 	foreach ( $post_IDs as $post_ID ) {
+		// Start with fresh post data with each iteration.
+		$post_data = $shared_post_data;
+
 		$post_type_object = get_post_type_object( get_post_type( $post_ID ) );

 		if ( !isset( $post_type_object ) || ( isset($children) && in_array($post_ID, $children) ) || !current_user_can( 'edit_post', $post_ID ) ) {
@@ -422,10 +465,25 @@ function bulk_edit_posts( $post_data = null ) {
 			unset( $post_data['tax_input']['category'] );
 		}

+		$post_data['post_type'] = $post->post_type;
 		$post_data['post_mime_type'] = $post->post_mime_type;
 		$post_data['guid'] = $post->guid;

+		foreach ( array( 'comment_status', 'ping_status', 'post_author' ) as $field ) {
+			if ( ! isset( $post_data[ $field ] ) ) {
+				$post_data[ $field ] = $post->$field;
+			}
+		}
+
 		$post_data['ID'] = $post_ID;
+		$post_data['post_ID'] = $post_ID;
+
+		$post_data = _wp_translate_postdata( true, $post_data );
+		if ( is_wp_error( $post_data ) ) {
+			$skipped[] = $post_ID;
+			continue;
+		}
+
 		$updated[] = wp_update_post( $post_data );

 		if ( isset( $post_data['sticky'] ) && current_user_can( $ptype->cap->edit_others_posts ) ) {
@@ -569,10 +627,6 @@ function wp_write_post() {
 	if ( isset( $_POST['post_ID'] ) )
 		return edit_post();

-	$translated = _wp_translate_postdata( false );
-	if ( is_wp_error($translated) )
-		return $translated;
-
 	if ( isset($_POST['visibility']) ) {
 		switch ( $_POST['visibility'] ) {
 			case 'public' :
@@ -589,6 +643,10 @@ function wp_write_post() {
 		}
 	}

+	$translated = _wp_translate_postdata( false );
+	if ( is_wp_error($translated) )
+		return $translated;
+
 	// Create the post.
 	$post_ID = wp_insert_post( $_POST );
 	if ( is_wp_error( $post_ID ) )
--- a/wp-admin/includes/template.php
+++ b/wp-admin/includes/template.php
@@ -1373,7 +1373,7 @@ function _draft_or_post_title( $post = 0 ) {
 	$title = get_the_title( $post );
 	if ( empty( $title ) )
 		$title = __( '(no title)' );
-	return $title;
+	return esc_html( $title );
 }

 /**
--- a/wp-admin/includes/update-core.php
+++ b/wp-admin/includes/update-core.php
@@ -697,6 +697,9 @@ function update_core($from, $to) {

 	// Check to see which files don't really need updating - only available for 3.7 and higher
 	if ( function_exists( 'get_core_checksums' ) ) {
+		// Find the local version of the working directory
+		$working_dir_local = WP_CONTENT_DIR . '/upgrade/' . basename( $from ) . $distro;
+
 		$checksums = get_core_checksums( $wp_version, isset( $wp_local_package ) ? $wp_local_package : 'en_US' );
 		if ( is_array( $checksums ) && isset( $checksums[ $wp_version ] ) )
 			$checksums = $checksums[ $wp_version ]; // Compat code for 3.7-beta2
@@ -706,6 +709,8 @@ function update_core($from, $to) {
 					continue;
 				if ( ! file_exists( ABSPATH . $file ) )
 					continue;
+				if ( ! file_exists( $working_dir_local . $file ) )
+					continue;
 				if ( md5_file( ABSPATH . $file ) === $checksum )
 					$skip[] = $file;
 				else
@@ -752,9 +757,10 @@ function update_core($from, $to) {
 	$failed = array();
 	if ( isset( $checksums ) && is_array( $checksums ) ) {
 		foreach ( $checksums as $file => $checksum ) {
-			if ( 0 === strpos( $file, 'wp-content' ) )
+			if ( 'wp-content' == substr( $file, 0, 10 ) )
+				continue;
+			if ( ! file_exists( $working_dir_local . $file ) )
 				continue;
-
 			if ( file_exists( ABSPATH . $file ) && md5_file( ABSPATH . $file ) == $checksum )
 				$skip[] = $file;
 			else
@@ -765,8 +771,6 @@ function update_core($from, $to) {
 	// Some files didn't copy properly
 	if ( ! empty( $failed ) ) {
 		$total_size = 0;
-		// Find the local version of the working directory
-		$working_dir_local = WP_CONTENT_DIR . '/upgrade/' . basename( $from ) . $distro;
 		foreach ( $failed as $file ) {
 			if ( file_exists( $working_dir_local . $file ) )
 				$total_size += filesize( $working_dir_local . $file );
@@ -882,6 +886,11 @@ function update_core($from, $to) {
 	$db_upgrade_url = admin_url('upgrade.php?step=upgrade_db');
 	wp_remote_post($db_upgrade_url, array('timeout' => 60));

+	// Clear the cache to prevent an update_option() from saving a stale db_version to the cache
+	wp_cache_flush();
+	// (Not all cache backends listen to 'flush')
+	wp_cache_delete( 'alloptions', 'options' );
+
 	// Remove working directory
 	$wp_filesystem->delete($from, true);

--- a/wp-admin/includes/update.php
+++ b/wp-admin/includes/update.php
@@ -364,7 +364,7 @@ function maintenance_nag() {
 		 * This flag is cleared whenever a successful update occurs using Core_Upgrader.
 		 */
 		$comparison = ! empty( $failed['critical'] ) ? '>=' : '>';
-		if ( version_compare( $failed['attempted'], $wp_version, '>=' ) )
+		if ( version_compare( $failed['attempted'], $wp_version, $comparison ) )
 			$nag = true;
 	}

--- a/wp-admin/includes/upgrade.php
+++ b/wp-admin/includes/upgrade.php
@@ -405,6 +405,12 @@ function upgrade_all() {
 	if ( $wp_current_db_version < 25824 )
 		upgrade_370();

+	if ( $wp_current_db_version < 26148 )
+		upgrade_372();
+
+	if ( $wp_current_db_version < 26149 )
+		upgrade_373();
+
 	maybe_disable_link_manager();

 	maybe_disable_automattic_widgets();
@@ -1222,6 +1228,47 @@ function upgrade_370() {
 		wp_clear_scheduled_hook( 'wp_auto_updates_maybe_update' );
 }

+/**
+ * Execute changes made in WordPress 3.7.2.
+ *
+ * @since 3.7.2
+ * @since 3.8.0
+ */
+function upgrade_372() {
+	global $wp_current_db_version;
+	if ( $wp_current_db_version < 26148 )
+		wp_clear_scheduled_hook( 'wp_maybe_auto_update' );
+}
+
+/**
+ * Execute changes made in WordPress 3.7.3.
+ *
+ * @since 3.7.3
+ */
+function upgrade_373() {
+	global $wp_current_db_version, $wpdb;
+	if ( $wp_current_db_version < 26149 ) {
+		// Find all lost Quick Draft auto-drafts and promote them to proper drafts.
+		$posts = $wpdb->get_results( "SELECT ID, post_title, post_content FROM $wpdb->posts WHERE post_type = 'post'
+			AND post_status = 'auto-draft' AND post_date >= '2014-04-08 00:00:00'" );
+
+		foreach ( $posts as $post ) {
+			// A regular auto-draft should never have content as that would mean it should have been promoted.
+			// If an auto-draft has content, it's from Quick Draft and it should be recovered.
+			if ( '' === $post->post_content ) {
+				// If it does not have content, we must evaluate whether the title should be recovered.
+				if ( 'Auto Draft' === $post->post_title || __( 'Auto Draft' ) === $post->post_title ) {
+					// This a plain old auto draft. Ignore it.
+					continue;
+				}
+			}
+
+			$wpdb->update( $wpdb->posts, array( 'post_status' => 'draft' ), array( 'ID' => $post->ID ) );
+			clean_post_cache( $post->ID );
+		}
+	}
+}
+
 /**
 * Execute network level changes
 *
--- a/wp-admin/js/nav-menu.js
+++ b/wp-admin/js/nav-menu.js
@@ -444,14 +444,14 @@ var wpNavMenu;
 				if ( ! isPrimaryMenuItem ) {
 					var thisLink = menuItem.find( '.menus-move-left' ),
 						thisLinkText = menus.outFrom.replace( '%s', prevItemNameLeft );
-					thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).html( thisLinkText ).css( 'display', 'inline' );
+					thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).text( thisLinkText ).css( 'display', 'inline' );
 				}

 				if ( 0 !== position ) {
 					if ( menuItem.find( '.menu-item-data-parent-id' ).val() !== menuItem.prev().find( '.menu-item-data-db-id' ).val() ) {
 						var thisLink = menuItem.find( '.menus-move-right' ),
 							thisLinkText = menus.under.replace( '%s', prevItemNameRight );
-						thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).html( thisLinkText ).css( 'display', 'inline' );
+						thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).text( thisLinkText ).css( 'display', 'inline' );
 					}
 				}

@@ -473,7 +473,7 @@ var wpNavMenu;
 						title = menus.subMenuFocus.replace( '%1$s', itemName ).replace( '%2$d', itemPosition ).replace( '%3$s', parentItemName );
 				}

-				$this.prop('title', title).html( title );
+				$this.prop('title', title).text( title );
 			});
 		},

--- a/wp-admin/js/nav-menu.min.js
+++ b/wp-admin/js/nav-menu.min.js
--- a/wp-admin/press-this.php
+++ b/wp-admin/press-this.php
@@ -65,7 +65,7 @@ function press_it() {
 	// error handling for media_sideload
 	if ( is_wp_error($upload) ) {
 		wp_delete_post($post_ID);
-		wp_die($upload);
+		wp_die( esc_html( $upload->get_error_message() ) );
 	} else {
 		// Post formats
 		if ( isset( $_POST['post_format'] ) ) {
--- a/wp-content/themes/twentyeleven/languages/twentyeleven.pot
+++ b/wp-content/themes/twentyeleven/languages/twentyeleven.pot
@@ -1,14 +1,14 @@
-# Copyright (C) 2013 the WordPress team
+# Copyright (C) 2014 the WordPress team
 # This file is distributed under the GNU General Public License v2 or later.
 msgid ""
 msgstr ""
 "Project-Id-Version: Twenty Eleven 1.7\n"
 "Report-Msgid-Bugs-To: http://wordpress.org/tags/twentyeleven\n"
-"POT-Creation-Date: 2013-10-24 19:42:42+00:00\n"
+"POT-Creation-Date: 2014-03-18 19:16:25+00:00\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"PO-Revision-Date: 2013-MO-DA HO:MI+ZONE\n"
+"PO-Revision-Date: 2014-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

--- a/wp-content/themes/twentyten/languages/twentyten.pot
+++ b/wp-content/themes/twentyten/languages/twentyten.pot
@@ -1,14 +1,14 @@
-# Copyright (C) 2013 the WordPress team
+# Copyright (C) 2014 the WordPress team
 # This file is distributed under the GNU General Public License v2 or later.
 msgid ""
 msgstr ""
 "Project-Id-Version: Twenty Ten 1.6\n"
 "Report-Msgid-Bugs-To: http://wordpress.org/tags/twentyten\n"
-"POT-Creation-Date: 2013-10-24 19:42:39+00:00\n"
+"POT-Creation-Date: 2014-03-18 19:16:24+00:00\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"PO-Revision-Date: 2013-MO-DA HO:MI+ZONE\n"
+"PO-Revision-Date: 2014-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

