Tag 3.8.7.

Built from https://develop.svn.wordpress.org/@32290 git-svn-id: http://core.svn.wordpress.org/tags/3.8.7@32261 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The 3.8 branch is now 3.8.7.
2015-04-23 22:39:05 +00:00 · 2015-04-23 21:36:02 +00:00 · 2015-04-23 11:52:11 +00:00 · 2015-04-21 07:01:10 +00:00 · 2015-04-20 17:36:11 +00:00 · 2015-04-20 17:34:09 +00:00
26 changed files with 1053 additions and 126 deletions
--- a/license.txt
+++ b/license.txt
@@ -1,6 +1,6 @@
 WordPress - Web publishing software

-Copyright 2013 by the contributors
+Copyright 2015 by the contributors

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
--- a/readme.html
+++ b/readme.html
@@ -9,7 +9,7 @@
 <body>
 <h1 id="logo">
 	<a href="http://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
-	<br /> Version 3.8.2
+	<br /> Version 3.8.7
 </h1>
 <p style="text-align: center">Semantic Personal Publishing Platform</p>

--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -39,7 +39,27 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 </h2>

 <div class="changelog point-releases">
-	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 2 ); ?></h3>
+	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 7 ); ?></h3>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed %2$s bug.',
+         '<strong>Version %1$s</strong> addressed %2$s bugs.', 1 ), '3.8.7', number_format_i18n( 1 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.7' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 8 ), '3.8.6' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.8.6' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 8 ), '3.8.5', number_format_i18n( 8 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.8.5' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 5 ), '3.8.4', number_format_i18n( 5 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.8.4' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed %2$s bug.',
+		'<strong>Version %1$s</strong> addressed %2$s bugs.', 2 ), '3.8.3', number_format_i18n( 2 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.8.3' ); ?>
+ 	</p>
 	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
         '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 9 ), '3.8.2', number_format_i18n( 9 ) ); ?>
 		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.8.2' ); ?>
--- a/wp-admin/includes/class-wp-comments-list-table.php
+++ b/wp-admin/includes/class-wp-comments-list-table.php
@@ -537,9 +537,9 @@ class WP_Comments_List_Table extends WP_List_Table {

 		if ( current_user_can( 'edit_post', $post->ID ) ) {
 			$post_link = "<a href='" . get_edit_post_link( $post->ID ) . "'>";
-			$post_link .= get_the_title( $post->ID ) . '</a>';
+			$post_link .= esc_html( get_the_title( $post->ID ) ) . '</a>';
 		} else {
-			$post_link = get_the_title( $post->ID );
+			$post_link = esc_html( get_the_title( $post->ID ) );
 		}

 		echo '<div class="response-links"><span class="post-com-count-wrapper">';
--- a/wp-admin/includes/dashboard.php
+++ b/wp-admin/includes/dashboard.php
@@ -430,7 +430,7 @@ function _wp_dashboard_recent_comments_row( &$comment, $show_date = true ) {
 	$GLOBALS['comment'] =& $comment;

 	$comment_post_url = get_edit_post_link( $comment->comment_post_ID );
-	$comment_post_title = strip_tags(get_the_title( $comment->comment_post_ID ));
+	$comment_post_title = _draft_or_post_title( $comment->comment_post_ID );
 	$comment_post_link = "<a href='$comment_post_url'>$comment_post_title</a>";
 	$comment_link = '<a class="comment-link" href="' . esc_url(get_comment_link()) . '">#</a>';

--- a/wp-admin/includes/image.php
+++ b/wp-admin/includes/image.php
@@ -316,6 +316,12 @@ function wp_read_image_metadata( $file ) {
 			$meta[ $key ] = utf8_encode( $meta[ $key ] );
 	}

+	foreach ( $meta as &$value ) {
+		if ( is_string( $value ) ) {
+			$value = wp_kses_post( $value );
+		}
+	}
+
 	return apply_filters( 'wp_read_image_metadata', $meta, $file, $sourceImageType );

 }
--- a/wp-admin/includes/post.php
+++ b/wp-admin/includes/post.php
@@ -166,6 +166,7 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
 * @return int Post ID.
 */
 function edit_post( $post_data = null ) {
+	global $wpdb;

 	if ( empty($post_data) )
 		$post_data = &$_POST;
@@ -203,10 +204,6 @@ function edit_post( $post_data = null ) {
 			_wp_upgrade_revisions_of_post( $post, wp_get_post_revisions( $post_ID ) );
 	}

-	if ( ( empty( $post_data['action'] ) || 'autosave' != $post_data['action'] ) && 'auto-draft' == $post_data['post_status'] ) {
-		$post_data['post_status'] = 'draft';
-	}
-
 	if ( isset($post_data['visibility']) ) {
 		switch ( $post_data['visibility'] ) {
 			case 'public' :
@@ -227,6 +224,10 @@ function edit_post( $post_data = null ) {
 	if ( is_wp_error($post_data) )
 		wp_die( $post_data->get_error_message() );

+	if ( ( empty( $post_data['action'] ) || 'autosave' != $post_data['action'] ) && 'auto-draft' == $post_data['post_status'] ) {
+		$post_data['post_status'] = 'draft';
+	}
+
 	// Post Formats
 	if ( isset( $post_data['post_format'] ) )
 		set_post_format( $post_ID, $post_data['post_format'] );
@@ -295,7 +296,19 @@ function edit_post( $post_data = null ) {

 	update_post_meta( $post_ID, '_edit_last', get_current_user_id() );

-	wp_update_post( $post_data );
+	$success = wp_update_post( $post_data );
+	// If the save failed, see if we can sanity check the main fields and try again
+	if ( ! $success && is_callable( array( $wpdb, 'strip_invalid_text_for_column' ) ) ) {
+		$fields = array( 'post_title', 'post_content', 'post_excerpt' );
+
+		foreach( $fields as $field ) {
+			if ( isset( $post_data[ $field ] ) ) {
+				$post_data[ $field ] = $wpdb->strip_invalid_text_for_column( $wpdb->posts, $field, $post_data[ $field ] );
+			}
+		}
+
+		wp_update_post( $post_data );
+	}

 	// Now that we have an ID we can fix any attachment anchor hrefs
 	_fix_attachment_links( $post_ID );
@@ -411,7 +424,12 @@ function bulk_edit_posts( $post_data = null ) {
 	}

 	$updated = $skipped = $locked = array();
+	$shared_post_data = $post_data;
+
 	foreach ( $post_IDs as $post_ID ) {
+		// Start with fresh post data with each iteration.
+		$post_data = $shared_post_data;
+
 		$post_type_object = get_post_type_object( get_post_type( $post_ID ) );

 		if ( !isset( $post_type_object ) || ( isset($children) && in_array($post_ID, $children) ) || !current_user_can( 'edit_post', $post_ID ) ) {
@@ -460,13 +478,13 @@ function bulk_edit_posts( $post_data = null ) {
 		$post_data['ID'] = $post_ID;
 		$post_data['post_ID'] = $post_ID;

-		$translated_post_data = _wp_translate_postdata( true, $post_data );
-		if ( is_wp_error( $translated_post_data ) ) {
+		$post_data = _wp_translate_postdata( true, $post_data );
+		if ( is_wp_error( $post_data ) ) {
 			$skipped[] = $post_ID;
 			continue;
 		}

-		$updated[] = wp_update_post( $translated_post_data );
+		$updated[] = wp_update_post( $post_data );

 		if ( isset( $post_data['sticky'] ) && current_user_can( $ptype->cap->edit_others_posts ) ) {
 			if ( 'sticky' == $post_data['sticky'] )
--- a/wp-admin/includes/template.php
+++ b/wp-admin/includes/template.php
@@ -1373,7 +1373,7 @@ function _draft_or_post_title( $post = 0 ) {
 	$title = get_the_title( $post );
 	if ( empty( $title ) )
 		$title = __( '(no title)' );
-	return $title;
+	return esc_html( $title );
 }

 /**
--- a/wp-admin/includes/upgrade.php
+++ b/wp-admin/includes/upgrade.php
@@ -411,6 +411,9 @@ function upgrade_all() {
 	if ( $wp_current_db_version < 26691 )
 		upgrade_380();

