Tag 3.8.19

Built from https://develop.svn.wordpress.org/tags/3.8.19@40222 git-svn-id: http://core.svn.wordpress.org/tags/3.8.19@40161 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Bump 3.8 branch to version 3.8.19.
2017-03-06 18:17:07 +00:00 · 2017-03-06 16:47:12 +00:00 · 2017-03-06 13:46:12 +00:00 · 2017-03-06 13:05:26 +00:00 · 2017-03-06 08:13:13 +00:00 · 2017-01-26 18:30:15 +00:00
49 changed files with 5990 additions and 3898 deletions
--- a/license.txt
+++ b/license.txt
@@ -1,6 +1,6 @@
 WordPress - Web publishing software

-Copyright 2015 by the contributors
+Copyright 2017 by the contributors

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
--- a/readme.html
+++ b/readme.html
@@ -9,7 +9,7 @@
 <body>
 <h1 id="logo">
 	<a href="http://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
-	<br /> Version 3.8.8
+	<br /> Version 3.8.19
 </h1>
 <p style="text-align: center">Semantic Personal Publishing Platform</p>

--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -39,7 +39,51 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 </h2>

 <div class="changelog point-releases">
-	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 8 ); ?></h3>
+	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 19 ); ?></h3>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 5 ), '3.8.19' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.19' ); ?>
+	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 3 ), '3.8.18' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.18' ); ?>
+	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 8 ), '3.8.17' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.17' ); ?>
+	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 2 ), '3.8.16' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.16' ); ?>
+	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 9 ), '3.8.15' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.15' ); ?>
+	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 6 ), '3.8.14' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.14' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 2 ), '3.8.13' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.13' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 1 ), '3.8.12' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.12' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
+         '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 2 ), '3.8.11', number_format_i18n( 2 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.11' ); ?>
+	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
+         '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 2 ), '3.8.10', number_format_i18n( 2 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.10' ); ?>
+	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 2 ), '3.8.9' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.9' ); ?>
+ 	</p>
 	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
         '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 3 ), '3.8.8', number_format_i18n( 3 ) ); ?>
 		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.8' ); ?>
--- a/wp-admin/customize.php
+++ b/wp-admin/customize.php
@@ -15,9 +15,10 @@ if ( ! current_user_can( 'edit_theme_options' ) )

 wp_reset_vars( array( 'url', 'return' ) );
 $url = urldecode( $url );
+$url = esc_url_raw( $url );
 $url = wp_validate_redirect( $url, home_url( '/' ) );
 if ( $return )
-	$return = wp_validate_redirect( urldecode( $return ) );
+	$return = wp_validate_redirect( esc_url_raw( urldecode( $return ) ) );
 if ( ! $return )
 	$return = $url;

--- a/wp-admin/includes/ajax-actions.php
+++ b/wp-admin/includes/ajax-actions.php
@@ -1373,11 +1373,13 @@ function wp_ajax_inline_save() {
 	if ( isset($data['post_parent']) )
 		$data['parent_id'] = $data['post_parent'];

-	// status
-	if ( isset($data['keep_private']) && 'private' == $data['keep_private'] )
+	// Status.
+	if ( isset( $data['keep_private'] ) && 'private' == $data['keep_private'] ) {
+		$data['visibility']  = 'private';
 		$data['post_status'] = 'private';
-	else
+	} else {
 		$data['post_status'] = $data['_status'];
+	}

 	if ( empty($data['comment_status']) )
 		$data['comment_status'] = 'closed';
@@ -2220,7 +2222,7 @@ function wp_ajax_get_revision_diffs() {
 	if ( ! $post = get_post( (int) $_REQUEST['post_id'] ) )
 		wp_send_json_error();

-	if ( ! current_user_can( 'read_post', $post->ID ) )
+	if ( ! current_user_can( 'edit_post', $post->ID ) )
 		wp_send_json_error();

 	// Really just pre-loading the cache here.
--- a/wp-admin/includes/class-wp-ms-users-list-table.php
+++ b/wp-admin/includes/class-wp-ms-users-list-table.php
@@ -219,7 +219,7 @@ class WP_MS_Users_List_Table extends WP_List_Table {
 					break;

 					case 'email':
-						echo "<td $attributes><a href='mailto:$user->user_email'>$user->user_email</a></td>";
+						echo "<td $attributes><a href='" . esc_url( "mailto:$user->user_email" ) . "'>$user->user_email</a></td>";
 					break;

 					case 'registered':
--- a/wp-admin/includes/class-wp-posts-list-table.php
+++ b/wp-admin/includes/class-wp-posts-list-table.php
@@ -587,8 +587,9 @@ class WP_Posts_List_Table extends WP_List_Table {
 					echo '<div class="locked-info"><span class="locked-avatar">' . $locked_avatar . '</span> <span class="locked-text">' . $locked_text . "</span></div>\n";
 				}