--- a/wp-content/themes/twentythirteen/languages/twentythirteen.pot
+++ b/wp-content/themes/twentythirteen/languages/twentythirteen.pot
@@ -1,14 +1,14 @@
-# Copyright (C) 2013 the WordPress team
+# Copyright (C) 2014 the WordPress team
 # This file is distributed under the GNU General Public License v2 or later.
 msgid ""
 msgstr ""
 "Project-Id-Version: Twenty Thirteen 1.1\n"
 "Report-Msgid-Bugs-To: http://wordpress.org/tags/twentythirteen\n"
-"POT-Creation-Date: 2013-10-24 20:32:07+00:00\n"
+"POT-Creation-Date: 2014-03-18 19:16:26+00:00\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"PO-Revision-Date: 2013-MO-DA HO:MI+ZONE\n"
+"PO-Revision-Date: 2014-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

--- a/wp-content/themes/twentytwelve/languages/twentytwelve.pot
+++ b/wp-content/themes/twentytwelve/languages/twentytwelve.pot
@@ -1,14 +1,14 @@
-# Copyright (C) 2013 the WordPress team
+# Copyright (C) 2014 the WordPress team
 # This file is distributed under the GNU General Public License v2 or later.
 msgid ""
 msgstr ""
 "Project-Id-Version: Twenty Twelve 1.3\n"
 "Report-Msgid-Bugs-To: http://wordpress.org/tags/twentytwelve\n"
-"POT-Creation-Date: 2013-10-24 20:32:05+00:00\n"
+"POT-Creation-Date: 2014-03-18 19:16:25+00:00\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"PO-Revision-Date: 2013-MO-DA HO:MI+ZONE\n"
+"PO-Revision-Date: 2014-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

--- a/wp-includes/ID3/getid3.lib.php
+++ b/wp-includes/ID3/getid3.lib.php
@@ -519,11 +519,12 @@ class getid3_lib
 	}

 	public static function XML2array($XMLstring) {
-		if (function_exists('simplexml_load_string')) {
-			if (function_exists('get_object_vars')) {
-				$XMLobject = simplexml_load_string($XMLstring);
-				return self::SimpleXMLelement2array($XMLobject);
-			}
+		if ( function_exists( 'simplexml_load_string' ) && function_exists( 'libxml_disable_entity_loader' ) ) {
+			$loader = libxml_disable_entity_loader( true );
+			$XMLobject = simplexml_load_string( $XMLstring, 'SimpleXMLElement', LIBXML_NOENT );
+			$return = self::SimpleXMLelement2array( $XMLobject );
+			libxml_disable_entity_loader( $loader );
+			return $return;
 		}
 		return false;
 	}
--- a/wp-includes/bookmark.php
+++ b/wp-includes/bookmark.php
@@ -208,8 +208,8 @@ function get_bookmarks($args = '') {
 		$join = " INNER JOIN $wpdb->term_relationships AS tr ON ($wpdb->links.link_id = tr.object_id) INNER JOIN $wpdb->term_taxonomy as tt ON tt.term_taxonomy_id = tr.term_taxonomy_id";
 	}

-	if ( $show_updated && get_option('links_recently_updated_time') ) {
-		$recently_updated_test = ", IF (DATE_ADD(link_updated, INTERVAL " . get_option('links_recently_updated_time') . " MINUTE) >= NOW(), 1,0) as recently_updated ";
+	if ( $show_updated ) {
+		$recently_updated_test = ", IF (DATE_ADD(link_updated, INTERVAL 120 MINUTE) >= NOW(), 1,0) as recently_updated ";
 	} else {
 		$recently_updated_test = '';
 	}
--- a/wp-includes/capabilities.php
+++ b/wp-includes/capabilities.php
@@ -1304,21 +1304,25 @@ function current_user_can( $capability ) {
 * @return bool
 */
 function current_user_can_for_blog( $blog_id, $capability ) {
-	if ( is_multisite() )
-		switch_to_blog( $blog_id );
+	$switched = is_multisite() ? switch_to_blog( $blog_id ) : false;

 	$current_user = wp_get_current_user();

-	if ( empty( $current_user ) )
+	if ( empty( $current_user ) ) {
+		if ( $switched ) {
+			restore_current_blog();
+		}
 		return false;
+	}

 	$args = array_slice( func_get_args(), 2 );
 	$args = array_merge( array( $capability ), $args );

 	$can = call_user_func_array( array( $current_user, 'has_cap' ), $args );

-	if ( is_multisite() )
+	if ( $switched ) {
 		restore_current_blog();
+	}

 	return $can;
 }
--- a/wp-includes/class-IXR.php
+++ b/wp-includes/class-IXR.php
@@ -203,11 +203,37 @@ class IXR_Message
    {
        // first remove the XML declaration
        // merged from WP #10698 - this method avoids the RAM usage of preg_replace on very large messages
-        $header = preg_replace( '/<\?xml.*?\?'.'>/', '', substr($this->message, 0, 100), 1);
-        $this->message = substr_replace($this->message, $header, 0, 100);
-        if (trim($this->message) == '') {
+        $header = preg_replace( '/<\?xml.*?\?'.'>/s', '', substr( $this->message, 0, 100 ), 1 );
+        $this->message = trim( substr_replace( $this->message, $header, 0, 100 ) );
+        if ( '' == $this->message ) {
            return false;
        }
+
+        // Then remove the DOCTYPE
+        $header = preg_replace( '/^<!DOCTYPE[^>]*+>/i', '', substr( $this->message, 0, 200 ), 1 );
+        $this->message = trim( substr_replace( $this->message, $header, 0, 200 ) );
+        if ( '' == $this->message ) {
+            return false;
+        }
+
+        // Check that the root tag is valid
+        $root_tag = substr( $this->message, 0, strcspn( substr( $this->message, 0, 20 ), "> \t\r\n" ) );
+        if ( '<!DOCTYPE' === strtoupper( $root_tag ) ) {
+            return false;
+        }
+        if ( ! in_array( $root_tag, array( '<methodCall', '<methodResponse', '<fault' ) ) ) {
+            return false;
+        }
+
+        // Bail if there are too many elements to parse
+        $element_limit = 30000;
+        if ( function_exists( 'apply_filters' ) ) {
+            $element_limit = apply_filters( 'xmlrpc_element_limit', $element_limit );
+        }
+        if ( $element_limit && 2 * $element_limit < substr_count( $this->message, '<' ) ) {
+            return false;
+        }
+
        $this->_parser = xml_parser_create();
        // Set XML parser to take the case of tags in to account
        xml_parser_set_option($this->_parser, XML_OPTION_CASE_FOLDING, false);
--- a/wp-includes/class-phpass.php
+++ b/wp-includes/class-phpass.php
@@ -214,6 +214,10 @@ class PasswordHash {

 	function HashPassword($password)
 	{
+		if ( strlen( $password ) > 4096 ) {
+			return '*';
+		}
+
 		$random = '';

 		if (CRYPT_BLOWFISH == 1 && !$this->portable_hashes) {
@@ -249,6 +253,10 @@ class PasswordHash {

 	function CheckPassword($password, $stored_hash)
 	{
+		if ( strlen( $password ) > 4096 ) {
+			return false;
+		}
+
 		$hash = $this->crypt_private($password, $stored_hash);
 		if ($hash[0] == '*')
 			$hash = crypt($password, $stored_hash);
--- a/wp-includes/class-wp-editor.php
+++ b/wp-includes/class-wp-editor.php
@@ -59,12 +59,6 @@ final class _WP_Editors {
 			// A cookie (set when a user resizes the editor) overrides the height.
 			$cookie = (int) get_user_setting( 'ed_size' );

-			// Upgrade an old TinyMCE cookie if it is still around, and the new one isn't.
-			if ( ! $cookie && isset( $_COOKIE['TinyMCE_content_size'] ) ) {
-				parse_str( $_COOKIE['TinyMCE_content_size'], $cookie );
- 				$cookie = $cookie['ch'];
-			}
-
 			if ( $cookie )
 				$set['editor_height'] = $cookie;
 		}
--- a/wp-includes/class-wp-xmlrpc-server.php
+++ b/wp-includes/class-wp-xmlrpc-server.php
@@ -5391,11 +5391,18 @@ class wp_xmlrpc_server extends IXR_Server {
 		// very stupid, but gives time to the 'from' server to publish !
 		sleep(1);

+		$remote_ip = preg_replace( '/[^0-9a-fA-F:., ]/', '', $_SERVER['REMOTE_ADDR'] );
+		$user_agent = apply_filters( 'http_headers_useragent', 'WordPress/' . $GLOBALS['wp_version'] . '; ' . get_bloginfo( 'url' ) );
+
 		// Let's check the remote site
 		$http_api_args = array(
 			'timeout' => 10,
 			'redirection' => 0,
 			'limit_response_size' => 153600, // 150 KB
+			'user-agent' => "$user_agent; verifying pingback from $remote_ip",
+			'headers' => array(
+				'X-Pingback-Forwarded-For' => $remote_ip,
+			),
 		);
 		$linea = wp_remote_retrieve_body( wp_safe_remote_get( $pagelinkedfrom, $http_api_args ) );

--- a/wp-includes/compat.php
+++ b/wp-includes/compat.php
@@ -94,3 +94,32 @@ if ( !function_exists('json_decode') ) {
 		return is_array($data) ? array_map(__FUNCTION__, $data) : $data;
 	}
 }
+
+if ( ! function_exists( 'hash_equals' ) ) :
+/**
+ * Compare two strings in constant time.
+ *
+ * This function was added in PHP 5.6.
+ * It can leak the length of a string.
+ *
+ * @since 3.9.2
+ *
+ * @param string $a Expected string.
+ * @param string $b Actual string.
+ * @return bool Whether strings are equal.
+ */
+function hash_equals( $a, $b ) {
+	$a_length = strlen( $a );
+	if ( $a_length !== strlen( $b ) ) {
+		return false;
+	}
+	$result = 0;
+
+	// Do not attempt to "optimize" this.
+	for ( $i = 0; $i < $a_length; $i++ ) {
+		$result |= ord( $a[ $i ] ) ^ ord( $b[ $i ] );
+	}
+
+	return $result === 0;
+}
+endif;
--- a/wp-includes/cron.php
+++ b/wp-includes/cron.php
@@ -160,8 +160,19 @@ function wp_clear_scheduled_hook( $hook, $args = array() ) {
 		$args = array_slice( func_get_args(), 1 );
 	}

-	while ( $timestamp = wp_next_scheduled( $hook, $args ) )
-		wp_unschedule_event( $timestamp, $hook, $args );
+	// This logic duplicates wp_next_scheduled()
+	// It's required due to a scenario where wp_unschedule_event() fails due to update_option() failing,
+	// and, wp_next_scheduled() returns the same schedule in an infinite loop.
+	$crons = _get_cron_array();
+	if ( empty( $crons ) )
+		return;
+
+	$key = md5( serialize( $args ) );
+	foreach ( $crons as $timestamp => $cron ) {
+		if ( isset( $cron[ $hook ][ $key ] ) ) {
+			wp_unschedule_event( $timestamp, $hook, $args );
+		}
+	}
 }

 /**
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -107,7 +107,14 @@ function wptexturize($text) {
 	$no_texturize_tags_stack = array();
 	$no_texturize_shortcodes_stack = array();