+	if ( $wp_current_db_version < 26692 )
+		upgrade_383();
+
 	maybe_disable_link_manager();

 	maybe_disable_automattic_widgets();
@@ -1251,6 +1254,36 @@ function upgrade_380() {
 		deactivate_plugins( array( 'mp6/mp6.php' ), true );
 	}
 }
+
+/**
+ * Execute changes made in WordPress 3.8.3.
+ *
+ * @since 3.8.3
+ */
+function upgrade_383() {
+	global $wp_current_db_version, $wpdb;
+	if ( $wp_current_db_version < 26692 ) {
+		// Find all lost Quick Draft auto-drafts and promote them to proper drafts.
+		$posts = $wpdb->get_results( "SELECT ID, post_title, post_content FROM $wpdb->posts WHERE post_type = 'post'
+			AND post_status = 'auto-draft' AND post_date >= '2014-04-08 00:00:00'" );
+
+		foreach ( $posts as $post ) {
+			// A regular auto-draft should never have content as that would mean it should have been promoted.
+			// If an auto-draft has content, it's from Quick Draft and it should be recovered.
+			if ( '' === $post->post_content ) {
+				// If it does not have content, we must evaluate whether the title should be recovered.
+				if ( 'Auto Draft' === $post->post_title || __( 'Auto Draft' ) === $post->post_title ) {
+					// This a plain old auto draft. Ignore it.
+					continue;
+				}
+			}
+
+			$wpdb->update( $wpdb->posts, array( 'post_status' => 'draft' ), array( 'ID' => $post->ID ) );
+			clean_post_cache( $post->ID );
+		}
+	}
+}
+
 /**
 * Execute network level changes
 *
--- a/wp-admin/js/nav-menu.js
+++ b/wp-admin/js/nav-menu.js
@@ -451,14 +451,14 @@ var wpNavMenu;
 				if ( ! isPrimaryMenuItem ) {
 					thisLink = menuItem.find( '.menus-move-left' ),
 					thisLinkText = menus.outFrom.replace( '%s', prevItemNameLeft );
-					thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).html( thisLinkText ).css( 'display', 'inline' );
+					thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).text( thisLinkText ).css( 'display', 'inline' );
 				}

 				if ( 0 !== position ) {
 					if ( menuItem.find( '.menu-item-data-parent-id' ).val() !== menuItem.prev().find( '.menu-item-data-db-id' ).val() ) {
 						thisLink = menuItem.find( '.menus-move-right' ),
 						thisLinkText = menus.under.replace( '%s', prevItemNameRight );
-						thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).html( thisLinkText ).css( 'display', 'inline' );
+						thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).text( thisLinkText ).css( 'display', 'inline' );
 					}
 				}

@@ -480,7 +480,7 @@ var wpNavMenu;
 					title = menus.subMenuFocus.replace( '%1$s', itemName ).replace( '%2$d', itemPosition ).replace( '%3$s', parentItemName );
 				}

-				$this.prop('title', title).html( title );
+				$this.prop('title', title).text( title );
 			});
 		},

--- a/wp-admin/js/nav-menu.min.js
+++ b/wp-admin/js/nav-menu.min.js
--- a/wp-admin/press-this.php
+++ b/wp-admin/press-this.php
@@ -65,7 +65,7 @@ function press_it() {
 	// error handling for media_sideload
 	if ( is_wp_error($upload) ) {
 		wp_delete_post($post_ID);
-		wp_die($upload);
+		wp_die( esc_html( $upload->get_error_message() ) );
 	} else {
 		// Post formats
 		if ( isset( $_POST['post_format'] ) ) {
--- a/wp-includes/ID3/getid3.lib.php
+++ b/wp-includes/ID3/getid3.lib.php
@@ -519,11 +519,12 @@ class getid3_lib
 	}

 	public static function XML2array($XMLstring) {
-		if (function_exists('simplexml_load_string')) {
-			if (function_exists('get_object_vars')) {
-				$XMLobject = simplexml_load_string($XMLstring);
-				return self::SimpleXMLelement2array($XMLobject);
-			}
+		if ( function_exists( 'simplexml_load_string' ) && function_exists( 'libxml_disable_entity_loader' ) ) {
+			$loader = libxml_disable_entity_loader( true );
+			$XMLobject = simplexml_load_string( $XMLstring, 'SimpleXMLElement', LIBXML_NOENT );
+			$return = self::SimpleXMLelement2array( $XMLobject );
+			libxml_disable_entity_loader( $loader );
+			return $return;
 		}
 		return false;
 	}
--- a/wp-includes/capabilities.php
+++ b/wp-includes/capabilities.php
@@ -1360,21 +1360,25 @@ function current_user_can( $capability ) {
 * @return bool
 */
 function current_user_can_for_blog( $blog_id, $capability ) {
-	if ( is_multisite() )
-		switch_to_blog( $blog_id );
+	$switched = is_multisite() ? switch_to_blog( $blog_id ) : false;

 	$current_user = wp_get_current_user();

-	if ( empty( $current_user ) )
+	if ( empty( $current_user ) ) {
+		if ( $switched ) {
+			restore_current_blog();
+		}
 		return false;
+	}

 	$args = array_slice( func_get_args(), 2 );
 	$args = array_merge( array( $capability ), $args );

 	$can = call_user_func_array( array( $current_user, 'has_cap' ), $args );

-	if ( is_multisite() )
+	if ( $switched ) {
 		restore_current_blog();
+	}

 	return $can;
 }
--- a/wp-includes/class-IXR.php
+++ b/wp-includes/class-IXR.php
@@ -203,11 +203,37 @@ class IXR_Message
    {
        // first remove the XML declaration
        // merged from WP #10698 - this method avoids the RAM usage of preg_replace on very large messages
-        $header = preg_replace( '/<\?xml.*?\?'.'>/', '', substr($this->message, 0, 100), 1);
-        $this->message = substr_replace($this->message, $header, 0, 100);
-        if (trim($this->message) == '') {
+        $header = preg_replace( '/<\?xml.*?\?'.'>/s', '', substr( $this->message, 0, 100 ), 1 );
+        $this->message = trim( substr_replace( $this->message, $header, 0, 100 ) );
+        if ( '' == $this->message ) {
            return false;
        }
+
+        // Then remove the DOCTYPE
+        $header = preg_replace( '/^<!DOCTYPE[^>]*+>/i', '', substr( $this->message, 0, 200 ), 1 );
+        $this->message = trim( substr_replace( $this->message, $header, 0, 200 ) );
+        if ( '' == $this->message ) {
+            return false;
+        }
+
+        // Check that the root tag is valid
+        $root_tag = substr( $this->message, 0, strcspn( substr( $this->message, 0, 20 ), "> \t\r\n" ) );
+        if ( '<!DOCTYPE' === strtoupper( $root_tag ) ) {
+            return false;
+        }
+        if ( ! in_array( $root_tag, array( '<methodCall', '<methodResponse', '<fault' ) ) ) {
+            return false;
+        }
+
+        // Bail if there are too many elements to parse
+        $element_limit = 30000;
+        if ( function_exists( 'apply_filters' ) ) {
+            $element_limit = apply_filters( 'xmlrpc_element_limit', $element_limit );
+        }
+        if ( $element_limit && 2 * $element_limit < substr_count( $this->message, '<' ) ) {
+            return false;
+        }
+
        $this->_parser = xml_parser_create();
        // Set XML parser to take the case of tags in to account
        xml_parser_set_option($this->_parser, XML_OPTION_CASE_FOLDING, false);
--- a/wp-includes/class-phpass.php
+++ b/wp-includes/class-phpass.php
@@ -214,6 +214,10 @@ class PasswordHash {

 	function HashPassword($password)
 	{
+		if ( strlen( $password ) > 4096 ) {
+			return '*';
+		}
+
 		$random = '';

 		if (CRYPT_BLOWFISH == 1 && !$this->portable_hashes) {
@@ -249,6 +253,10 @@ class PasswordHash {

 	function CheckPassword($password, $stored_hash)
 	{
+		if ( strlen( $password ) > 4096 ) {
+			return false;
+		}
+
 		$hash = $this->crypt_private($password, $stored_hash);
 		if ($hash[0] == '*')
 			$hash = crypt($password, $stored_hash);
--- a/wp-includes/class-wp-editor.php
+++ b/wp-includes/class-wp-editor.php
@@ -59,12 +59,6 @@ final class _WP_Editors {
 			// A cookie (set when a user resizes the editor) overrides the height.
 			$cookie = (int) get_user_setting( 'ed_size' );

-			// Upgrade an old TinyMCE cookie if it is still around, and the new one isn't.
-			if ( ! $cookie && isset( $_COOKIE['TinyMCE_content_size'] ) ) {
-				parse_str( $_COOKIE['TinyMCE_content_size'], $cookie );
- 				$cookie = $cookie['ch'];
-			}
-
 			if ( $cookie )
 				$set['editor_height'] = $cookie;
 		}
--- a/wp-includes/compat.php
+++ b/wp-includes/compat.php
@@ -94,3 +94,32 @@ if ( !function_exists('json_decode') ) {
 		return is_array($data) ? array_map(__FUNCTION__, $data) : $data;
 	}
 }
+
+if ( ! function_exists( 'hash_equals' ) ) :
+/**
+ * Compare two strings in constant time.
+ *
+ * This function was added in PHP 5.6.
+ * It can leak the length of a string.
+ *
+ * @since 3.9.2
+ *
+ * @param string $a Expected string.
+ * @param string $b Actual string.
+ * @return bool Whether strings are equal.
+ */
+function hash_equals( $a, $b ) {
+	$a_length = strlen( $a );
+	if ( $a_length !== strlen( $b ) ) {
+		return false;
+	}
+	$result = 0;
+
+	// Do not attempt to "optimize" this.
+	for ( $i = 0; $i < $a_length; $i++ ) {
+		$result |= ord( $a[ $i ] ) ^ ord( $b[ $i ] );
+	}
+
+	return $result === 0;
+}
+endif;
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -121,7 +121,14 @@ function wptexturize($text) {
 	$no_texturize_tags_stack = array();
 	$no_texturize_shortcodes_stack = array();