-				if ( ! $this->hierarchical_display && 'excerpt' == $mode && current_user_can( 'read_post', $post->ID ) )
-						the_excerpt();
+				if ( ! $this->hierarchical_display && 'excerpt' == $mode && current_user_can( 'read_post', $post->ID ) ) {
+						echo esc_html( get_the_excerpt() );
+				}

 				$actions = array();
 				if ( $can_edit_post && 'trash' != $post->post_status ) {
--- a/wp-admin/includes/class-wp-upgrader.php
+++ b/wp-admin/includes/class-wp-upgrader.php
@@ -1601,8 +1601,12 @@ class File_Upload_Upgrader {
 			if ( ! ( ( $uploads = wp_upload_dir() ) && false === $uploads['error'] ) )
 				wp_die( $uploads['error'] );

-			$this->filename = $_GET[$urlholder];
+			$this->filename = sanitize_file_name( $_GET[ $urlholder ] );
 			$this->package = $uploads['basedir'] . '/' . $this->filename;
+
+			if ( 0 !== strpos( realpath( $this->package ), realpath( $uploads['basedir'] ) ) ) {
+				wp_die( __( 'Please select a file' ) );
+			}
 		}
 	}

--- a/wp-admin/includes/class-wp-users-list-table.php
+++ b/wp-admin/includes/class-wp-users-list-table.php
@@ -294,7 +294,7 @@ class WP_Users_List_Table extends WP_List_Table {
 					$r .= "<td $attributes>$user_object->first_name $user_object->last_name</td>";
 					break;
 				case 'email':
-					$r .= "<td $attributes><a href='mailto:$email' title='" . esc_attr( sprintf( __( 'E-mail: %s' ), $email ) ) . "'>$email</a></td>";
+					$r .= "<td $attributes><a href='" . esc_url( "mailto:$email" ) . "' title='" . esc_attr( sprintf( __( 'E-mail: %s' ), $email ) ) . "'>$email</a></td>";
 					break;
 				case 'role':
 					$r .= "<td $attributes>$role_name</td>";
--- a/wp-admin/includes/dashboard.php
+++ b/wp-admin/includes/dashboard.php
@@ -333,6 +333,10 @@ function wp_network_dashboard_right_now() {
 function wp_dashboard_quick_press( $error_msg = false ) {
 	global $post_ID;

+	if ( ! current_user_can( 'edit_posts' ) ) {
+		return;
+	}
+
 	/* Check if a new auto-draft (= no new post_ID) is needed or if the old can be used */
 	$last_post_id = (int) get_user_option( 'dashboard_quick_press_last_post_id' ); // Get the last post_ID
 	if ( $last_post_id ) {
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -221,7 +221,7 @@ function media_handle_upload($file_id, $post_id, $post_data = array(), $override
 	$url = $file['url'];
 	$type = $file['type'];
 	$file = $file['file'];
-	$title = $name;
+	$title = sanitize_text_field( $name );
 	$content = '';

 	if ( preg_match( '#^audio#', $type ) ) {
@@ -1558,7 +1558,7 @@ $post_params = array(
 $post_params = apply_filters( 'upload_post_params', $post_params ); // hook change! old name: 'swfupload_post_params'

 $plupload_init = array(
-	'runtimes' => 'html5,silverlight,flash,html4',
+	'runtimes' => 'html5,silverlight,html4',
 	'browse_button' => 'plupload-browse-button',
 	'container' => 'plupload-upload-ui',
 	'drop_element' => 'drag-drop-area',
@@ -2665,6 +2665,8 @@ function wp_read_video_metadata( $file ) {

 	wp_add_id3_tag_data( $metadata, $data );

+	$metadata = wp_kses_post_deep( $metadata );
+
 	return $metadata;
 }

@@ -2704,5 +2706,7 @@ function wp_read_audio_metadata( $file ) {

 	wp_add_id3_tag_data( $metadata, $data );

+	$metadata = wp_kses_post_deep( $metadata );
+
 	return $metadata;
 }
--- a/wp-admin/includes/post.php
+++ b/wp-admin/includes/post.php
@@ -154,6 +154,13 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
 		$post_data['post_date_gmt'] = get_gmt_from_date( $post_data['post_date'] );
 	}

+	if ( isset( $post_data['post_category'] ) ) {
+		$category_object = get_taxonomy( 'category' );
+		if ( ! current_user_can( $category_object->cap->assign_terms ) ) {
+			unset( $post_data['post_category'] );
+		}
+	}
+
 	return $post_data;
 }