-	$textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE);
+	// Look for shortcodes and HTML elements.
+	
+	$shortcode_regex =
+		  '\['          // Find start of shortcode.
+		. '[^\[\]<>]++' // Shortcodes do not contain other shortcodes. Possessive critical.
+		. '\]';         // Find end of shortcode.
+
+	$textarr = preg_split("/(<[^>]*>|$shortcode_regex)/s", $text, -1, PREG_SPLIT_DELIM_CAPTURE);

 	foreach ( $textarr as &$curl ) {
 		if ( empty( $curl ) )
@@ -117,7 +124,7 @@ function wptexturize($text) {
 		$first = $curl[0];
 		if ( '<' === $first ) {
 			_wptexturize_pushpop_element($curl, $no_texturize_tags_stack, $no_texturize_tags, '<', '>');
-		} elseif ( '[' === $first ) {
+		} elseif ( '[' === $first && 1 === preg_match( '/^' . $shortcode_regex . '$/', $curl ) ) {
 			_wptexturize_pushpop_element($curl, $no_texturize_shortcodes_stack, $no_texturize_shortcodes, '[', ']');
 		} elseif ( empty($no_texturize_shortcodes_stack) && empty($no_texturize_tags_stack) ) {
 			// This is not a tag, nor is the texturization disabled static strings
@@ -158,6 +165,8 @@ function _wptexturize_pushpop_element($text, &$stack, $disabled_elements, $openi

 			array_push($stack, $matches[1]);
 		}
+	} elseif ( 0 == count( $stack ) ) {
+		// Stack is empty. Just stop.
 	} else {
 		// Closing? Check $text+2 against disabled elements
 		$c = preg_quote($closing, '/');
@@ -1044,21 +1053,23 @@ function sanitize_title_with_dashes( $title, $raw_title = '', $context = 'displa
 }

 /**
- * Ensures a string is a valid SQL order by clause.
+ * Ensures a string is a valid SQL 'order by' clause.
 *
- * Accepts one or more columns, with or without ASC/DESC, and also accepts
- * RAND().
+ * Accepts one or more columns, with or without a sort order (ASC / DESC).
+ * e.g. 'column_1', 'column_1, column_2', 'column_1 ASC, column_2 DESC' etc.
+ *
+ * Also accepts 'RAND()'.
 *
 * @since 2.5.1
 *
- * @param string $orderby Order by string to be checked.
- * @return string|bool Returns the order by clause if it is a match, false otherwise.
+ * @param string $orderby Order by clause to be validated.
+ * @return string|bool Returns $orderby if valid, false otherwise.
 */
-function sanitize_sql_orderby( $orderby ){
-	preg_match('/^\s*([a-z0-9_]+(\s+(ASC|DESC))?(\s*,\s*|\s*$))+|^\s*RAND\(\s*\)\s*$/i', $orderby, $obmatches);
-	if ( !$obmatches )
-		return false;
-	return $orderby;
+function sanitize_sql_orderby( $orderby ) {
+	if ( preg_match( '/^\s*(([a-z0-9_]+|`[a-z0-9_]+`)(\s+(ASC|DESC))?\s*(,\s*(?=[a-z0-9_`])|$))+$/i', $orderby ) || preg_match( '/^\s*RAND\(\s*\)\s*$/i', $orderby ) ) {
+		return $orderby;
+	}
+	return false;
 }

 /**
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -1372,14 +1372,23 @@ function wp_mkdir_p( $target ) {
 	}

 	// Get the permission bits.
-	if ( $target_parent && '.' != $target_parent ) {
-		$stat = @stat( $target_parent );
+	$dir_perms = false;
+	if ( $stat = @stat( $target_parent ) ) {
 		$dir_perms = $stat['mode'] & 0007777;
 	} else {
 		$dir_perms = 0777;
 	}

 	if ( @mkdir( $target, $dir_perms, true ) ) {
+
+		// If a umask is set that modifies $dir_perms, we'll have to re-set the $dir_perms correctly with chmod()
+		if ( $dir_perms != ( $dir_perms & ~umask() ) ) {
+			$folder_parts = explode( '/', substr( $target, strlen( $target_parent ) + 1 ) );
+			for ( $i = 1; $i <= count( $folder_parts ); $i++ ) {
+				@chmod( $target_parent . '/' . implode( '/', array_slice( $folder_parts, 0, $i ) ), $dir_perms );
+			}
+		}
+
 		return true;
 	}

--- a/wp-includes/http.php
+++ b/wp-includes/http.php
@@ -451,8 +451,9 @@ function send_origin_headers() {
 * @return mixed URL or false on failure.
 */
 function wp_http_validate_url( $url ) {
+	$original_url = $url;
 	$url = wp_kses_bad_protocol( $url, array( 'http', 'https' ) );
-	if ( ! $url )
+	if ( ! $url || strtolower( $url ) !== strtolower( $original_url ) )
 		return false;

 	$parsed_url = @parse_url( $url );
@@ -462,7 +463,7 @@ function wp_http_validate_url( $url ) {
 	if ( isset( $parsed_url['user'] ) || isset( $parsed_url['pass'] ) )
 		return false;

-	if ( false !== strpos( $parsed_url['host'], ':' ) )
+	if ( false !== strpbrk( $parsed_url['host'], ':#?[]' ) )
 		return false;

 	$parsed_home = @parse_url( get_option( 'home' ) );
@@ -480,8 +481,7 @@ function wp_http_validate_url( $url ) {
 		}
 		if ( $ip ) {
 			$parts = array_map( 'intval', explode( '.', $ip ) );
-			if ( '127.0.0.1' === $ip
-				|| ( 10 === $parts[0] )
+			if ( 127 === $parts[0] || 10 === $parts[0]
 				|| ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
 				|| ( 192 === $parts[0] && 168 === $parts[1] )
 			) {
--- a/wp-includes/js/plupload/plupload.silverlight.xap
+++ b/wp-includes/js/plupload/plupload.silverlight.xap
--- a/wp-includes/kses.php
+++ b/wp-includes/kses.php
@@ -1405,7 +1405,7 @@ function safecss_filter_attr( $css, $deprecated = '' ) {
 	$css = wp_kses_no_null($css);
 	$css = str_replace(array("\n","\r","\t"), '', $css);

-	if ( preg_match( '%[\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
+	if ( preg_match( '%[\\\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
 		return '';

 	$css_array = explode( ';', trim( $css ) );
--- a/wp-includes/option.php
+++ b/wp-includes/option.php
@@ -757,7 +757,8 @@ function get_site_option( $option, $default = false, $use_cache = true ) {
 		return $pre;

 	// prevent non-existent options from triggering multiple queries
-	$notoptions = wp_cache_get( 'notoptions', 'site-options' );
+	$notoptions_key = "{$wpdb->siteid}:notoptions";
+	$notoptions = wp_cache_get( $notoptions_key, 'site-options' );
 	if ( isset( $notoptions[$option] ) )
 		return apply_filters( 'default_site_option_' . $option, $default );

@@ -779,7 +780,7 @@ function get_site_option( $option, $default = false, $use_cache = true ) {
 				wp_cache_set( $cache_key, $value, 'site-options' );
 			} else {
 				$notoptions[$option] = true;
-				wp_cache_set( 'notoptions', $notoptions, 'site-options' );
+				wp_cache_set( $notoptions_key, $notoptions, 'site-options' );
 				$value = apply_filters( 'default_site_option_' . $option, $default );
 			}
 		}
@@ -812,6 +813,7 @@ function add_site_option( $option, $value ) {
 	wp_protect_special_option( $option );

 	$value = apply_filters( 'pre_add_site_option_' . $option, $value );
+	$notoptions_key = "{$wpdb->siteid}:notoptions";

 	if ( !is_multisite() ) {
 		$result = add_option( $option, $value );
@@ -819,7 +821,7 @@ function add_site_option( $option, $value ) {
 		$cache_key = "{$wpdb->siteid}:$option";

 		// Make sure the option doesn't already exist. We can check the 'notoptions' cache before we ask for a db query
-		$notoptions = wp_cache_get( 'notoptions', 'site-options' );
+		$notoptions = wp_cache_get( $notoptions_key, 'site-options' );
 		if ( ! is_array( $notoptions ) || ! isset( $notoptions[$option] ) )
 			if ( false !== get_site_option( $option ) )
 				return false;
@@ -835,10 +837,10 @@ function add_site_option( $option, $value ) {
 		wp_cache_set( $cache_key, $value, 'site-options' );

 		// This option exists now
-		$notoptions = wp_cache_get( 'notoptions', 'site-options' ); // yes, again... we need it to be fresh
+		$notoptions = wp_cache_get( $notoptions_key, 'site-options' ); // yes, again... we need it to be fresh
 		if ( is_array( $notoptions ) && isset( $notoptions[$option] ) ) {
 			unset( $notoptions[$option] );
-			wp_cache_set( 'notoptions', $notoptions, 'site-options' );
+			wp_cache_set( $notoptions_key, $notoptions, 'site-options' );
 		}
 	}

@@ -922,10 +924,11 @@ function update_site_option( $option, $value ) {
 	if ( false === $old_value )
 		return add_site_option( $option, $value );

-	$notoptions = wp_cache_get( 'notoptions', 'site-options' );
+	$notoptions_key = "{$wpdb->siteid}:notoptions";
+	$notoptions = wp_cache_get( $notoptions_key, 'site-options' );
 	if ( is_array( $notoptions ) && isset( $notoptions[$option] ) ) {
 		unset( $notoptions[$option] );
-		wp_cache_set( 'notoptions', $notoptions, 'site-options' );
+		wp_cache_set( $notoptions_key, $notoptions, 'site-options' );
 	}

 	if ( !is_multisite() ) {
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -546,7 +546,7 @@ function wp_validate_auth_cookie($cookie = '', $scheme = '') {
 	$key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
 	$hash = hash_hmac('md5', $username . '|' . $expiration, $key);

-	if ( $hmac != $hash ) {
+	if ( ! hash_equals( $hash, $hmac ) ) {
 		do_action('auth_cookie_bad_hash', $cookie_elements);
 		return false;
 	}
@@ -1297,11 +1297,17 @@ function wp_verify_nonce($nonce, $action = -1) {
 	$i = wp_nonce_tick();

 	// Nonce generated 0-12 hours ago
-	if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) === $nonce )
+	$expected = substr( wp_hash( $i . '|' . $action . '|' . $uid, 'nonce'), -12, 10 );
+	if ( hash_equals( $expected, $nonce ) ) {
 		return 1;
+	}
+
 	// Nonce generated 12-24 hours ago
-	if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) === $nonce )
+	$expected = substr( wp_hash( ( $i - 1 ) . '|' . $action . '|' . $uid, 'nonce' ), -12, 10 );
+	if ( hash_equals( $expected, $nonce ) ) {
 		return 2;
+	}
+
 	// Invalid nonce
 	return false;
 }
@@ -1324,7 +1330,7 @@ function wp_create_nonce($action = -1) {

 	$i = wp_nonce_tick();

-	return substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10);
+	return substr(wp_hash($i . '|' . $action . '|' . $uid, 'nonce'), -12, 10);
 }
 endif;

@@ -1486,7 +1492,7 @@ function wp_check_password($password, $hash, $user_id = '') {

 	// If the hash is still md5...
 	if ( strlen($hash) <= 32 ) {
-		$check = ( $hash == md5($password) );
+		$check = hash_equals( $hash, md5( $password ) );
 		if ( $check && $user_id ) {
 			// Rehash using new hash.
 			wp_set_password($password, $user_id);
@@ -1703,7 +1709,8 @@ function get_avatar( $id_or_email, $size = '96', $default = '', $alt = false ) {
 		$out = str_replace( '&#038;', '&amp;', esc_url( $out ) );
 		$avatar = "<img alt='{$safe_alt}' src='{$out}' class='avatar avatar-{$size} photo' height='{$size}' width='{$size}' />";
 	} else {
-		$avatar = "<img alt='{$safe_alt}' src='{$default}' class='avatar avatar-{$size} photo avatar-default' height='{$size}' width='{$size}' />";
+		$out = esc_url( $default );
+		$avatar = "<img alt='{$safe_alt}' src='{$out}' class='avatar avatar-{$size} photo avatar-default' height='{$size}' width='{$size}' />";
 	}

 	return apply_filters('get_avatar', $avatar, $id_or_email, $size, $default, $alt);
@@ -1784,3 +1791,35 @@ function wp_text_diff( $left_string, $right_string, $args = null ) {
 }
 endif;