-	$textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE);
+	// Look for shortcodes and HTML elements.
+	
+	$shortcode_regex =
+		  '\['          // Find start of shortcode.
+		. '[^\[\]<>]++' // Shortcodes do not contain other shortcodes. Possessive critical.
+		. '\]';         // Find end of shortcode.
+
+	$textarr = preg_split("/(<[^>]*>|$shortcode_regex)/s", $text, -1, PREG_SPLIT_DELIM_CAPTURE);

 	foreach ( $textarr as &$curl ) {
 		if ( empty( $curl ) )
@@ -131,7 +138,7 @@ function wptexturize($text) {
 		$first = $curl[0];
 		if ( '<' === $first ) {
 			_wptexturize_pushpop_element($curl, $no_texturize_tags_stack, $no_texturize_tags, '<', '>');
-		} elseif ( '[' === $first ) {
+		} elseif ( '[' === $first && 1 === preg_match( '/^' . $shortcode_regex . '$/', $curl ) ) {
 			_wptexturize_pushpop_element($curl, $no_texturize_shortcodes_stack, $no_texturize_shortcodes, '[', ']');
 		} elseif ( empty($no_texturize_shortcodes_stack) && empty($no_texturize_tags_stack) ) {
 			// This is not a tag, nor is the texturization disabled static strings
@@ -172,6 +179,8 @@ function _wptexturize_pushpop_element($text, &$stack, $disabled_elements, $openi

 			array_push($stack, $matches[1]);
 		}
+	} elseif ( 0 == count( $stack ) ) {
+		// Stack is empty. Just stop.
 	} else {
 		// Closing? Check $text+2 against disabled elements
 		$c = preg_quote($closing, '/');
@@ -1109,21 +1118,23 @@ function sanitize_title_with_dashes( $title, $raw_title = '', $context = 'displa
 }

 /**
- * Ensures a string is a valid SQL order by clause.
+ * Ensures a string is a valid SQL 'order by' clause.
 *
- * Accepts one or more columns, with or without ASC/DESC, and also accepts
- * RAND().
+ * Accepts one or more columns, with or without a sort order (ASC / DESC).
+ * e.g. 'column_1', 'column_1, column_2', 'column_1 ASC, column_2 DESC' etc.
+ *
+ * Also accepts 'RAND()'.
 *
 * @since 2.5.1
 *
- * @param string $orderby Order by string to be checked.
- * @return string|bool Returns the order by clause if it is a match, false otherwise.
+ * @param string $orderby Order by clause to be validated.
+ * @return string|bool Returns $orderby if valid, false otherwise.
 */
-function sanitize_sql_orderby( $orderby ){
-	preg_match('/^\s*([a-z0-9_]+(\s+(ASC|DESC))?(\s*,\s*|\s*$))+|^\s*RAND\(\s*\)\s*$/i', $orderby, $obmatches);
-	if ( !$obmatches )
-		return false;
-	return $orderby;
+function sanitize_sql_orderby( $orderby ) {
+	if ( preg_match( '/^\s*(([a-z0-9_]+|`[a-z0-9_]+`)(\s+(ASC|DESC))?\s*(,\s*(?=[a-z0-9_`])|$))+$/i', $orderby ) || preg_match( '/^\s*RAND\(\s*\)\s*$/i', $orderby ) ) {
+		return $orderby;
+	}
+	return false;
 }

 /**
--- a/wp-includes/http.php
+++ b/wp-includes/http.php
@@ -451,8 +451,9 @@ function send_origin_headers() {
 * @return mixed URL or false on failure.
 */
 function wp_http_validate_url( $url ) {
+	$original_url = $url;
 	$url = wp_kses_bad_protocol( $url, array( 'http', 'https' ) );
-	if ( ! $url )
+	if ( ! $url || strtolower( $url ) !== strtolower( $original_url ) )
 		return false;

 	$parsed_url = @parse_url( $url );
@@ -462,7 +463,7 @@ function wp_http_validate_url( $url ) {
 	if ( isset( $parsed_url['user'] ) || isset( $parsed_url['pass'] ) )
 		return false;

-	if ( false !== strpos( $parsed_url['host'], ':' ) )
+	if ( false !== strpbrk( $parsed_url['host'], ':#?[]' ) )
 		return false;

 	$parsed_home = @parse_url( get_option( 'home' ) );
@@ -480,8 +481,7 @@ function wp_http_validate_url( $url ) {
 		}
 		if ( $ip ) {
 			$parts = array_map( 'intval', explode( '.', $ip ) );
-			if ( '127.0.0.1' === $ip
-				|| ( 10 === $parts[0] )
+			if ( 127 === $parts[0] || 10 === $parts[0]
 				|| ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
 				|| ( 192 === $parts[0] && 168 === $parts[1] )
 			) {
--- a/wp-includes/kses.php
+++ b/wp-includes/kses.php
@@ -1407,7 +1407,7 @@ function safecss_filter_attr( $css, $deprecated = '' ) {
 	$css = wp_kses_no_null($css);
 	$css = str_replace(array("\n","\r","\t"), '', $css);

-	if ( preg_match( '%[\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
+	if ( preg_match( '%[\\\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
 		return '';

 	$css_array = explode( ';', trim( $css ) );
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -543,7 +543,7 @@ function wp_validate_auth_cookie($cookie = '', $scheme = '') {
 	$key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
 	$hash = hash_hmac('md5', $username . '|' . $expiration, $key);

-	if ( hash_hmac( 'md5', $hmac, $key ) !== hash_hmac( 'md5', $hash, $key ) ) {
+	if ( ! hash_equals( $hash, $hmac ) ) {
 		do_action('auth_cookie_bad_hash', $cookie_elements);
 		return false;
 	}
@@ -1342,11 +1342,17 @@ function wp_verify_nonce($nonce, $action = -1) {
 	$i = wp_nonce_tick();

 	// Nonce generated 0-12 hours ago
-	if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) === $nonce )
+	$expected = substr( wp_hash( $i . '|' . $action . '|' . $uid, 'nonce'), -12, 10 );
+	if ( hash_equals( $expected, $nonce ) ) {
 		return 1;
+	}
+
 	// Nonce generated 12-24 hours ago
-	if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) === $nonce )
+	$expected = substr( wp_hash( ( $i - 1 ) . '|' . $action . '|' . $uid, 'nonce' ), -12, 10 );
+	if ( hash_equals( $expected, $nonce ) ) {
 		return 2;
+	}
+
 	// Invalid nonce
 	return false;
 }
@@ -1369,7 +1375,7 @@ function wp_create_nonce($action = -1) {

 	$i = wp_nonce_tick();

-	return substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10);
+	return substr(wp_hash($i . '|' . $action . '|' . $uid, 'nonce'), -12, 10);
 }
 endif;

@@ -1531,7 +1537,7 @@ function wp_check_password($password, $hash, $user_id = '') {

 	// If the hash is still md5...
 	if ( strlen($hash) <= 32 ) {
-		$check = ( $hash == md5($password) );
+		$check = hash_equals( $hash, md5( $password ) );
 		if ( $check && $user_id ) {
 			// Rehash using new hash.
 			wp_set_password($password, $user_id);
@@ -1749,7 +1755,8 @@ function get_avatar( $id_or_email, $size = '96', $default = '', $alt = false ) {
 		$out = str_replace( '&#038;', '&amp;', esc_url( $out ) );
 		$avatar = "<img alt='{$safe_alt}' src='{$out}' class='avatar avatar-{$size} photo' height='{$size}' width='{$size}' />";
 	} else {
-		$avatar = "<img alt='{$safe_alt}' src='{$default}' class='avatar avatar-{$size} photo avatar-default' height='{$size}' width='{$size}' />";
+		$out = esc_url( $default );
+		$avatar = "<img alt='{$safe_alt}' src='{$out}' class='avatar avatar-{$size} photo avatar-default' height='{$size}' width='{$size}' />";
 	}

 	return apply_filters('get_avatar', $avatar, $id_or_email, $size, $default, $alt);
@@ -1830,3 +1837,35 @@ function wp_text_diff( $left_string, $right_string, $args = null ) {
 }
 endif;

+if ( ! function_exists( 'hash_equals' ) ) :
+/**
+ * Compare two strings in constant time.
+ *
+ * This function is NOT pluggable. It is in this file (in addition to
+ * compat.php) to prevent errors if, during an update, pluggable.php
+ * copies over but compat.php does not.
+ *
+ * This function was added in PHP 5.6.
+ * It can leak the length of a string.
+ *
+ * @since 3.9.2
+ *
+ * @param string $a Expected string.
+ * @param string $b Actual string.
+ * @return bool Whether strings are equal.
+ */
+function hash_equals( $a, $b ) {
+	$a_length = strlen( $a );
+	if ( $a_length !== strlen( $b ) ) {
+		return false;
+	}
+	$result = 0;
+
+	// Do not attempt to "optimize" this.
+	for ( $i = 0; $i < $a_length; $i++ ) {
+		$result |= ord( $a[ $i ] ) ^ ord( $b[ $i ] );
+	}
+
+	return $result === 0;
+}
+endif;
--- a/wp-includes/user.php
+++ b/wp-includes/user.php
@@ -1409,6 +1409,9 @@ function wp_insert_user( $userdata ) {
 	$data = wp_unslash( $data );

 	if ( $update ) {
+		if ( $user_email !== $old_user_data->user_email ) {
+			$data['user_activation_key'] = '';
+		}
 		$wpdb->update( $wpdb->users, $data, compact( 'ID' ) );
 		$user_id = (int) $ID;
 	} else {
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,14 +4,14 @@
 *
 * @global string $wp_version
 */
-$wp_version = '3.8.2';
+$wp_version = '3.8.7';

 /**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
 *
 * @global int $wp_db_version
 */
-$wp_db_version = 26691;
+$wp_db_version = 26692;

 /**
 * Holds the TinyMCE version
--- a/wp-includes/wp-db.php
+++ b/wp-includes/wp-db.php
@@ -139,6 +139,43 @@ class wpdb {
 	 */
 	protected $result;

+	/**
+	 * Cached column info, for sanity checking data before inserting
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 * @var array
+	 */
+	protected $col_meta = array();
+
+	/**
+	 * Calculated character sets on tables
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 * @var array
+	 */
+	protected $table_charset = array();
+
+	/**
+	 * Whether text fields in the current query need to be sanity checked.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 * @var bool
+	 */
+	protected $check_current_query = true;
+
+	/**
+	 * Flag to ensure we don't run into recursion problems when checking the collation.
+	 *
+	 * @since 4.2.0
+	 * @access private
+	 * @see wpdb::check_safe_collation()
+	 * @var boolean
+	 */
+	private $checking_collation = false;
+
 	/**
 	 * Saved info on the table column
 	 *
@@ -575,6 +612,14 @@ class wpdb {
 	 * @param mixed  $value The value to set
 	 */
 	function __set( $name, $value ) {
+		$protected_members = array(
+			'col_meta',
+			'table_charset',
+			'check_current_query',
+		);
+		if (  in_array( $name, $protected_members, true ) ) {
+			return;
+		}
 		$this->$name = $value;
 	}

@@ -1186,8 +1231,11 @@ class wpdb {
 	 * @return int|false Number of rows affected/selected or false on error
 	 */
 	function query( $query ) {
-		if ( ! $this->ready )
+		if ( ! $this->ready ) {
+			$this->check_current_query = true;
 			return false;
+		}
+
 		/**
 		 * Filter the database query.
 		 *
@@ -1204,6 +1252,20 @@ class wpdb {
 		// Log how the function was called
 		$this->func_call = "\$db->query(\"$query\")";

+		// If we're writing to the database, make sure the query will write safely.
+		if ( $this->check_current_query && ! $this->check_ascii( $query ) ) {
+			$stripped_query = $this->strip_invalid_text_from_query( $query );
+			// strip_invalid_text_from_query() can perform queries, so we need
+			// to flush again, just to make sure everything is clear.
+			$this->flush();
+			if ( $stripped_query !== $query ) {
+				$this->insert_id = 0;
+				return false;
+			}
+		}
+
+		$this->check_current_query = true;
+
 		// Keep track of the last query for debug..
 		$this->last_query = $query;

@@ -1317,23 +1379,29 @@ class wpdb {
 	 * @return int|false The number of rows affected, or false on error.
 	 */
 	function _insert_replace_helper( $table, $data, $format = null, $type = 'INSERT' ) {
-		if ( ! in_array( strtoupper( $type ), array( 'REPLACE', 'INSERT' ) ) )
+		if ( ! in_array( strtoupper( $type ), array( 'REPLACE', 'INSERT' ) ) ) {
 			return false;
-		$this->insert_id = 0;
-		$formats = $format = (array) $format;
-		$fields = array_keys( $data );
-		$formatted_fields = array();
-		foreach ( $fields as $field ) {
-			if ( !empty( $format ) )
-				$form = ( $form = array_shift( $formats ) ) ? $form : $format[0];
-			elseif ( isset( $this->field_types[$field] ) )
-				$form = $this->field_types[$field];
-			else
-				$form = '%s';
-			$formatted_fields[] = $form;
 		}
-		$sql = "{$type} INTO `$table` (`" . implode( '`,`', $fields ) . "`) VALUES (" . implode( ",", $formatted_fields ) . ")";
-		return $this->query( $this->prepare( $sql, $data ) );
+
+		$data = $this->process_fields( $table, $data, $format );
+		if ( false === $data ) {
+			return false;
+		}
+
+		$formats = $values = array();
+		foreach ( $data as $value ) {
+			$formats[] = $value['format'];
+			$values[]  = $value['value'];
+		}
+
+		$fields  = '`' . implode( '`, `', array_keys( $data ) ) . '`';
+		$formats = implode( ', ', $formats );
+
+		$sql = "$type INTO `$table` ($fields) VALUES ($formats)";
+
+		$this->insert_id = 0;
+		$this->check_current_query = false;
+		return $this->query( $this->prepare( $sql, $values ) );
 	}

 	/**
@@ -1358,34 +1426,36 @@ class wpdb {
 	 * @return int|false The number of rows updated, or false on error.
 	 */
 	function update( $table, $data, $where, $format = null, $where_format = null ) {
-		if ( ! is_array( $data ) || ! is_array( $where ) )
+		if ( ! is_array( $data ) || ! is_array( $where ) ) {
 			return false;
-
-		$formats = $format = (array) $format;
-		$bits = $wheres = array();
-		foreach ( (array) array_keys( $data ) as $field ) {
-			if ( !empty( $format ) )
-				$form = ( $form = array_shift( $formats ) ) ? $form : $format[0];
-			elseif ( isset($this->field_types[$field]) )
-				$form = $this->field_types[$field];
-			else
-				$form = '%s';
-			$bits[] = "`$field` = {$form}";
 		}

-		$where_formats = $where_format = (array) $where_format;
-		foreach ( (array) array_keys( $where ) as $field ) {
-			if ( !empty( $where_format ) )
-				$form = ( $form = array_shift( $where_formats ) ) ? $form : $where_format[0];
-			elseif ( isset( $this->field_types[$field] ) )
-				$form = $this->field_types[$field];
-			else
-				$form = '%s';
-			$wheres[] = "`$field` = {$form}";
+		$data = $this->process_fields( $table, $data, $format );
+		if ( false === $data ) {
+			return false;
+		}
+		$where = $this->process_fields( $table, $where, $where_format );
+		if ( false === $where ) {
+			return false;
 		}

-		$sql = "UPDATE `$table` SET " . implode( ', ', $bits ) . ' WHERE ' . implode( ' AND ', $wheres );
-		return $this->query( $this->prepare( $sql, array_merge( array_values( $data ), array_values( $where ) ) ) );
+		$fields = $conditions = $values = array();
+		foreach ( $data as $field => $value ) {
+			$fields[] = "`$field` = " . $value['format'];
+			$values[] = $value['value'];
+		}
+		foreach ( $where as $field => $value ) {
+			$conditions[] = "`$field` = " . $value['format'];
+			$values[] = $value['value'];
+		}
+
+		$fields = implode( ', ', $fields );
+		$conditions = implode( ' AND ', $conditions );
+
+		$sql = "UPDATE `$table` SET $fields WHERE $conditions";
+
+		$this->check_current_query = false;
+		return $this->query( $this->prepare( $sql, $values ) );
 	}

 	/**
@@ -1407,30 +1477,135 @@ class wpdb {
 	 * @return int|false The number of rows updated, or false on error.
 	 */
 	function delete( $table, $where, $where_format = null ) {
-		if ( ! is_array( $where ) )
+		if ( ! is_array( $where ) ) {
 			return false;
-
-		$bits = $wheres = array();
-
-		$where_formats = $where_format = (array) $where_format;
-
-		foreach ( array_keys( $where ) as $field ) {
-			if ( !empty( $where_format ) ) {
-				$form = ( $form = array_shift( $where_formats ) ) ? $form : $where_format[0];
-			} elseif ( isset( $this->field_types[ $field ] ) ) {
-				$form = $this->field_types[ $field ];
-			} else {
-				$form = '%s';
-			}
-
-			$wheres[] = "$field = $form";
 		}

-		$sql = "DELETE FROM $table WHERE " . implode( ' AND ', $wheres );
-		return $this->query( $this->prepare( $sql, $where ) );
+		$where = $this->process_fields( $table, $where, $where_format );
+		if ( false === $where ) {
+			return false;
+		}
+
+		$conditions = $values = array();
+		foreach ( $where as $field => $value ) {
+			$conditions[] = "`$field` = " . $value['format'];
+			$values[] = $value['value'];
+		}
+
+		$conditions = implode( ' AND ', $conditions );
+
+		$sql = "DELETE FROM `$table` WHERE $conditions";
+
+		$this->check_current_query = false;
+		return $this->query( $this->prepare( $sql, $values ) );
 	}