+if ( ! function_exists( 'hash_equals' ) ) :
+/**
+ * Compare two strings in constant time.
+ *
+ * This function is NOT pluggable. It is in this file (in addition to
+ * compat.php) to prevent errors if, during an update, pluggable.php
+ * copies over but compat.php does not.
+ *
+ * This function was added in PHP 5.6.
+ * It can leak the length of a string.
+ *
+ * @since 3.9.2
+ *
+ * @param string $a Expected string.
+ * @param string $b Actual string.
+ * @return bool Whether strings are equal.
+ */
+function hash_equals( $a, $b ) {
+	$a_length = strlen( $a );
+	if ( $a_length !== strlen( $b ) ) {
+		return false;
+	}
+	$result = 0;
+
+	// Do not attempt to "optimize" this.
+	for ( $i = 0; $i < $a_length; $i++ ) {
+		$result |= ord( $a[ $i ] ) ^ ord( $b[ $i ] );
+	}
+
+	return $result === 0;
+}
+endif;
--- a/wp-includes/update.php
+++ b/wp-includes/update.php
@@ -160,9 +160,10 @@ function wp_version_check( $extra_stats = array() ) {
 * @since 2.3.0
 * @uses $wp_version Used to notify the WordPress version.
 *
+ * @param array $extra_stats Extra statistics to report to the WordPress.org API.
 * @return mixed Returns null if update is unsupported. Returns false if check is too soon.
 */
-function wp_update_plugins() {
+function wp_update_plugins( $extra_stats = array() ) {
 	include ABSPATH . WPINC . '/version.php'; // include an unmodified $wp_version

 	if ( defined('WP_INSTALLING') )
@@ -201,7 +202,7 @@ function wp_update_plugins() {

 	$time_not_changed = isset( $current->last_checked ) && $timeout > ( time() - $current->last_checked );

-	if ( $time_not_changed ) {
+	if ( $time_not_changed && ! $extra_stats ) {
 		$plugin_changed = false;
 		foreach ( $plugins as $file => $p ) {
 			$new_option->checked[ $file ] = $p['Version'];
@@ -250,6 +251,10 @@ function wp_update_plugins() {
 		'user-agent' => 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' )
 	);

+	if ( $extra_stats ) {
+		$options['body']['update_stats'] = json_encode( $extra_stats );
+	}
+
 	$url = $http_url = 'http://api.wordpress.org/plugins/update-check/1.1/';
 	if ( $ssl = wp_http_supports( array( 'ssl' ) ) )
 		$url = set_url_scheme( $url, 'https' );
@@ -291,9 +296,10 @@ function wp_update_plugins() {
 * @since 2.7.0
 * @uses $wp_version Used to notify the WordPress version.
 *
+ * @param array $extra_stats Extra statistics to report to the WordPress.org API.
 * @return mixed Returns null if update is unsupported. Returns false if check is too soon.
 */
-function wp_update_themes() {
+function wp_update_themes( $extra_stats = array() ) {
 	include ABSPATH . WPINC . '/version.php'; // include an unmodified $wp_version

 	if ( defined( 'WP_INSTALLING' ) )
@@ -343,7 +349,7 @@ function wp_update_themes() {

 	$time_not_changed = isset( $last_update->last_checked ) && $timeout > ( time() - $last_update->last_checked );

-	if ( $time_not_changed ) {
+	if ( $time_not_changed && ! $extra_stats ) {
 		$theme_changed = false;
 		foreach ( $checked as $slug => $v ) {
 			if ( !isset( $last_update->checked[ $slug ] ) || strval($last_update->checked[ $slug ]) !== strval($v) )
@@ -390,6 +396,10 @@ function wp_update_themes() {
 		'user-agent'	=> 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' )
 	);

+	if ( $extra_stats ) {
+		$options['body']['update_stats'] = json_encode( $extra_stats );
+	}
+
 	$url = $http_url = 'http://api.wordpress.org/themes/update-check/1.1/';
 	if ( $ssl = wp_http_supports( array( 'ssl' ) ) )
 		$url = set_url_scheme( $url, 'https' );
@@ -584,6 +594,8 @@ function wp_schedule_update_checks() {
 			$next += 12 * HOUR_IN_SECONDS;
 		}
 		$next = $next - get_option( 'gmt_offset' ) * HOUR_IN_SECONDS;
+		// Add a random number of minutes, so we don't have all sites trying to update exactly on the hour
+		$next = $next + rand( 0, 59 ) * MINUTE_IN_SECONDS;
 		wp_schedule_event( $next, 'twicedaily', 'wp_maybe_auto_update' );
 	}
 }
@@ -600,14 +612,14 @@ add_action( 'load-update.php', 'wp_update_plugins' );
 add_action( 'load-update-core.php', 'wp_update_plugins' );
 add_action( 'admin_init', '_maybe_update_plugins' );
 add_action( 'wp_update_plugins', 'wp_update_plugins' );
-add_action( 'upgrader_process_complete', 'wp_update_plugins' );
+add_action( 'upgrader_process_complete', 'wp_update_plugins', 10, 0 );

 add_action( 'load-themes.php', 'wp_update_themes' );
 add_action( 'load-update.php', 'wp_update_themes' );
 add_action( 'load-update-core.php', 'wp_update_themes' );
 add_action( 'admin_init', '_maybe_update_themes' );
 add_action( 'wp_update_themes', 'wp_update_themes' );
-add_action( 'upgrader_process_complete', 'wp_update_themes' );
+add_action( 'upgrader_process_complete', 'wp_update_themes', 10, 0 );

 add_action( 'wp_maybe_auto_update', 'wp_maybe_auto_update' );

--- a/wp-includes/user.php
+++ b/wp-includes/user.php
@@ -1415,6 +1415,9 @@ function wp_insert_user( $userdata ) {
 	$data = wp_unslash( $data );

 	if ( $update ) {
+		if ( $user_email !== $old_user_data->user_email ) {
+			$data['user_activation_key'] = '';
+		}
 		$wpdb->update( $wpdb->users, $data, compact( 'ID' ) );
 		$user_id = (int) $ID;
 	} else {
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,14 +4,14 @@
 *
 * @global string $wp_version
 */
-$wp_version = '3.7.1';
+$wp_version = '3.7.7';

 /**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
 *
 * @global int $wp_db_version
 */
-$wp_db_version = 25824;
+$wp_db_version = 26149;

 /**
 * Holds the TinyMCE version
--- a/wp-includes/wp-db.php
+++ b/wp-includes/wp-db.php
@@ -139,6 +139,43 @@ class wpdb {
 	 */
 	protected $result;

+	/**
+	 * Cached column info, for sanity checking data before inserting
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 * @var array
+	 */
+	protected $col_meta = array();
+
+	/**
+	 * Calculated character sets on tables
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 * @var array
+	 */
+	protected $table_charset = array();
+
+	/**
+	 * Whether text fields in the current query need to be sanity checked.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 * @var bool
+	 */
+	protected $check_current_query = true;
+
+	/**
+	 * Flag to ensure we don't run into recursion problems when checking the collation.
+	 *
+	 * @since 4.2.0
+	 * @access private
+	 * @see wpdb::check_safe_collation()
+	 * @var boolean
+	 */
+	private $checking_collation = false;
+
 	/**
 	 * Saved info on the table column
 	 *
@@ -575,6 +612,14 @@ class wpdb {
 	 * @param mixed  $value The value to set
 	 */
 	function __set( $name, $value ) {
+		$protected_members = array(
+			'col_meta',
+			'table_charset',
+			'check_current_query',
+		);
+		if (  in_array( $name, $protected_members, true ) ) {
+			return;
+		}
 		$this->$name = $value;
 	}

@@ -1178,8 +1223,11 @@ class wpdb {
 	 * @return int|false Number of rows affected/selected or false on error
 	 */
 	function query( $query ) {
-		if ( ! $this->ready )
+		if ( ! $this->ready ) {
+			$this->check_current_query = true;
 			return false;
+		}
+
 		/**
 		 * Filter the database query.
 		 *
@@ -1196,6 +1244,20 @@ class wpdb {
 		// Log how the function was called
 		$this->func_call = "\$db->query(\"$query\")";

+		// If we're writing to the database, make sure the query will write safely.
+		if ( $this->check_current_query && ! $this->check_ascii( $query ) ) {
+			$stripped_query = $this->strip_invalid_text_from_query( $query );
+			// strip_invalid_text_from_query() can perform queries, so we need
+			// to flush again, just to make sure everything is clear.
+			$this->flush();
+			if ( $stripped_query !== $query ) {
+				$this->insert_id = 0;
+				return false;
+			}
+		}
+
+		$this->check_current_query = true;
+
 		// Keep track of the last query for debug..
 		$this->last_query = $query;

@@ -1309,23 +1371,29 @@ class wpdb {
 	 * @return int|false The number of rows affected, or false on error.
 	 */
 	function _insert_replace_helper( $table, $data, $format = null, $type = 'INSERT' ) {
-		if ( ! in_array( strtoupper( $type ), array( 'REPLACE', 'INSERT' ) ) )
+		if ( ! in_array( strtoupper( $type ), array( 'REPLACE', 'INSERT' ) ) ) {
 			return false;
-		$this->insert_id = 0;
-		$formats = $format = (array) $format;
-		$fields = array_keys( $data );
-		$formatted_fields = array();
-		foreach ( $fields as $field ) {
-			if ( !empty( $format ) )
-				$form = ( $form = array_shift( $formats ) ) ? $form : $format[0];
-			elseif ( isset( $this->field_types[$field] ) )
-				$form = $this->field_types[$field];
-			else
-				$form = '%s';
-			$formatted_fields[] = $form;
 		}
-		$sql = "{$type} INTO `$table` (`" . implode( '`,`', $fields ) . "`) VALUES (" . implode( ",", $formatted_fields ) . ")";
-		return $this->query( $this->prepare( $sql, $data ) );
+
+		$data = $this->process_fields( $table, $data, $format );
+		if ( false === $data ) {
+			return false;
+		}
+
+		$formats = $values = array();
+		foreach ( $data as $value ) {
+			$formats[] = $value['format'];
+			$values[]  = $value['value'];
+		}
+
+		$fields  = '`' . implode( '`, `', array_keys( $data ) ) . '`';
+		$formats = implode( ', ', $formats );
+
+		$sql = "$type INTO `$table` ($fields) VALUES ($formats)";
+
+		$this->insert_id = 0;
+		$this->check_current_query = false;
+		return $this->query( $this->prepare( $sql, $values ) );
 	}

 	/**
@@ -1350,34 +1418,36 @@ class wpdb {
 	 * @return int|false The number of rows updated, or false on error.
 	 */
 	function update( $table, $data, $where, $format = null, $where_format = null ) {
-		if ( ! is_array( $data ) || ! is_array( $where ) )
+		if ( ! is_array( $data ) || ! is_array( $where ) ) {
 			return false;
-
-		$formats = $format = (array) $format;
-		$bits = $wheres = array();
-		foreach ( (array) array_keys( $data ) as $field ) {
-			if ( !empty( $format ) )
-				$form = ( $form = array_shift( $formats ) ) ? $form : $format[0];
-			elseif ( isset($this->field_types[$field]) )
-				$form = $this->field_types[$field];
-			else
-				$form = '%s';
-			$bits[] = "`$field` = {$form}";
 		}

-		$where_formats = $where_format = (array) $where_format;
-		foreach ( (array) array_keys( $where ) as $field ) {
-			if ( !empty( $where_format ) )
-				$form = ( $form = array_shift( $where_formats ) ) ? $form : $where_format[0];
-			elseif ( isset( $this->field_types[$field] ) )
-				$form = $this->field_types[$field];
-			else
-				$form = '%s';
-			$wheres[] = "`$field` = {$form}";
+		$data = $this->process_fields( $table, $data, $format );
+		if ( false === $data ) {
+			return false;
+		}
+		$where = $this->process_fields( $table, $where, $where_format );
+		if ( false === $where ) {
+			return false;
 		}