+	/**
+	 * Processes arrays of field/value pairs and field formats.
+	 *
+	 * This is a helper method for wpdb's CRUD methods, which take field/value
+	 * pairs for inserts, updates, and where clauses. This method first pairs
+	 * each value with a format. Then it determines the charset of that field,
+	 * using that to determine if any invalid text would be stripped. If text is
+	 * stripped, then field processing is rejected and the query fails.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param string $table  Table name.
+	 * @param array  $data   Field/value pair.
+	 * @param mixed  $format Format for each field.
+	 * @return array|bool Returns an array of fields that contain paired values
+	 *                    and formats. Returns false for invalid values.
+	 */
+	protected function process_fields( $table, $data, $format ) {
+		$data = $this->process_field_formats( $data, $format );
+		$data = $this->process_field_charsets( $data, $table );
+		if ( false === $data ) {
+			return false;
+		}
+
+		$converted_data = $this->strip_invalid_text( $data );
+
+		if ( $data !== $converted_data ) {
+			return false;
+		}
+
+		return $data;
+	}
+
+	/**
+	 * Prepares arrays of value/format pairs as passed to wpdb CRUD methods.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param array $data   Array of fields to values.
+	 * @param mixed $format Formats to be mapped to the values in $data.
+	 * @return array Array, keyed by field names with values being an array
+	 *               of 'value' and 'format' keys.
+	 */
+	protected function process_field_formats( $data, $format ) {
+		$formats = $original_formats = (array) $format;
+
+		foreach ( $data as $field => $value ) {
+			$value = array(
+				'value'  => $value,
+				'format' => '%s',
+			);
+
+			if ( ! empty( $format ) ) {
+				$value['format'] = array_shift( $formats );
+				if ( ! $value['format'] ) {
+					$value['format'] = reset( $original_formats );
+				}
+			} elseif ( isset( $this->field_types[ $field ] ) ) {
+				$value['format'] = $this->field_types[ $field ];
+			}
+
+			$data[ $field ] = $value;
+		}
+
+		return $data;
+	}
+
+	/**
+	 * Adds field charsets to field/value/format arrays generated by
+	 * the {@see wpdb::process_field_formats()} method.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param array  $data  As it comes from the {@see wpdb::process_field_formats()} method.
+	 * @param string $table Table name.
+	 * @return The same array as $data with additional 'charset' keys.
+	 */
+	protected function process_field_charsets( $data, $table ) {
+		foreach ( $data as $field => $value ) {
+			if ( '%d' === $value['format'] || '%f' === $value['format'] ) {
+				// We can skip this field if we know it isn't a string.
+				// This checks %d/%f versus ! %s because it's sprintf() could take more.
+				$value['charset'] = false;
+			} elseif ( $this->check_ascii( $value['value'] ) ) {
+				// If it's ASCII, then we don't need the charset. We can skip this field.
+				$value['charset'] = false;
+			} else {
+				$value['charset'] = $this->get_col_charset( $table, $field );
+				if ( is_wp_error( $value['charset'] ) ) {
+					return false;
+				}
+
+				// This isn't ASCII. Don't have strip_invalid_text() re-check.
+				$value['ascii'] = false;
+			}
+
+			$data[ $field ] = $value;
+		}
+
+		return $data;
+	}
+
 	/**
 	 * Retrieve one variable from the database.
 	 *
@@ -1447,6 +1622,11 @@ class wpdb {
 	 */
 	function get_var( $query = null, $x = 0, $y = 0 ) {
 		$this->func_call = "\$db->get_var(\"$query\", $x, $y)";
+
+		if ( $this->check_safe_collation( $query ) ) {
+			$this->check_current_query = false;
+		}
+
 		if ( $query )
 			$this->query( $query );

@@ -1474,6 +1654,11 @@ class wpdb {
 	 */
 	function get_row( $query = null, $output = OBJECT, $y = 0 ) {
 		$this->func_call = "\$db->get_row(\"$query\",$output,$y)";
+
+		if ( $this->check_safe_collation( $query ) ) {
+			$this->check_current_query = false;
+		}
+
 		if ( $query )
 			$this->query( $query );
 		else
@@ -1507,6 +1692,10 @@ class wpdb {
 	 * @return array Database query result. Array indexed from 0 by SQL result row number.
 	 */
 	function get_col( $query = null , $x = 0 ) {
+		if ( $this->check_safe_collation( $query ) ) {
+			$this->check_current_query = false;
+		}
+
 		if ( $query )
 			$this->query( $query );

@@ -1534,6 +1723,10 @@ class wpdb {
 	function get_results( $query = null, $output = OBJECT ) {
 		$this->func_call = "\$db->get_results(\"$query\", $output)";

+		if ( $this->check_safe_collation( $query ) ) {
+			$this->check_current_query = false;
+		}
+
 		if ( $query )
 			$this->query( $query );
 		else
@@ -1571,6 +1764,528 @@ class wpdb {
 		return null;
 	}

+
+	/**
+	 * Retrieves the character set for the given table.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param string $table Table name.
+	 * @return string|WP_Error Table character set, {@see WP_Error} object if it couldn't be found.
+	 */
+	protected function get_table_charset( $table ) {
+		$tablekey = strtolower( $table );
+
+		/**
+		 * Filter the table charset value before the DB is checked.
+		 *
+		 * Passing a non-null value to the filter will effectively short-circuit
+		 * checking the DB for the charset, returning that value instead.
+		 *
+		 * @since 4.2.0
+		 *
+		 * @param string $charset The character set to use. Default null.
+		 * @param string $table   The name of the table being checked.
+		 */
+		$charset = apply_filters( 'pre_get_table_charset', null, $table );
+		if ( null !== $charset ) {
+			return $charset;
+		}
+
+		if ( isset( $this->table_charset[ $tablekey ] ) ) {
+			return $this->table_charset[ $tablekey ];
+		}
+
+		$charsets = $columns = array();
+		$results = $this->get_results( "SHOW FULL COLUMNS FROM `$table`" );
+		if ( ! $results ) {
+			return new WP_Error( 'wpdb_get_table_charset_failure' );
+		}
+
+		foreach ( $results as $column ) {
+			$columns[ strtolower( $column->Field ) ] = $column;
+		}
+
+		$this->col_meta[ $tablekey ] = $columns;
+
+		foreach ( $columns as $column ) {
+			if ( ! empty( $column->Collation ) ) {
+				list( $charset ) = explode( '_', $column->Collation );
+				$charsets[ strtolower( $charset ) ] = true;
+			}
+
+			list( $type ) = explode( '(', $column->Type );
+
+			// A binary/blob means the whole query gets treated like this.
+			if ( in_array( strtoupper( $type ), array( 'BINARY', 'VARBINARY', 'TINYBLOB', 'MEDIUMBLOB', 'BLOB', 'LONGBLOB' ) ) ) {
+				$this->table_charset[ $tablekey ] = 'binary';
+				return 'binary';
+			}
+		}
+
+		// utf8mb3 is an alias for utf8.
+		if ( isset( $charsets['utf8mb3'] ) ) {
+			$charsets['utf8'] = true;
+			unset( $charsets['utf8mb3'] );
+		}
+
+		// Check if we have more than one charset in play.
+		$count = count( $charsets );
+		if ( 1 === $count ) {
+			$charset = key( $charsets );
+		} elseif ( 0 === $count ) {
+			// No charsets, assume this table can store whatever.
+			$charset = false;
+		} else {
+			// More than one charset. Remove latin1 if present and recalculate.
+			unset( $charsets['latin1'] );
+			$count = count( $charsets );
+			if ( 1 === $count ) {
+				// Only one charset (besides latin1).
+				$charset = key( $charsets );
+			} elseif ( 2 === $count && isset( $charsets['utf8'], $charsets['utf8mb4'] ) ) {
+				// Two charsets, but they're utf8 and utf8mb4, use utf8.
+				$charset = 'utf8';
+			} else {
+				// Two mixed character sets. ascii.
+				$charset = 'ascii';
+			}
+		}
+
+		$this->table_charset[ $tablekey ] = $charset;
+		return $charset;
+	}
+
+	/**
+	 * Retrieves the character set for the given column.
+	 *
+	 * @since 4.2.0
+	 * @access public
+	 *
+	 * @param string $table  Table name.
+	 * @param string $column Column name.
+	 * @return mixed Column character set as a string. False if the column has no
+	 *               character set. {@see WP_Error} object if there was an error.
+	 */
+	public function get_col_charset( $table, $column ) {
+		$tablekey = strtolower( $table );
+		$columnkey = strtolower( $column );
+
+		/**
+		 * Filter the column charset value before the DB is checked.
+		 *
+		 * Passing a non-null value to the filter will short-circuit
+		 * checking the DB for the charset, returning that value instead.
+		 *
+		 * @since 4.2.0
+		 *
+		 * @param string $charset The character set to use. Default null.
+		 * @param string $table   The name of the table being checked.
+		 * @param string $column  The name of the column being checked.
+		 */
+		$charset = apply_filters( 'pre_get_col_charset', null, $table, $column );
+		if ( null !== $charset ) {
+			return $charset;
+		}
+
+		// Skip this entirely if this isn't a MySQL database.
+		if ( false === $this->is_mysql ) {
+			return false;
+		}
+
+		if ( empty( $this->table_charset[ $tablekey ] ) ) {
+			// This primes column information for us.
+			$table_charset = $this->get_table_charset( $table );
+			if ( is_wp_error( $table_charset ) ) {
+				return $table_charset;
+			}
+		}
+
+		// If still no column information, return the table charset.
+		if ( empty( $this->col_meta[ $tablekey ] ) ) {
+			return $this->table_charset[ $tablekey ];
+		}
+
+		// If this column doesn't exist, return the table charset.
+		if ( empty( $this->col_meta[ $tablekey ][ $columnkey ] ) ) {
+			return $this->table_charset[ $tablekey ];
+		}
+
+		// Return false when it's not a string column.
+		if ( empty( $this->col_meta[ $tablekey ][ $columnkey ]->Collation ) ) {
+			return false;
+		}
+
+		list( $charset ) = explode( '_', $this->col_meta[ $tablekey ][ $columnkey ]->Collation );
+		return $charset;
+	}
+
+	/**
+	 * Check if a string is ASCII.
+	 *
+	 * The negative regex is faster for non-ASCII strings, as it allows
+	 * the search to finish as soon as it encounters a non-ASCII character.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param string $string String to check.
+	 * @return bool True if ASCII, false if not.
+	 */
+	protected function check_ascii( $string ) {
+		if ( function_exists( 'mb_check_encoding' ) ) {
+			if ( mb_check_encoding( $string, 'ASCII' ) ) {
+				return true;
+			}
+		} elseif ( ! preg_match( '/[^\x00-\x7F]/', $string ) ) {
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * Check if the query is accessing a collation considered safe on the current version of MySQL.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param string $query The query to check.
+	 * @return bool True if the collation is safe, false if it isn't.
+	 */
+	protected function check_safe_collation( $query ) {
+		if ( $this->checking_collation ) {
+			return true;
+		}
+
+		// We don't need to check the collation for queries that don't read data.
+		$query = ltrim( $query, "\r\n\t (" );
+		if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN)\s/i', $query ) ) {
+			return true;
+		}
+
+		// All-ASCII queries don't need extra checking.
+		if ( $this->check_ascii( $query ) ) {
+			return true;
+		}
+
+		$table = $this->get_table_from_query( $query );
+		if ( ! $table ) {
+			return false;
+		}
+
+		$this->checking_collation = true;
+		$collation = $this->get_table_charset( $table );
+		$this->checking_collation = false;
+
+		// Tables with no collation, or latin1 only, don't need extra checking.
+		if ( false === $collation || 'latin1' === $collation ) {
+			return true;
+		}
+
+		$table = strtolower( $table );
+		if ( empty( $this->col_meta[ $table ] ) ) {
+			return false;
+		}
+
+		// If any of the columns don't have one of these collations, it needs more sanity checking.
+		foreach( $this->col_meta[ $table ] as $col ) {
+			if ( empty( $col->Collation ) ) {
+				continue;
+			}
+
+			if ( ! in_array( $col->Collation, array( 'utf8_general_ci', 'utf8_bin', 'utf8mb4_general_ci', 'utf8mb4_bin' ), true ) ) {
+				return false;
+			}
+		}
+
+		return true;
+	}
+
+	/**
+	 * Strips any invalid characters based on value/charset pairs.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param array $data Array of value arrays. Each value array has the keys
+	 *                    'value' and 'charset'. An optional 'ascii' key can be
+	 *                    set to false to avoid redundant ASCII checks.
+	 * @return array|WP_Error The $data parameter, with invalid characters removed from
+	 *                        each value. This works as a passthrough: any additional keys
+	 *                        such as 'field' are retained in each value array. If we cannot
+	 *                        remove invalid characters, a {@see WP_Error} object is returned.
+	 */
+		// If any of the columns don't have one of these collations, it needs more sanity checking.
+	protected function strip_invalid_text( $data ) {
+		// Some multibyte character sets that we can check in PHP.
+		$mb_charsets = array(
+			'ascii'   => 'ASCII',
+			'big5'    => 'BIG-5',
+			'eucjpms' => 'eucJP-win',
+			'gb2312'  => 'EUC-CN',
+			'ujis'    => 'EUC-JP',
+			'utf32'   => 'UTF-32',
+		);
+
+		$supported_charsets = array();
+		if ( function_exists( 'mb_list_encodings' ) ) {
+			$supported_charsets = mb_list_encodings();
+		}
+
+		$db_check_string = false;
+
+		foreach ( $data as &$value ) {
+			$charset = $value['charset'];
+
+			// Column isn't a string, or is latin1, which will will happily store anything.
+			if ( false === $charset || 'latin1' === $charset ) {
+				continue;
+			}
+
+			if ( ! is_string( $value['value'] ) ) {
+				continue;
+			}
+
+			// ASCII is always OK.
+			if ( ! isset( $value['ascii'] ) && $this->check_ascii( $value['value'] ) ) {
+				continue;
+			}
+
+			// Convert the text locally.
+			if ( $supported_charsets ) {
+				if ( isset( $mb_charsets[ $charset ] ) && in_array( $mb_charsets[ $charset ], $supported_charsets ) ) {
+					$value['value'] = mb_convert_encoding( $value['value'], $mb_charsets[ $charset ], $mb_charsets[ $charset ] );
+					continue;
+				}
+			}
+
+			// utf8 can be handled by regex, which is a bunch faster than a DB lookup.
+			if ( 'utf8' === $charset || 'utf8mb3' === $charset || 'utf8mb4' === $charset ) {
+				$regex = '/
+					(
+						(?: [\x00-\x7F]                  # single-byte sequences   0xxxxxxx
+						|   [\xC2-\xDF][\x80-\xBF]       # double-byte sequences   110xxxxx 10xxxxxx
+						|   \xE0[\xA0-\xBF][\x80-\xBF]   # triple-byte sequences   1110xxxx 10xxxxxx * 2
+						|   [\xE1-\xEC][\x80-\xBF]{2}
+						|   \xED[\x80-\x9F][\x80-\xBF]
+						|   [\xEE-\xEF][\x80-\xBF]{2}';
+
+				if ( 'utf8mb4' === $charset) {
+					$regex .= '
+						|    \xF0[\x90-\xBF][\x80-\xBF]{2} # four-byte sequences   11110xxx 10xxxxxx * 3
+						|    [\xF1-\xF3][\x80-\xBF]{3}
+						|    \xF4[\x80-\x8F][\x80-\xBF]{2}
+					';
+				}
+
+				$regex .= '){1,50}                          # ...one or more times
+					)
+					| .                                  # anything else
+					/x';
+				$value['value'] = preg_replace( $regex, '$1', $value['value'] );
+				continue;
+			}
+
+			// We couldn't use any local conversions, send it to the DB.
+			$value['db'] = $db_check_string = true;
+		}
+		unset( $value ); // Remove by reference.
+
+		if ( $db_check_string ) {
+			$queries = array();
+			foreach ( $data as $col => $value ) {
+				if ( ! empty( $value['db'] ) ) {
+					if ( ! isset( $queries[ $value['charset'] ] ) ) {
+						$queries[ $value['charset'] ] = array();
+					}
+
+					// Split the CONVERT() calls by charset, so we can make sure the connection is right
+					$queries[ $value['charset'] ][ $col ] = $this->prepare( "CONVERT( %s USING {$value['charset']} )", $value['value'] );
+					unset( $data[ $col ]['db'] );
+				}
+			}
+
+			$connection_charset = $this->charset;
+			foreach ( $queries as $charset => $query ) {
+				if ( ! $query ) {
+					continue;
+				}
+
+				// Change the charset to match the string(s) we're converting
+				if ( $charset !== $connection_charset ) {
+					$connection_charset = $charset;
+					$this->set_charset( $this->dbh, $charset );
+				}
+
+				$this->check_current_query = false;
+
+				$row = $this->get_row( "SELECT " . implode( ', ', $query ), ARRAY_N );
+				if ( ! $row ) {
+					$this->set_charset( $this->dbh, $connection_charset );
+					return new WP_Error( 'wpdb_strip_invalid_text_failure' );
+				}
+
+				$cols = array_keys( $query );
+				$col_count = count( $cols );
+				for ( $ii = 0; $ii < $col_count; $ii++ ) {
+					$data[ $cols[ $ii ] ]['value'] = $row[ $ii ];
+				}
+			}
+
+			// Don't forget to change the charset back!
+			if ( $connection_charset !== $this->charset ) {
+				$this->set_charset( $this->dbh );
+			}
+		}
+
+		return $data;
+	}
+
+	/**
+	 * Strips any invalid characters from the query.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param string $query Query to convert.
+	 * @return string|WP_Error The converted query, or a {@see WP_Error} object if the conversion fails.
+	 */
+	protected function strip_invalid_text_from_query( $query ) {
+		$table = $this->get_table_from_query( $query );
+		if ( $table ) {
+			$charset = $this->get_table_charset( $table );
+			if ( is_wp_error( $charset ) ) {
+				return $charset;
+			}
+
+			// We can't reliably strip text from tables containing binary/blob columns
+			if ( 'binary' === $charset ) {
+				return $query;
+			}
+		} else {
+			$charset = $this->charset;
+		}
+
+		$data = array(
+			'value'   => $query,
+			'charset' => $charset,
+			'ascii'   => false,
+		);
+
+		$data = $this->strip_invalid_text( array( $data ) );
+		if ( is_wp_error( $data ) ) {
+			return $data;
+		}
+
+		return $data[0]['value'];
+	}
+
+	/**
+	 * Strips any invalid characters from the string for a given table and column.
+	 *
+	 * @since 4.2.0
+	 * @access public
+	 *
+	 * @param string $table  Table name.
+	 * @param string $column Column name.
+	 * @param string $value  The text to check.
+	 * @return string|WP_Error The converted string, or a `WP_Error` object if the conversion fails.
+	 */
+	public function strip_invalid_text_for_column( $table, $column, $value ) {
+		if ( ! is_string( $value ) || $this->check_ascii( $value ) ) {
+			return $value;
+		}
+
+		$charset = $this->get_col_charset( $table, $column );
+		if ( ! $charset ) {
+			// Not a string column.
+			return $value;
+		} elseif ( is_wp_error( $charset ) ) {
+			// Bail on real errors.
+			return $charset;
+		}
+
+		$data = array(
+			$column => array(
+				'value'   => $value,
+				'charset' => $charset,
+				'ascii'   => false,
+			)
+		);
+
+		$data = $this->strip_invalid_text( $data );
+		if ( is_wp_error( $data ) ) {
+			return $data;
+		}
+
+		return $data[ $column ]['value'];
+	}
+
+	/**
+	 * Find the first table name referenced in a query.
+	 *
+	 * @since 4.2.0
+	 * @access protected
+	 *
+	 * @param string $query The query to search.
+	 * @return string|false $table The table name found, or false if a table couldn't be found.
+	 */
+	protected function get_table_from_query( $query ) {
+		// Remove characters that can legally trail the table name.
+		$query = rtrim( $query, ';/-#' );
+
+		// Allow (select...) union [...] style queries. Use the first query's table name.
+		$query = ltrim( $query, "\r\n\t (" );
+
+		/*
+		 * Strip everything between parentheses except nested selects and use only 1,000
+		 * chars of the query.
+		 */
+		$query = preg_replace( '/\((?!\s*select)[^(]*?\)/is', '()', substr( $query, 0, 1000 ) );
+
+		// Quickly match most common queries.
+		if ( preg_match( '/^\s*(?:'
+				. 'SELECT.*?\s+FROM'
+				. '|INSERT(?:\s+LOW_PRIORITY|\s+DELAYED|\s+HIGH_PRIORITY)?(?:\s+IGNORE)?(?:\s+INTO)?'
+				. '|REPLACE(?:\s+LOW_PRIORITY|\s+DELAYED)?(?:\s+INTO)?'
+				. '|UPDATE(?:\s+LOW_PRIORITY)?(?:\s+IGNORE)?'
+				. '|DELETE(?:\s+LOW_PRIORITY|\s+QUICK|\s+IGNORE)*(?:\s+FROM)?'
+				. ')\s+`?([\w-]+)`?/is', $query, $maybe ) ) {
+			return $maybe[1];
+		}
+
+		// SHOW TABLE STATUS and SHOW TABLES
+		if ( preg_match( '/^\s*(?:'
+				. 'SHOW\s+TABLE\s+STATUS.+(?:LIKE\s+|WHERE\s+Name\s*=\s*)'
+				. '|SHOW\s+(?:FULL\s+)?TABLES.+(?:LIKE\s+|WHERE\s+Name\s*=\s*)'
+				. ')\W([\w-]+)\W/is', $query, $maybe ) ) {
+			return $maybe[1];
+		}
+
+		// Big pattern for the rest of the table-related queries.
+		if ( preg_match( '/^\s*(?:'
+				. '(?:EXPLAIN\s+(?:EXTENDED\s+)?)?SELECT.*?\s+FROM'
+				. '|DESCRIBE|DESC|EXPLAIN|HANDLER'
+				. '|(?:LOCK|UNLOCK)\s+TABLE(?:S)?'
+				. '|(?:RENAME|OPTIMIZE|BACKUP|RESTORE|CHECK|CHECKSUM|ANALYZE|REPAIR).*\s+TABLE'
+				. '|TRUNCATE(?:\s+TABLE)?'
+				. '|CREATE(?:\s+TEMPORARY)?\s+TABLE(?:\s+IF\s+NOT\s+EXISTS)?'
+				. '|ALTER(?:\s+IGNORE)?\s+TABLE'
+				. '|DROP\s+TABLE(?:\s+IF\s+EXISTS)?'
+				. '|CREATE(?:\s+\w+)?\s+INDEX.*\s+ON'
+				. '|DROP\s+INDEX.*\s+ON'
+				. '|LOAD\s+DATA.*INFILE.*INTO\s+TABLE'
+				. '|(?:GRANT|REVOKE).*ON\s+TABLE'
+				. '|SHOW\s+(?:.*FROM|.*TABLE)'
+				. ')\s+\(*\s*`?([\w-]+)`?\s*\)*/is', $query, $maybe ) ) {
+			return $maybe[1];
+		}
+
+		return false;
+	}
+
 	/**
 	 * Load the column metadata from the last query.
 	 *
--- a/wp-login.php
+++ b/wp-login.php
@@ -524,7 +524,7 @@ case 'retrievepassword' :