-		$sql = "UPDATE `$table` SET " . implode( ', ', $bits ) . ' WHERE ' . implode( ' AND ', $wheres );
-		return $this->query( $this->prepare( $sql, array_merge( array_values( $data ), array_values( $where ) ) ) );
+		$fields = $conditions = $values = array();
+		foreach ( $data as $field => $value ) {
+			$fields[] = "`$field` = " . $value['format'];
+			$values[] = $value['value'];
+		}
+		foreach ( $where as $field => $value ) {
+			$conditions[] = "`$field` = " . $value['format'];
+			$values[] = $value['value'];
+		}
+
+		$fields = implode( ', ', $fields );
+		$conditions = implode( ' AND ', $conditions );
+
+		$sql = "UPDATE `$table` SET $fields WHERE $conditions";
+
+		$this->check_current_query = false;
+		return $this->query( $this->prepare( $sql, $values ) );
 	}

 	/**
@@ -1399,30 +1469,135 @@ class wpdb {
 	 * @return int|false The number of rows updated, or false on error.
 	 */
 	function delete( $table, $where, $where_format = null ) {
-		if ( ! is_array( $where ) )
+		if ( ! is_array( $where ) ) {
 			return false;
-
-		$bits = $wheres = array();
-
-		$where_formats = $where_format = (array) $where_format;
-
-		foreach ( array_keys( $where ) as $field ) {
-			if ( !empty( $where_format ) ) {
-				$form = ( $form = array_shift( $where_formats ) ) ? $form : $where_format[0];
-			} elseif ( isset( $this->field_types[ $field ] ) ) {
-				$form = $this->field_types[ $field ];
-			} else {
-				$form = '%s';
-			}
-
-			$wheres[] = "$field = $form";
 		}

-		$sql = "DELETE FROM $table WHERE " . implode( ' AND ', $wheres );
-		return $this->query( $this->prepare( $sql, $where ) );
+		$where = $this->process_fields( $table, $where, $where_format );
+		if ( false === $where ) {
+			return false;
+		}
+
+		$conditions = $values = array();
+		foreach ( $where as $field => $value ) {
+			$conditions[] = "`$field` = " . $value['format'];
+			$values[] = $value['value'];
+		}
+
+		$conditions = implode( ' AND ', $conditions );
+
+		$sql = "DELETE FROM `$table` WHERE $conditions";
+
+		$this->check_current_query = false;
+		return $this->query( $this->prepare( $sql, $values ) );
 	}


+	/**
+	 * Processes arrays of field/value pairs and field formats.
+	 *
+	 * This is a helper method for wpdb's CRUD methods, which take field/value
+	 * pairs for inserts, updates, and where clauses. This method first pairs
+	 * each value with a format. Then it determines the charset of that field,
+	 * using that to determine if any invalid text would be stripped. If text is
+	 * stripped, then field processing is rejected and the query fails.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param string $table  Table name.
+	 * @param array  $data   Field/value pair.
+	 * @param mixed  $format Format for each field.
+	 * @return array|bool Returns an array of fields that contain paired values
+	 *                    and formats. Returns false for invalid values.
+	 */
+	protected function process_fields( $table, $data, $format ) {
+		$data = $this->process_field_formats( $data, $format );
+		$data = $this->process_field_charsets( $data, $table );
+		if ( false === $data ) {
+			return false;
+		}
+
+		$converted_data = $this->strip_invalid_text( $data );
+
+		if ( $data !== $converted_data ) {
+			return false;
+		}
+
+		return $data;
+	}
+
+	/**
+	 * Prepares arrays of value/format pairs as passed to wpdb CRUD methods.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param array $data   Array of fields to values.
+	 * @param mixed $format Formats to be mapped to the values in $data.
+	 * @return array Array, keyed by field names with values being an array
+	 *               of 'value' and 'format' keys.
+	 */
+	protected function process_field_formats( $data, $format ) {
+		$formats = $original_formats = (array) $format;
+
+		foreach ( $data as $field => $value ) {
+			$value = array(
+				'value'  => $value,
+				'format' => '%s',
+			);
+
+			if ( ! empty( $format ) ) {
+				$value['format'] = array_shift( $formats );
+				if ( ! $value['format'] ) {
+					$value['format'] = reset( $original_formats );
+				}
+			} elseif ( isset( $this->field_types[ $field ] ) ) {
+				$value['format'] = $this->field_types[ $field ];
+			}
+
+			$data[ $field ] = $value;
+		}
+
+		return $data;
+	}
+
+	/**
+	 * Adds field charsets to field/value/format arrays generated by
+	 * the {@see wpdb::process_field_formats()} method.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param array  $data  As it comes from the {@see wpdb::process_field_formats()} method.
+	 * @param string $table Table name.
+	 * @return The same array as $data with additional 'charset' keys.
+	 */
+	protected function process_field_charsets( $data, $table ) {
+		foreach ( $data as $field => $value ) {
+			if ( '%d' === $value['format'] || '%f' === $value['format'] ) {
+				// We can skip this field if we know it isn't a string.
+				// This checks %d/%f versus ! %s because it's sprintf() could take more.
+				$value['charset'] = false;
+			} elseif ( $this->check_ascii( $value['value'] ) ) {
+				// If it's ASCII, then we don't need the charset. We can skip this field.
+				$value['charset'] = false;
+			} else {
+				$value['charset'] = $this->get_col_charset( $table, $field );
+				if ( is_wp_error( $value['charset'] ) ) {
+					return false;
+				}
+
+				// This isn't ASCII. Don't have strip_invalid_text() re-check.
+				$value['ascii'] = false;
+			}
+
+			$data[ $field ] = $value;
+		}
+
+		return $data;
+	}
+
 	/**
 	 * Retrieve one variable from the database.
 	 *
@@ -1439,6 +1614,11 @@ class wpdb {
 	 */
 	function get_var( $query = null, $x = 0, $y = 0 ) {
 		$this->func_call = "\$db->get_var(\"$query\", $x, $y)";
+
+		if ( $this->check_safe_collation( $query ) ) {
+			$this->check_current_query = false;
+		}
+
 		if ( $query )
 			$this->query( $query );

@@ -1466,6 +1646,11 @@ class wpdb {
 	 */
 	function get_row( $query = null, $output = OBJECT, $y = 0 ) {
 		$this->func_call = "\$db->get_row(\"$query\",$output,$y)";
+
+		if ( $this->check_safe_collation( $query ) ) {
+			$this->check_current_query = false;
+		}
+
 		if ( $query )
 			$this->query( $query );
 		else
@@ -1499,6 +1684,10 @@ class wpdb {
 	 * @return array Database query result. Array indexed from 0 by SQL result row number.
 	 */
 	function get_col( $query = null , $x = 0 ) {
+		if ( $this->check_safe_collation( $query ) ) {
+			$this->check_current_query = false;
+		}
+
 		if ( $query )
 			$this->query( $query );

@@ -1526,6 +1715,10 @@ class wpdb {
 	function get_results( $query = null, $output = OBJECT ) {
 		$this->func_call = "\$db->get_results(\"$query\", $output)";

+		if ( $this->check_safe_collation( $query ) ) {
+			$this->check_current_query = false;
+		}
+
 		if ( $query )
 			$this->query( $query );
 		else
@@ -1563,6 +1756,528 @@ class wpdb {
 		return null;
 	}