 ?>

-<form name="lostpasswordform" id="lostpasswordform" action="<?php echo esc_url( site_url( 'wp-login.php?action=lostpassword', 'login_post' ) ); ?>" method="post">
+<form name="lostpasswordform" id="lostpasswordform" action="<?php echo esc_url( network_site_url( 'wp-login.php?action=lostpassword', 'login_post' ) ); ?>" method="post">
 	<p>
 		<label for="user_login" ><?php _e('Username or E-mail:') ?><br />
 		<input type="text" name="user_login" id="user_login" class="input" value="<?php echo esc_attr($user_login); ?>" size="20" /></label>
@@ -563,10 +563,28 @@ break;

 case 'resetpass' :
 case 'rp' :
-	$user = check_password_reset_key($_GET['key'], $_GET['login']);
+	list( $rp_path ) = explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) );
+	$rp_cookie = 'wp-resetpass-' . COOKIEHASH;
+	if ( isset( $_GET['key'] ) ) {
+		$value = sprintf( '%s:%s', wp_unslash( $_GET['login'] ), wp_unslash( $_GET['key'] ) );
+		setcookie( $rp_cookie, $value, 0, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
+		wp_safe_redirect( remove_query_arg( array( 'key', 'login' ) ) );
+		exit;
+	}

-	if ( is_wp_error($user) ) {
-		if ( $user->get_error_code() === 'expired_key' )
+	if ( isset( $_COOKIE[ $rp_cookie ] ) && 0 < strpos( $_COOKIE[ $rp_cookie ], ':' ) ) {
+		list( $rp_login, $rp_key ) = explode( ':', wp_unslash( $_COOKIE[ $rp_cookie ] ), 2 );
+		$user = check_password_reset_key( $rp_key, $rp_login );
+		if ( isset( $_POST['pass1'] ) && ! hash_equals( $rp_key, $_POST['rp_key'] ) ) {
+			$user = false;
+		}
+	} else {
+		$user = false;
+	}
+
+	if ( ! $user || is_wp_error( $user ) ) {
+		setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
+		if ( $user && $user->get_error_code() === 'expired_key' )
 			wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=expiredkey' ) );
 		else
 			wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=invalidkey' ) );
@@ -590,6 +608,7 @@ case 'rp' :

 	if ( ( ! $errors->get_error_code() ) && isset( $_POST['pass1'] ) && !empty( $_POST['pass1'] ) ) {
 		reset_password($user, $_POST['pass1']);
+		setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
 		login_header( __( 'Password Reset' ), '<p class="message reset-pass">' . __( 'Your password has been reset.' ) . ' <a href="' . esc_url( wp_login_url() ) . '">' . __( 'Log in' ) . '</a></p>' );
 		login_footer();
 		exit;
@@ -601,8 +620,8 @@ case 'rp' :
 	login_header(__('Reset Password'), '<p class="message reset-pass">' . __('Enter your new password below.') . '</p>', $errors );

 ?>
-<form name="resetpassform" id="resetpassform" action="<?php echo esc_url( site_url( 'wp-login.php?action=resetpass&key=' . urlencode( $_GET['key'] ) . '&login=' . urlencode( $_GET['login'] ), 'login_post' ) ); ?>" method="post" autocomplete="off">
-	<input type="hidden" id="user_login" value="<?php echo esc_attr( $_GET['login'] ); ?>" autocomplete="off" />
+<form name="resetpassform" id="resetpassform" action="<?php echo esc_url( network_site_url( 'wp-login.php?action=resetpass', 'login_post' ) ); ?>" method="post" autocomplete="off">
+	<input type="hidden" id="user_login" value="<?php echo esc_attr( $rp_login ); ?>" autocomplete="off" />

 	<p>
 		<label for="pass1"><?php _e('New password') ?><br />
@@ -617,6 +636,7 @@ case 'rp' :
 	<p class="description indicator-hint"><?php _e('Hint: The password should be at least seven characters long. To make it stronger, use upper and lower case letters, numbers and symbols like ! " ? $ % ^ &amp; ).'); ?></p>