+
+	/**
+	 * Retrieves the character set for the given table.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param string $table Table name.
+	 * @return string|WP_Error Table character set, {@see WP_Error} object if it couldn't be found.
+	 */
+	protected function get_table_charset( $table ) {
+		$tablekey = strtolower( $table );
+
+		/**
+		 * Filter the table charset value before the DB is checked.
+		 *
+		 * Passing a non-null value to the filter will effectively short-circuit
+		 * checking the DB for the charset, returning that value instead.
+		 *
+		 * @since 4.2.0
+		 *
+		 * @param string $charset The character set to use. Default null.
+		 * @param string $table   The name of the table being checked.
+		 */
+		$charset = apply_filters( 'pre_get_table_charset', null, $table );
+		if ( null !== $charset ) {
+			return $charset;
+		}
+
+		if ( isset( $this->table_charset[ $tablekey ] ) ) {
+			return $this->table_charset[ $tablekey ];
+		}
+
+		$charsets = $columns = array();
+		$results = $this->get_results( "SHOW FULL COLUMNS FROM `$table`" );
+		if ( ! $results ) {
+			return new WP_Error( 'wpdb_get_table_charset_failure' );
+		}
+
+		foreach ( $results as $column ) {
+			$columns[ strtolower( $column->Field ) ] = $column;
+		}
+
+		$this->col_meta[ $tablekey ] = $columns;
+
+		foreach ( $columns as $column ) {
+			if ( ! empty( $column->Collation ) ) {
+				list( $charset ) = explode( '_', $column->Collation );
+				$charsets[ strtolower( $charset ) ] = true;
+			}
+
+			list( $type ) = explode( '(', $column->Type );
+
+			// A binary/blob means the whole query gets treated like this.
+			if ( in_array( strtoupper( $type ), array( 'BINARY', 'VARBINARY', 'TINYBLOB', 'MEDIUMBLOB', 'BLOB', 'LONGBLOB' ) ) ) {
+				$this->table_charset[ $tablekey ] = 'binary';
+				return 'binary';
+			}
+		}
+
+		// utf8mb3 is an alias for utf8.
+		if ( isset( $charsets['utf8mb3'] ) ) {
+			$charsets['utf8'] = true;
+			unset( $charsets['utf8mb3'] );
+		}
+
+		// Check if we have more than one charset in play.
+		$count = count( $charsets );
+		if ( 1 === $count ) {
+			$charset = key( $charsets );
+		} elseif ( 0 === $count ) {
+			// No charsets, assume this table can store whatever.
+			$charset = false;
+		} else {
+			// More than one charset. Remove latin1 if present and recalculate.
+			unset( $charsets['latin1'] );
+			$count = count( $charsets );
+			if ( 1 === $count ) {
+				// Only one charset (besides latin1).
+				$charset = key( $charsets );
+			} elseif ( 2 === $count && isset( $charsets['utf8'], $charsets['utf8mb4'] ) ) {
+				// Two charsets, but they're utf8 and utf8mb4, use utf8.
+				$charset = 'utf8';
+			} else {
+				// Two mixed character sets. ascii.
+				$charset = 'ascii';
+			}
+		}
+
+		$this->table_charset[ $tablekey ] = $charset;
+		return $charset;
+	}
+
+	/**
+	 * Retrieves the character set for the given column.
+	 *
+	 * @since 4.2.0
+	 * @access public
+	 *
+	 * @param string $table  Table name.
+	 * @param string $column Column name.
+	 * @return mixed Column character set as a string. False if the column has no
+	 *               character set. {@see WP_Error} object if there was an error.
+	 */
+	public function get_col_charset( $table, $column ) {
+		$tablekey = strtolower( $table );
+		$columnkey = strtolower( $column );
+
+		/**
+		 * Filter the column charset value before the DB is checked.
+		 *
+		 * Passing a non-null value to the filter will short-circuit
+		 * checking the DB for the charset, returning that value instead.
+		 *
+		 * @since 4.2.0
+		 *
+		 * @param string $charset The character set to use. Default null.
+		 * @param string $table   The name of the table being checked.
+		 * @param string $column  The name of the column being checked.
+		 */
+		$charset = apply_filters( 'pre_get_col_charset', null, $table, $column );
+		if ( null !== $charset ) {
+			return $charset;
+		}
+
+		// Skip this entirely if this isn't a MySQL database.
+		if ( false === $this->is_mysql ) {
+			return false;
+		}
+
+		if ( empty( $this->table_charset[ $tablekey ] ) ) {
+			// This primes column information for us.
+			$table_charset = $this->get_table_charset( $table );
+			if ( is_wp_error( $table_charset ) ) {
+				return $table_charset;
+			}
+		}
+
+		// If still no column information, return the table charset.
+		if ( empty( $this->col_meta[ $tablekey ] ) ) {
+			return $this->table_charset[ $tablekey ];
+		}
+
+		// If this column doesn't exist, return the table charset.
+		if ( empty( $this->col_meta[ $tablekey ][ $columnkey ] ) ) {
+			return $this->table_charset[ $tablekey ];
+		}
+
+		// Return false when it's not a string column.
+		if ( empty( $this->col_meta[ $tablekey ][ $columnkey ]->Collation ) ) {
+			return false;
+		}
+
+		list( $charset ) = explode( '_', $this->col_meta[ $tablekey ][ $columnkey ]->Collation );
+		return $charset;
+	}
+
+	/**
+	 * Check if a string is ASCII.
+	 *
+	 * The negative regex is faster for non-ASCII strings, as it allows
+	 * the search to finish as soon as it encounters a non-ASCII character.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param string $string String to check.
+	 * @return bool True if ASCII, false if not.
+	 */
+	protected function check_ascii( $string ) {
+		if ( function_exists( 'mb_check_encoding' ) ) {
+			if ( mb_check_encoding( $string, 'ASCII' ) ) {
+				return true;
+			}
+		} elseif ( ! preg_match( '/[^\x00-\x7F]/', $string ) ) {
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * Check if the query is accessing a collation considered safe on the current version of MySQL.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param string $query The query to check.
+	 * @return bool True if the collation is safe, false if it isn't.
+	 */
+	protected function check_safe_collation( $query ) {
+		if ( $this->checking_collation ) {
+			return true;
+		}
+
+		// We don't need to check the collation for queries that don't read data.
+		$query = ltrim( $query, "\r\n\t (" );
+		if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN)\s/i', $query ) ) {
+			return true;
+		}
+
+		// All-ASCII queries don't need extra checking.
+		if ( $this->check_ascii( $query ) ) {
+			return true;
+		}
+
+		$table = $this->get_table_from_query( $query );
+		if ( ! $table ) {
+			return false;
+		}
+
+		$this->checking_collation = true;
+		$collation = $this->get_table_charset( $table );
+		$this->checking_collation = false;
+
+		// Tables with no collation, or latin1 only, don't need extra checking.
+		if ( false === $collation || 'latin1' === $collation ) {
+			return true;
+		}
+
+		$table = strtolower( $table );
+		if ( empty( $this->col_meta[ $table ] ) ) {
+			return false;
+		}
+
+		// If any of the columns don't have one of these collations, it needs more sanity checking.
+		foreach( $this->col_meta[ $table ] as $col ) {
+			if ( empty( $col->Collation ) ) {
+				continue;
+			}
+
+			if ( ! in_array( $col->Collation, array( 'utf8_general_ci', 'utf8_bin', 'utf8mb4_general_ci', 'utf8mb4_bin' ), true ) ) {
+				return false;
+			}
+		}
+
+		return true;
+	}
+
+	/**
+	 * Strips any invalid characters based on value/charset pairs.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param array $data Array of value arrays. Each value array has the keys
+	 *                    'value' and 'charset'. An optional 'ascii' key can be
+	 *                    set to false to avoid redundant ASCII checks.
+	 * @return array|WP_Error The $data parameter, with invalid characters removed from
+	 *                        each value. This works as a passthrough: any additional keys
+	 *                        such as 'field' are retained in each value array. If we cannot
+	 *                        remove invalid characters, a {@see WP_Error} object is returned.
+	 */
+		// If any of the columns don't have one of these collations, it needs more sanity checking.
+	protected function strip_invalid_text( $data ) {
+		// Some multibyte character sets that we can check in PHP.
+		$mb_charsets = array(
+			'ascii'   => 'ASCII',
+			'big5'    => 'BIG-5',
+			'eucjpms' => 'eucJP-win',
+			'gb2312'  => 'EUC-CN',
+			'ujis'    => 'EUC-JP',
+			'utf32'   => 'UTF-32',
+		);
+
+		$supported_charsets = array();
+		if ( function_exists( 'mb_list_encodings' ) ) {
+			$supported_charsets = mb_list_encodings();
+		}
+
+		$db_check_string = false;
+
+		foreach ( $data as &$value ) {
+			$charset = $value['charset'];
+
+			// Column isn't a string, or is latin1, which will will happily store anything.
+			if ( false === $charset || 'latin1' === $charset ) {
+				continue;
+			}
+
+			if ( ! is_string( $value['value'] ) ) {
+				continue;
+			}
+
+			// ASCII is always OK.
+			if ( ! isset( $value['ascii'] ) && $this->check_ascii( $value['value'] ) ) {
+				continue;
+			}
+
+			// Convert the text locally.
+			if ( $supported_charsets ) {
+				if ( isset( $mb_charsets[ $charset ] ) && in_array( $mb_charsets[ $charset ], $supported_charsets ) ) {
+					$value['value'] = mb_convert_encoding( $value['value'], $mb_charsets[ $charset ], $mb_charsets[ $charset ] );
+					continue;
+				}
+			}
+
+			// utf8 can be handled by regex, which is a bunch faster than a DB lookup.
+			if ( 'utf8' === $charset || 'utf8mb3' === $charset || 'utf8mb4' === $charset ) {
+				$regex = '/
+					(
+						(?: [\x00-\x7F]                  # single-byte sequences   0xxxxxxx
+						|   [\xC2-\xDF][\x80-\xBF]       # double-byte sequences   110xxxxx 10xxxxxx
+						|   \xE0[\xA0-\xBF][\x80-\xBF]   # triple-byte sequences   1110xxxx 10xxxxxx * 2
+						|   [\xE1-\xEC][\x80-\xBF]{2}
+						|   \xED[\x80-\x9F][\x80-\xBF]
+						|   [\xEE-\xEF][\x80-\xBF]{2}';
+
+				if ( 'utf8mb4' === $charset) {
+					$regex .= '
+						|    \xF0[\x90-\xBF][\x80-\xBF]{2} # four-byte sequences   11110xxx 10xxxxxx * 3
+						|    [\xF1-\xF3][\x80-\xBF]{3}
+						|    \xF4[\x80-\x8F][\x80-\xBF]{2}
+					';
+				}
+
+				$regex .= '){1,50}                          # ...one or more times
+					)
+					| .                                  # anything else
+					/x';
+				$value['value'] = preg_replace( $regex, '$1', $value['value'] );
+				continue;
+			}
+
+			// We couldn't use any local conversions, send it to the DB.
+			$value['db'] = $db_check_string = true;
+		}
+		unset( $value ); // Remove by reference.
+
+		if ( $db_check_string ) {
+			$queries = array();
+			foreach ( $data as $col => $value ) {
+				if ( ! empty( $value['db'] ) ) {
+					if ( ! isset( $queries[ $value['charset'] ] ) ) {
+						$queries[ $value['charset'] ] = array();
+					}
+
+					// Split the CONVERT() calls by charset, so we can make sure the connection is right
+					$queries[ $value['charset'] ][ $col ] = $this->prepare( "CONVERT( %s USING {$value['charset']} )", $value['value'] );
+					unset( $data[ $col ]['db'] );
+				}
+			}
+
+			$connection_charset = $this->charset;
+			foreach ( $queries as $charset => $query ) {
+				if ( ! $query ) {
+					continue;
+				}
+
+				// Change the charset to match the string(s) we're converting
+				if ( $charset !== $connection_charset ) {
+					$connection_charset = $charset;
+					$this->set_charset( $this->dbh, $charset );
+				}
+
+				$this->check_current_query = false;
+
+				$row = $this->get_row( "SELECT " . implode( ', ', $query ), ARRAY_N );
+				if ( ! $row ) {
+					$this->set_charset( $this->dbh, $connection_charset );
+					return new WP_Error( 'wpdb_strip_invalid_text_failure' );
+				}
+
+				$cols = array_keys( $query );
+				$col_count = count( $cols );
+				for ( $ii = 0; $ii < $col_count; $ii++ ) {
+					$data[ $cols[ $ii ] ]['value'] = $row[ $ii ];
+				}
+			}
+
+			// Don't forget to change the charset back!
+			if ( $connection_charset !== $this->charset ) {
+				$this->set_charset( $this->dbh );
+			}
+		}
+
+		return $data;
+	}
+
+	/**
+	 * Strips any invalid characters from the query.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param string $query Query to convert.
+	 * @return string|WP_Error The converted query, or a {@see WP_Error} object if the conversion fails.
+	 */
+	protected function strip_invalid_text_from_query( $query ) {
+		$table = $this->get_table_from_query( $query );
+		if ( $table ) {
+			$charset = $this->get_table_charset( $table );
+			if ( is_wp_error( $charset ) ) {
+				return $charset;
+			}
+
+			// We can't reliably strip text from tables containing binary/blob columns
+			if ( 'binary' === $charset ) {
+				return $query;
+			}
+		} else {
+			$charset = $this->charset;
+		}
+
+		$data = array(
+			'value'   => $query,
+			'charset' => $charset,
+			'ascii'   => false,
+		);
+
+		$data = $this->strip_invalid_text( array( $data ) );
+		if ( is_wp_error( $data ) ) {
+			return $data;
+		}
+
+		return $data[0]['value'];
+	}
+
+	/**
+	 * Strips any invalid characters from the string for a given table and column.
+	 *
+	 * @since 4.2.0
+	 * @access public
+	 *
+	 * @param string $table  Table name.
+	 * @param string $column Column name.
+	 * @param string $value  The text to check.
+	 * @return string|WP_Error The converted string, or a `WP_Error` object if the conversion fails.
+	 */
+	public function strip_invalid_text_for_column( $table, $column, $value ) {
+		if ( ! is_string( $value ) || $this->check_ascii( $value ) ) {
+			return $value;
+		}
+
+		$charset = $this->get_col_charset( $table, $column );
+		if ( ! $charset ) {
+			// Not a string column.
+			return $value;
+		} elseif ( is_wp_error( $charset ) ) {
+			// Bail on real errors.
+			return $charset;
+		}
+
+		$data = array(
+			$column => array(
+				'value'   => $value,
+				'charset' => $charset,
+				'ascii'   => false,
+			)
+		);
+
+		$data = $this->strip_invalid_text( $data );
+		if ( is_wp_error( $data ) ) {
+			return $data;
+		}
+
+		return $data[ $column ]['value'];
+	}
+
+	/**
+	 * Find the first table name referenced in a query.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param string $query The query to search.
+	 * @return string|false $table The table name found, or false if a table couldn't be found.
+	 */
+	protected function get_table_from_query( $query ) {
+		// Remove characters that can legally trail the table name.
+		$query = rtrim( $query, ';/-#' );
+
+		// Allow (select...) union [...] style queries. Use the first query's table name.
+		$query = ltrim( $query, "\r\n\t (" );
+
+		/*
+		 * Strip everything between parentheses except nested selects and use only 1,000
+		 * chars of the query.
+		 */
+		$query = preg_replace( '/\((?!\s*select)[^(]*?\)/is', '()', substr( $query, 0, 1000 ) );
+
+		// Quickly match most common queries.
+		if ( preg_match( '/^\s*(?:'
+				. 'SELECT.*?\s+FROM'
+				. '|INSERT(?:\s+LOW_PRIORITY|\s+DELAYED|\s+HIGH_PRIORITY)?(?:\s+IGNORE)?(?:\s+INTO)?'
+				. '|REPLACE(?:\s+LOW_PRIORITY|\s+DELAYED)?(?:\s+INTO)?'
+				. '|UPDATE(?:\s+LOW_PRIORITY)?(?:\s+IGNORE)?'
+				. '|DELETE(?:\s+LOW_PRIORITY|\s+QUICK|\s+IGNORE)*(?:\s+FROM)?'
+				. ')\s+`?([\w-]+)`?/is', $query, $maybe ) ) {
+			return $maybe[1];
+		}
+
+		// SHOW TABLE STATUS and SHOW TABLES
+		if ( preg_match( '/^\s*(?:'
+				. 'SHOW\s+TABLE\s+STATUS.+(?:LIKE\s+|WHERE\s+Name\s*=\s*)'
+				. '|SHOW\s+(?:FULL\s+)?TABLES.+(?:LIKE\s+|WHERE\s+Name\s*=\s*)'
+				. ')\W([\w-]+)\W/is', $query, $maybe ) ) {
+			return $maybe[1];
+		}
+
+		// Big pattern for the rest of the table-related queries.
+		if ( preg_match( '/^\s*(?:'
+				. '(?:EXPLAIN\s+(?:EXTENDED\s+)?)?SELECT.*?\s+FROM'
+				. '|DESCRIBE|DESC|EXPLAIN|HANDLER'
+				. '|(?:LOCK|UNLOCK)\s+TABLE(?:S)?'
+				. '|(?:RENAME|OPTIMIZE|BACKUP|RESTORE|CHECK|CHECKSUM|ANALYZE|REPAIR).*\s+TABLE'
+				. '|TRUNCATE(?:\s+TABLE)?'
+				. '|CREATE(?:\s+TEMPORARY)?\s+TABLE(?:\s+IF\s+NOT\s+EXISTS)?'
+				. '|ALTER(?:\s+IGNORE)?\s+TABLE'
+				. '|DROP\s+TABLE(?:\s+IF\s+EXISTS)?'
+				. '|CREATE(?:\s+\w+)?\s+INDEX.*\s+ON'
+				. '|DROP\s+INDEX.*\s+ON'
+				. '|LOAD\s+DATA.*INFILE.*INTO\s+TABLE'
+				. '|(?:GRANT|REVOKE).*ON\s+TABLE'
+				. '|SHOW\s+(?:.*FROM|.*TABLE)'
+				. ')\s+\(*\s*`?([\w-]+)`?\s*\)*/is', $query, $maybe ) ) {
+			return $maybe[1];
+		}
+
+		return false;
+	}
+
 	/**
 	 * Load the column metadata from the last query.
 	 *
--- a/wp-login.php
+++ b/wp-login.php
@@ -518,7 +518,7 @@ case 'retrievepassword' :

 ?>

-<form name="lostpasswordform" id="lostpasswordform" action="<?php echo esc_url( site_url( 'wp-login.php?action=lostpassword', 'login_post' ) ); ?>" method="post">
+<form name="lostpasswordform" id="lostpasswordform" action="<?php echo esc_url( network_site_url( 'wp-login.php?action=lostpassword', 'login_post' ) ); ?>" method="post">
 	<p>
 		<label for="user_login" ><?php _e('Username or E-mail:') ?><br />
 		<input type="text" name="user_login" id="user_login" class="input" value="<?php echo esc_attr($user_login); ?>" size="20" /></label>
@@ -557,10 +557,28 @@ break;

 case 'resetpass' :
 case 'rp' :
-	$user = check_password_reset_key($_GET['key'], $_GET['login']);
+	list( $rp_path ) = explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) );
+	$rp_cookie = 'wp-resetpass-' . COOKIEHASH;
+	if ( isset( $_GET['key'] ) ) {
+		$value = sprintf( '%s:%s', wp_unslash( $_GET['login'] ), wp_unslash( $_GET['key'] ) );
+		setcookie( $rp_cookie, $value, 0, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
+		wp_safe_redirect( remove_query_arg( array( 'key', 'login' ) ) );
+		exit;
+	}

-	if ( is_wp_error($user) ) {
-		if ( $user->get_error_code() === 'expired_key' )
+	if ( isset( $_COOKIE[ $rp_cookie ] ) && 0 < strpos( $_COOKIE[ $rp_cookie ], ':' ) ) {
+		list( $rp_login, $rp_key ) = explode( ':', wp_unslash( $_COOKIE[ $rp_cookie ] ), 2 );
+		$user = check_password_reset_key( $rp_key, $rp_login );
+		if ( isset( $_POST['pass1'] ) && ! hash_equals( $rp_key, $_POST['rp_key'] ) ) {
+			$user = false;
+		}
+	} else {
+		$user = false;
+	}
+
+	if ( ! $user || is_wp_error( $user ) ) {
+		setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
+		if ( $user && $user->get_error_code() === 'expired_key' )
 			wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=expiredkey' ) );
 		else
 			wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=invalidkey' ) );
@@ -584,6 +602,7 @@ case 'rp' :

 	if ( ( ! $errors->get_error_code() ) && isset( $_POST['pass1'] ) && !empty( $_POST['pass1'] ) ) {
 		reset_password($user, $_POST['pass1']);
+		setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
 		login_header( __( 'Password Reset' ), '<p class="message reset-pass">' . __( 'Your password has been reset.' ) . ' <a href="' . esc_url( wp_login_url() ) . '">' . __( 'Log in' ) . '</a></p>' );
 		login_footer();
 		exit;
@@ -595,8 +614,8 @@ case 'rp' :
 	login_header(__('Reset Password'), '<p class="message reset-pass">' . __('Enter your new password below.') . '</p>', $errors );

 ?>
-<form name="resetpassform" id="resetpassform" action="<?php echo esc_url( site_url( 'wp-login.php?action=resetpass&key=' . urlencode( $_GET['key'] ) . '&login=' . urlencode( $_GET['login'] ), 'login_post' ) ); ?>" method="post" autocomplete="off">
-	<input type="hidden" id="user_login" value="<?php echo esc_attr( $_GET['login'] ); ?>" autocomplete="off" />
+<form name="resetpassform" id="resetpassform" action="<?php echo esc_url( network_site_url( 'wp-login.php?action=resetpass', 'login_post' ) ); ?>" method="post" autocomplete="off">
+	<input type="hidden" id="user_login" value="<?php echo esc_attr( $rp_login ); ?>" autocomplete="off" />

 	<p>
 		<label for="pass1"><?php _e('New password') ?><br />
@@ -611,6 +630,7 @@ case 'rp' :
 	<p class="description indicator-hint"><?php _e('Hint: The password should be at least seven characters long. To make it stronger, use upper and lower case letters, numbers and symbols like ! " ? $ % ^ &amp; ).'); ?></p>