 	<br class="clear" />
+	<input type="hidden" name="rp_key" value="<?php echo esc_attr( $rp_key ); ?>" />
 	<p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e('Reset Password'); ?>" /></p>
 </form>
Author	SHA1	Message	Date
Helen Hou-Sandí	db1e6dd7db	Tag 3.8.7. Built from https://develop.svn.wordpress.org/@32290 git-svn-id: http://core.svn.wordpress.org/tags/3.8.7@32261 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-23 22:39:05 +00:00
Helen Hou-Sandí	da9b7a3b48	The 3.8 branch is now 3.8.7. Built from https://develop.svn.wordpress.org/branches/3.8@32285 git-svn-id: http://core.svn.wordpress.org/branches/3.8@32256 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-23 21:36:02 +00:00
Gary Pendergast	1975036fc4	WPDB: When sanity checking a string by sending it to MySQL for conversion checks, the incorrect data structure was being returned from wpdb::strip_invalid_text(), causing all write queries to fail for some character sets when the query contained non-ASCII characters. Merge of [32261] to the 3.8 branch. See #32051. Built from https://develop.svn.wordpress.org/branches/3.8@32274 git-svn-id: http://core.svn.wordpress.org/branches/3.8@32245 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-23 11:52:11 +00:00
Gary Pendergast	b93fea1bbb	WPDB: When deciding if a query needs extra sanity checking based on collation, return early when we can. Merges [32232] and [32233] to the 3.8 branch. See #32029. Built from https://develop.svn.wordpress.org/branches/3.8@32240 git-svn-id: http://core.svn.wordpress.org/branches/3.8@32211 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-21 07:01:10 +00:00
Gary Pendergast	983bd76658	Bump 3.8 branch to 3.8.6. Built from https://develop.svn.wordpress.org/branches/3.8@32215 git-svn-id: http://core.svn.wordpress.org/branches/3.8@32189 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 17:36:11 +00:00
Gary Pendergast	4427438a56	3.8: Update about.php. Built from https://develop.svn.wordpress.org/branches/3.8@32214 git-svn-id: http://core.svn.wordpress.org/branches/3.8@32188 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 17:34:09 +00:00
Gary Pendergast	46b1d12a64	Ensure post titles are correctly escaped on the Dashboard. Merge of [32175] to the 3.8 branch. Props helen, ocean90, dd32, pento. Built from https://develop.svn.wordpress.org/branches/3.8@32205 git-svn-id: http://core.svn.wordpress.org/branches/3.8@32178 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 13:42:10 +00:00
Gary Pendergast	67b4625791	In Multisite, prevent plugins from unintentionally switching sites. Merge of [32173] to the 3.8 branch. Props mdawaffe, pento. Built from https://develop.svn.wordpress.org/branches/3.8@32201 git-svn-id: http://core.svn.wordpress.org/branches/3.8@32174 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 13:26:10 +00:00
Gary Pendergast	7bf1b6ce40	Remove some old backwards compatibility code from TinyMCE. Merge of [32166] to the 3.8 branch. Props azaozz. Built from https://develop.svn.wordpress.org/branches/3.8@32195 git-svn-id: http://core.svn.wordpress.org/branches/3.8@32168 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 12:55:11 +00:00
Gary Pendergast	049740b854	Clean up some edge cases in `sanitize_sql_orderby()`. Merge of [32164] to the 3.8 branch. Props vortfu, dd32. Built from https://develop.svn.wordpress.org/branches/3.8@32191 git-svn-id: http://core.svn.wordpress.org/branches/3.8@32164 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 12:38:10 +00:00
Gary Pendergast	e5706783f0	Merge the query sanity checks from #21212 to the 3.8 branch. Props pento, nacin, mdawaffe, DrewAPicture. Built from https://develop.svn.wordpress.org/branches/3.8@32186 git-svn-id: http://core.svn.wordpress.org/branches/3.8@32159 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 11:32:11 +00:00
Gary Pendergast	2671c3eb8f	3.8: Bump package.json, readme.html and license.txt. Built from https://develop.svn.wordpress.org/branches/3.8@32158 git-svn-id: http://core.svn.wordpress.org/branches/3.8@32133 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 03:48:09 +00:00
Gary Pendergast	37d6092e6c	The 3.8 branch is now 3.8.6-alpha. Built from https://develop.svn.wordpress.org/branches/3.8@32157 git-svn-id: http://core.svn.wordpress.org/branches/3.8@32132 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 03:46:10 +00:00
Andrew Nacin	86dbc0e9f7	3.8.5 version bumps. Built from https://develop.svn.wordpress.org/branches/3.8@30473 git-svn-id: http://core.svn.wordpress.org/branches/3.8@30464 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 16:26:19 +00:00
Andrew Nacin	81a07d58df	Prevent high resource usage when hashing large passwords. props mdawaffe, pento Merges [30466] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@30469 git-svn-id: http://core.svn.wordpress.org/branches/3.8@30460 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 16:07:10 +00:00
Andrew Nacin	a8ee34c745	Validate image data. Merges [30458] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@30464 git-svn-id: http://core.svn.wordpress.org/branches/3.8@30455 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 15:59:10 +00:00
Andrew Nacin	e8613eb44a	Anchor texturize to shortcodes to improve regex efficiency. Merges [30452] to the 3.8 branch. props miqrogroove. see #29557 for segfault issues. Built from https://develop.svn.wordpress.org/branches/3.8@30455 git-svn-id: http://core.svn.wordpress.org/branches/3.8@30446 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 14:37:10 +00:00
Andrew Nacin	10f8d67e1b	Better validation of the URL used in core HTTP requests. Merges [30443] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@30446 git-svn-id: http://core.svn.wordpress.org/branches/3.8@30441 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 14:02:23 +00:00
Andrew Nacin	b8f2bbf7d3	Press This: Ensure the error message is printed. props johnbillion Merges [30438] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@30441 git-svn-id: http://core.svn.wordpress.org/branches/3.8@30436 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 14:00:10 +00:00
Andrew Nacin	916509ecd6	Invalidate password keys when a user's email changes. Merges [30430] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@30433 git-svn-id: http://core.svn.wordpress.org/branches/3.8@30428 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 13:42:25 +00:00
Andrew Nacin	41c66d64fb	Fix typo in style filter. props miqrogroove Merges [30425] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@30428 git-svn-id: http://core.svn.wordpress.org/branches/3.8@30423 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 13:16:52 +00:00
Andrew Nacin	fb7b89a23d	Form validation for password resets. Merges [30417] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@30420 git-svn-id: http://core.svn.wordpress.org/branches/3.8@30415 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 12:25:11 +00:00
Andrew Nacin	2a05a279fd	Use hash_equals() for old md5 hashes. Merges [30412] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@30415 git-svn-id: http://core.svn.wordpress.org/branches/3.8@30410 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 12:05:11 +00:00
Andrew Nacin	57e6b6e116	Password resets: Use network_site_url() for form actions. Merges [29631] to the 3.8 branch. props mdawaffe. fixes #29156. Built from https://develop.svn.wordpress.org/branches/3.8@29639 git-svn-id: http://core.svn.wordpress.org/branches/3.8@29413 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-27 03:05:10 +00:00
Andrew Nacin	78d0ddfa36	3.8.4 Built from https://develop.svn.wordpress.org/branches/3.8@29412 git-svn-id: http://core.svn.wordpress.org/branches/3.8@29190 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 18:27:27 +00:00
Andrew Nacin	fafada01b7	Use delimiters when building nonce hashes. Part two of [29386]. Built from https://develop.svn.wordpress.org/branches/3.8@29409 git-svn-id: http://core.svn.wordpress.org/branches/3.8@29187 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 17:58:11 +00:00
Andrew Nacin	7f5fcb184b	Ignore entities in XML-RPC requests. Merges [29404] to the 3.8 branch. props mdawaffe, nacin. Built from https://develop.svn.wordpress.org/branches/3.8@29406 git-svn-id: http://core.svn.wordpress.org/branches/3.8@29184 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 17:51:11 +00:00
Andrew Nacin	8905d8bda9	Escape late in get_avatar(). Merges [29397] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@29399 git-svn-id: http://core.svn.wordpress.org/branches/3.8@29177 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 07:51:25 +00:00
Andrew Nacin	1282f9b034	Don't pass around the password reset key. Merges [29327] and [29381] to the 3.9 branch. props mdawaffe. fixes #29060. Built from https://develop.svn.wordpress.org/branches/3.8@29395 git-svn-id: http://core.svn.wordpress.org/branches/3.8@29173 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 06:38:13 +00:00
Andrew Nacin	1f14360fe8	Disable external entities in ID3. Merges [29378] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@29391 git-svn-id: http://core.svn.wordpress.org/branches/3.8@29169 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 05:58:10 +00:00
Andrew Nacin	72d44b2fce	Constant time for wp_verify_nonce(). Merges [29384] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@29386 git-svn-id: http://core.svn.wordpress.org/branches/3.8@29164 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 05:43:22 +00:00
Andrew Nacin	f9bf8f0886	3.8.4-alpha Built from https://develop.svn.wordpress.org/branches/3.8@29385 git-svn-id: http://core.svn.wordpress.org/branches/3.8@29163 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-08-06 05:43:12 +00:00
Andrew Nacin	a12cfb6179	3.8.3 Built from https://develop.svn.wordpress.org/branches/3.8@28118 git-svn-id: http://core.svn.wordpress.org/branches/3.8@27949 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-14 19:04:11 +00:00
Andrew Nacin	0afc974ff2	Avoid stomping of bulk postdata inside the bulk_edit_posts() loop. Merge [28113] to the 3.8 branch. Reverts [27991] which did not fix it for authors and comment/ping status. props dd32, DrewAPicture. fixes #27792. Built from https://develop.svn.wordpress.org/branches/3.8@28114 git-svn-id: http://core.svn.wordpress.org/branches/3.8@27945 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-14 08:11:11 +00:00
Andrew Nacin	16f887b203	3.8.3-RC1 Built from https://develop.svn.wordpress.org/branches/3.8@28076 git-svn-id: http://core.svn.wordpress.org/branches/3.8@27907 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-11 16:56:11 +00:00
Andrew Nacin	3067ceb31a	Recover auto-drafts lost via Quick Draft. For the 3.8 branch. See [28074]. see #27734. Built from https://develop.svn.wordpress.org/branches/3.8@28075 git-svn-id: http://core.svn.wordpress.org/branches/3.8@27906 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-11 16:55:11 +00:00
Andrew Nacin	e635b17840	Ensure edit_post() promotes an auto-draft to draft. Fixes Quick Draft. For the 3.8 branch. Regression from [27976] that does not affect trunk. props dd32. see #27734. Built from https://develop.svn.wordpress.org/branches/3.8@28073 git-svn-id: http://core.svn.wordpress.org/branches/3.8@27904 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-04-11 04:34:13 +00:00