 	<br class="clear" />
+	<input type="hidden" name="rp_key" value="<?php echo esc_attr( $rp_key ); ?>" />
 	<p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e('Reset Password'); ?>" /></p>
 </form>
Author	SHA1	Message	Date
Helen Hou-Sandí	a7e5b6a48e	Tag 3.7.7. Built from https://develop.svn.wordpress.org/@32291 git-svn-id: http://core.svn.wordpress.org/tags/3.7.7@32262 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-23 22:39:30 +00:00
Helen Hou-Sandí	23f7dc02fe	The 3.7 branch is now 3.7.7. Built from https://develop.svn.wordpress.org/branches/3.7@32286 git-svn-id: http://core.svn.wordpress.org/branches/3.7@32257 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-23 21:36:10 +00:00
Gary Pendergast	2e7a66f15f	WPDB: When sanity checking a string by sending it to MySQL for conversion checks, the incorrect data structure was being returned from wpdb::strip_invalid_text(), causing all write queries to fail for some character sets when the query contained non-ASCII characters. Merge of [32261] to the 3.7 branch. See #32051. Built from https://develop.svn.wordpress.org/branches/3.7@32275 git-svn-id: http://core.svn.wordpress.org/branches/3.7@32246 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-23 11:56:10 +00:00
Gary Pendergast	8490921af3	WPDB: When deciding if a query needs extra sanity checking based on collation, return early when we can. Merges [32232] and [32233] to the 3.7 branch. See #32029. Built from https://develop.svn.wordpress.org/branches/3.7@32241 git-svn-id: http://core.svn.wordpress.org/branches/3.7@32212 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-21 07:06:10 +00:00
Gary Pendergast	4935ef466c	Bump 3.7 branch 3.7.6. Built from https://develop.svn.wordpress.org/branches/3.7@32213 git-svn-id: http://core.svn.wordpress.org/branches/3.7@32187 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 17:33:09 +00:00
Gary Pendergast	964a43089d	3.7: Update about.php. Built from https://develop.svn.wordpress.org/branches/3.7@32212 git-svn-id: http://core.svn.wordpress.org/branches/3.7@32186 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 17:32:10 +00:00
Gary Pendergast	f51aa3949c	Ensure post titles are correctly escaped on the Dashboard. Merge of [32175] to the 3.7 branch. Props helen, ocean90, dd32, pento. Built from https://develop.svn.wordpress.org/branches/3.7@32206 git-svn-id: http://core.svn.wordpress.org/branches/3.7@32179 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 13:44:10 +00:00
Gary Pendergast	03874af5c9	In Multisite, prevent plugins from unintentionally switching sites. Merge of [32173] to the 3.7 branch. Props mdawaffe, pento. Built from https://develop.svn.wordpress.org/branches/3.7@32202 git-svn-id: http://core.svn.wordpress.org/branches/3.7@32175 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 13:28:10 +00:00
Gary Pendergast	c3a4c7463c	Remove some old backwards compatibility code from TinyMCE. Merge of [32166] to the 3.7 branch. Props azaozz. Built from https://develop.svn.wordpress.org/branches/3.7@32196 git-svn-id: http://core.svn.wordpress.org/branches/3.7@32169 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 12:58:10 +00:00
Gary Pendergast	888d60a151	Clean up some edge cases in `sanitize_sql_orderby()`. Merge of [32164] to the 3.7 branch. Props vortfu, dd32. Built from https://develop.svn.wordpress.org/branches/3.7@32192 git-svn-id: http://core.svn.wordpress.org/branches/3.7@32165 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 12:41:09 +00:00
Gary Pendergast	5236e251a3	Merge the query sanity checks from #21212 to the 3.7 branch. Props pento, nacin, mdawaffe, DrewAPicture. Built from https://develop.svn.wordpress.org/branches/3.7@32188 git-svn-id: http://core.svn.wordpress.org/branches/3.7@32161 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 11:52:10 +00:00
Gary Pendergast	3d8bbda3e4	3.7: Bump package.json, readme.html and license.txt. Built from https://develop.svn.wordpress.org/branches/3.7@32160 git-svn-id: http://core.svn.wordpress.org/branches/3.7@32135 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 03:53:09 +00:00
Gary Pendergast	a05b1eca46	The 3.7 branch is now 3.7.6-alpha. Built from https://develop.svn.wordpress.org/branches/3.7@32159 git-svn-id: http://core.svn.wordpress.org/branches/3.7@32134 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 03:49:09 +00:00
Andrew Nacin	f5f28b9b1b	3.7.5 version bumps. Built from https://develop.svn.wordpress.org/branches/3.7@30472 git-svn-id: http://core.svn.wordpress.org/branches/3.7@30463 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 16:26:10 +00:00
Andrew Nacin	3762c63026	Prevent high resource usage when hashing large passwords. props mdawaffe, pento Merges [30466] to the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@30470 git-svn-id: http://core.svn.wordpress.org/branches/3.7@30461 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 16:08:09 +00:00
Andrew Nacin	1e3fb4d13c	Validate image data. Merges [30458] to the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@30465 git-svn-id: http://core.svn.wordpress.org/branches/3.7@30456 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 16:00:09 +00:00
Andrew Nacin	0c8039be21	Anchor texturize to shortcodes to improve regex efficiency. Merges [30452] to the 3.7 branch. props miqrogroove. see #29557 for segfault issues. Built from https://develop.svn.wordpress.org/branches/3.7@30456 git-svn-id: http://core.svn.wordpress.org/branches/3.7@30447 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 14:40:09 +00:00
Andrew Nacin	1e0faa77d3	Better validation of the URL used in core HTTP requests. Merges [30443] to the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@30447 git-svn-id: http://core.svn.wordpress.org/branches/3.7@30442 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 14:03:08 +00:00
Andrew Nacin	3d16a38fc4	Press This: Ensure the error message is printed. props johnbillion Merges [30438] to the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@30442 git-svn-id: http://core.svn.wordpress.org/branches/3.7@30437 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 14:00:18 +00:00
Andrew Nacin	c2b7538b1c	Invalidate password keys when a user's email changes. Merges [30430] to the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@30434 git-svn-id: http://core.svn.wordpress.org/branches/3.7@30429 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 13:43:09 +00:00
Andrew Nacin	eeb9290b3b	Fix typo in style filter. props miqrogroove Merges [30425] to the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@30429 git-svn-id: http://core.svn.wordpress.org/branches/3.7@30424 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 13:17:09 +00:00
Andrew Nacin	61d9bd544b	Form validation for password resets. Merges [30417] to the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@30421 git-svn-id: http://core.svn.wordpress.org/branches/3.7@30416 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 12:25:19 +00:00
Andrew Nacin	7e1c039ed1	Use hash_equals() for old md5 hashes. Merges [30412] to the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@30416 git-svn-id: http://core.svn.wordpress.org/branches/3.7@30411 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 12:06:10 +00:00
Andrew Nacin	a318c79670	Password resets: Use network_site_url() for form actions. Merges [29631] to the 3.7 branch. props mdawaffe. fixes #29156. Built from https://develop.svn.wordpress.org/branches/3.7@29640 git-svn-id: http://core.svn.wordpress.org/branches/3.7@29414 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-27 03:06:11 +00:00
Andrew Nacin	e4da99ec10	3.7.4 Built from https://develop.svn.wordpress.org/branches/3.7@29413 git-svn-id: http://core.svn.wordpress.org/branches/3.7@29191 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 18:27:35 +00:00
Andrew Nacin	635a071eda	Use delimiters when building nonce hashes. Part two of [29388]. Built from https://develop.svn.wordpress.org/branches/3.7@29410 git-svn-id: http://core.svn.wordpress.org/branches/3.7@29188 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 17:59:09 +00:00
Andrew Nacin	69d28f882f	Ignore entities in XML-RPC requests. Merges [29404] to the 3.7 branch. props mdawaffe, nacin. Built from https://develop.svn.wordpress.org/branches/3.7@29407 git-svn-id: http://core.svn.wordpress.org/branches/3.7@29185 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 17:51:19 +00:00
Andrew Nacin	8b02ba1d76	Escape late in get_avatar(). Merges [29397] to the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@29400 git-svn-id: http://core.svn.wordpress.org/branches/3.7@29178 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 07:51:32 +00:00
Andrew Nacin	b9739cae41	Don't pass around the password reset key. Merges [29327] and [29381] to the 3.7 branch. props mdawaffe. fixes #29060. Built from https://develop.svn.wordpress.org/branches/3.7@29396 git-svn-id: http://core.svn.wordpress.org/branches/3.7@29174 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 06:40:11 +00:00
Andrew Nacin	746e87cf0a	Disable external entities in ID3. Merges [29378] to the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@29392 git-svn-id: http://core.svn.wordpress.org/branches/3.7@29170 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 05:58:19 +00:00
Andrew Nacin	2312c77dc5	Constant time for wp_verify_nonce(). Merges [29384] to the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@29388 git-svn-id: http://core.svn.wordpress.org/branches/3.7@29166 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 05:45:10 +00:00
Andrew Nacin	110becdc03	3.7.4-alpha Built from https://develop.svn.wordpress.org/branches/3.7@29387 git-svn-id: http://core.svn.wordpress.org/branches/3.7@29165 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 05:44:11 +00:00
Andrew Nacin	d2044c3bb5	3.7.3 Built from https://develop.svn.wordpress.org/branches/3.7@28119 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27950 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-14 19:06:10 +00:00
Andrew Nacin	7331bf3e98	Avoid stomping of bulk postdata inside the bulk_edit_posts() loop. Merges [28113] to the 3.7 branch. Reverts [27992] which did not fix it for authors and comment/ping status. props dd32, DrewAPicture. fixes #27792. Built from https://develop.svn.wordpress.org/branches/3.7@28115 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27946 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-14 08:13:10 +00:00
Andrew Nacin	1ea4ff28ce	3.7.3-RC1 Built from https://develop.svn.wordpress.org/branches/3.7@28078 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27909 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-11 17:30:09 +00:00
Andrew Nacin	9c1b1dd073	Recover auto-drafts lost via Quick Draft. Merges [28075] from the 3.8 to the 3.7 branch. See [28074]. fixes #27734. Built from https://develop.svn.wordpress.org/branches/3.7@28077 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27908 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-11 17:29:10 +00:00
Andrew Nacin	1f7cf009b3	Ensure edit_post() promotes an auto-draft to draft. Fixes Quick Draft. Merges [28073] from the 3.8 branch to the 3.7 branch. props dd32. see #27734. Built from https://develop.svn.wordpress.org/branches/3.7@28074 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27905 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-11 04:38:11 +00:00
Andrew Nacin	1dd3b9212e	3.7.2 Built from https://develop.svn.wordpress.org/branches/3.7@28056 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27888 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-08 18:13:10 +00:00
Andrew Nacin	e17e1d22e6	Bump Akismet external in the 3.7 branch to 2.6.0. git-svn-id: http://core.svn.wordpress.org/branches/3.7@27886 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-08 18:10:19 +00:00
Andrew Nacin	4932c36533	Harden HMAC verification. props duck_. [28053] for 3.7. Built from https://develop.svn.wordpress.org/branches/3.7@28055 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27885 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-08 18:08:10 +00:00
Andrew Nacin	ab7e094de3	3.7.2-RC1 Built from https://develop.svn.wordpress.org/branches/3.7@27993 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27823 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-07 19:40:11 +00:00
Andrew Nacin	e5ba4e75cb	Avoid stomping of bulk postdata inside the bulk_edit_posts() loop. Merges [27990] to the 3.7 branch. props kovshenin. see [27964], see #27452. Built from https://develop.svn.wordpress.org/branches/3.7@27992 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27822 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-07 19:36:21 +00:00
Andrew Nacin	c322ca97ad	Better checks for contributors when saving posts. Merges [27976] from the 3.8 branch to the 3.7 branch. props dd32, kovshenin, plocha. fixes #27452. Built from https://develop.svn.wordpress.org/branches/3.7@27977 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27807 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-06 22:17:10 +00:00
Dion Hulse	1d299753ff	Background Updates: Fix a PHP Warning caused by a Upgrader instance being passed into the Theme & Plugin $extra_stats parameter. Background Updates: Fix two variable typos in r27905 Merges [27906], [27928] to the 3.7 branch. Fixes #27633. Built from https://develop.svn.wordpress.org/branches/3.7@27930 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27760 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-03 05:47:09 +00:00
Andrew Nacin	d5744d72dc	Background Updates: Record plugin & theme update statistics like we do for core updates. Pass plugin/theme update objects into the Background updater for consistency with core & translations. Merges [27905] to the 3.7 branch. props dd32. fixes #27633. Built from https://develop.svn.wordpress.org/branches/3.7@27924 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27754 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-03 04:03:09 +00:00
Andrew Nacin	3ec57fa3e0	Update Plupload Silverlight binary to 1.5.8 in the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@27921 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27751 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-03 03:38:09 +00:00
Andrew Nacin	dc382aeae2	Remove links_recently_updated_time (hardening). Merges [27917] from the 3.8 branch to 3.7 branch. see #27649. Built from https://develop.svn.wordpress.org/branches/3.7@27919 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27749 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-03 03:23:10 +00:00
Andrew Nacin	52f5555eca	Prefix the notoptions cache key in the multisite site-options group with $wpdb->siteid to avoid collisions. Merges [26304] (and [26305]) from 3.8 to the 3.7 branch. props wonderboymusic. fixes #25883. Built from https://develop.svn.wordpress.org/branches/3.7@27888 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27719 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-01 04:07:09 +00:00
Andrew Nacin	3d8c17a9c8	Fix a regression in wp_mkdir_p() where the $mode of the parent folder is not correctly applied to all created paths. Merges [26449] and [26927] from 3.8.x to the 3.7 branch. props dd32. fixes #25822. Built from https://develop.svn.wordpress.org/branches/3.7@27887 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27718 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-01 04:02:10 +00:00
Andrew Nacin	7a01e960b5	Cron: Fix a case where a cache inconsistency can cause wp_clear_scheduled_hook() to enter an infinite loop. Merges [26782] from 3.8 to the 3.7 branch. props dd32. fixes #25773. Built from https://develop.svn.wordpress.org/branches/3.7@27886 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27717 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-01 03:40:10 +00:00
Andrew Nacin	8d9c69ffc4	Core Updates: Fix a case where options (db_version specifically) can end up with stale values in the cache after a update is performed. Merges [26448] and [26734] from 3.8 to the 3.7 branch. props dd32. fixes #26173. Built from https://develop.svn.wordpress.org/branches/3.7@27885 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27716 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-01 03:36:10 +00:00
Andrew Nacin	62f4a5b223	Updates: When a failed Background Update occurs, only show the failed update nag if the user hasn't yet updated if it was an early abort. Merges [26186] from 3.8 to the 3.7 branch. props SergeyBiryukov. fixes #25887. Built from https://develop.svn.wordpress.org/branches/3.7@27884 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27715 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-01 03:31:09 +00:00
Andrew Nacin	4aa0ca0aab	Core Upgrader success statistics: Pass the version of WordPress we're upgrading from, as well as the version being upgraded to. Merges [26016] and [26017] from 3.8 to the 3.7 branch. fixes #25772. Built from https://develop.svn.wordpress.org/branches/3.7@27883 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27714 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-01 03:29:10 +00:00
Andrew Nacin	8930937bf0	When checking filesystem permissions for core updates, only check the permissions of the files which we need to alter. Merges [26014] from 3.8 to the 3.7 branch. fixes #25771. Built from https://develop.svn.wordpress.org/branches/3.7@27882 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27713 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-01 03:09:10 +00:00
Andrew Nacin	fe261114bd	Background Updates: Fix a PHP fatal error which could be encountered on some systems when using FTP. Merges [26148] from 3.8 to the 3.7 branch. props dd32. fixes #25817. Built from https://develop.svn.wordpress.org/branches/3.7@27881 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27712 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-01 02:58:10 +00:00
Andrew Nacin	2486cbe932	Forward pingback IP during pingback verification. Merges [27872] to the 3.7 branch. props tellyworth, nacin. fixes #27613. Built from https://develop.svn.wordpress.org/branches/3.7@27878 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27709 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-03-31 21:36:11 +00:00
Andrew Nacin	a9ce0ee825	Default Themes: Update POT files for the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@27590 git-svn-id: http://core.svn.wordpress.org/branches/3.7@27433 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-03-18 19:20:11 +00:00
Andrew Nacin	cbb694c005	Update the 3.7 branch's version numbers. fixes #25985 . Built from https://develop.svn.wordpress.org/branches/3.7@26546 git-svn-id: http://core.svn.wordpress.org/branches/3.7@26438 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2013-12-02 23:16:11 +00:00
Dion Hulse	bd4a5ae14a	Background Updates: Spread them over the hour. Props Pento. Merges r26149 to the 3.7 branch. Fixes #25833 for 3.7. Built from https://develop.svn.wordpress.org/branches/3.7@26450 git-svn-id: http://core.svn.wordpress.org/branches/3.7@26348 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2013-11-28 02:35:11 +00:00