@@ -1147,11 +1154,11 @@ function get_sample_permalink_html( $id, $new_title = null, $new_slug = null ) {
 	}

 	if ( false === strpos($permalink, '%postname%') && false === strpos($permalink, '%pagename%') ) {
-		$return = '<strong>' . __('Permalink:') . "</strong>\n" . '<span id="sample-permalink" tabindex="-1">' . $permalink . "</span>\n";
+		$return = '<strong>' . __('Permalink:') . "</strong>\n" . '<span id="sample-permalink" tabindex="-1">' . esc_html( $permalink ) . "</span>\n";
 		if ( '' == get_option( 'permalink_structure' ) && current_user_can( 'manage_options' ) && !( 'page' == get_option('show_on_front') && $id == get_option('page_on_front') ) )
 			$return .= '<span id="change-permalinks"><a href="options-permalink.php" class="button button-small" target="_blank">' . __('Change Permalinks') . "</a></span>\n";
 		if ( isset( $view_post ) )
-			$return .= "<span id='view-post-btn'><a href='$permalink' class='button button-small'>$view_post</a></span>\n";
+			$return .= "<span id='view-post-btn'><a href='" . esc_url( $permalink ) . "' class='button button-small'>$view_post</a></span>\n";

 		$return = apply_filters('get_sample_permalink_html', $return, $id, $new_title, $new_slug);

@@ -1172,16 +1179,16 @@ function get_sample_permalink_html( $id, $new_title = null, $new_slug = null ) {
 		}
 	}

-	$post_name_html = '<span id="editable-post-name" title="' . $title . '">' . $post_name_abridged . '</span>';
-	$display_link = str_replace(array('%pagename%','%postname%'), $post_name_html, $permalink);
+	$post_name_html = '<span id="editable-post-name" title="' . $title . '">' . esc_html( $post_name_abridged ) . '</span>';
+	$display_link = str_replace(array('%pagename%','%postname%'), $post_name_html, esc_html( $permalink ) );
 	$view_link = str_replace(array('%pagename%','%postname%'), $post_name, $permalink);
 	$return =  '<strong>' . __('Permalink:') . "</strong>\n";
 	$return .= '<span id="sample-permalink" tabindex="-1">' . $display_link . "</span>\n";
 	$return .= '&lrm;'; // Fix bi-directional text display defect in RTL languages.
 	$return .= '<span id="edit-slug-buttons"><a href="#post_name" class="edit-slug button button-small hide-if-no-js" onclick="editPermalink(' . $id . '); return false;">' . __('Edit') . "</a></span>\n";
-	$return .= '<span id="editable-post-name-full">' . $post_name . "</span>\n";
+	$return .= '<span id="editable-post-name-full">' . esc_html( $post_name ) . "</span>\n";
 	if ( isset($view_post) )
-		$return .= "<span id='view-post-btn'><a href='$view_link' class='button button-small'>$view_post</a></span>\n";
+		$return .= "<span id='view-post-btn'><a href='" . esc_url( $view_link ) . "' class='button button-small'>$view_post</a></span>\n";

 	$return = apply_filters('get_sample_permalink_html', $return, $id, $new_title, $new_slug);

@@ -1354,7 +1361,7 @@ function _admin_notice_post_locked() {
 		// Allow plugins to prevent some users overriding the post lock
 		if ( $override ) {
 			?>
-			<a class="button button-primary wp-tab-last" href="<?php echo esc_url( add_query_arg( 'get-post-lock', '1', get_edit_post_link( $post->ID, 'url' ) ) ); ?>"><?php _e('Take over'); ?></a>
+			<a class="button button-primary wp-tab-last" href="<?php echo esc_url( add_query_arg( 'get-post-lock', '1', wp_nonce_url( get_edit_post_link( $post->ID, 'url' ), 'lock-post_' . $post->ID ) ) ); ?>"><?php _e('Take over'); ?></a>
 			<?php
 		}

--- a/wp-admin/includes/screen.php
+++ b/wp-admin/includes/screen.php
@@ -885,7 +885,8 @@ final class WP_Screen {

 		switch ( $this->id ) {
 			case 'widgets':
-				$this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off">' . __('Disable accessibility mode') . "</a></p>\n";
+				$nonce = wp_create_nonce( 'widgets-access' );
+				$this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on&_wpnonce=' . urlencode( $nonce ) . '">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off&_wpnonce=' . urlencode( $nonce ) . '">' . __('Disable accessibility mode') . "</a></p>\n";
 				break;
 			default:
 				$this->_screen_settings = '';
--- a/wp-admin/network/settings.php
+++ b/wp-admin/network/settings.php
@@ -237,7 +237,7 @@ if ( isset( $_GET['updated'] ) ) {
 			<tr valign="top">
 				<th scope="row"><label for="first_comment_author"><?php _e( 'First Comment Author' ) ?></label></th>
 				<td>
-					<input type="text" size="40" name="first_comment_author" id="first_comment_author" value="<?php echo get_site_option('first_comment_author') ?>" />
+					<input type="text" size="40" name="first_comment_author" id="first_comment_author" value="<?php echo esc_attr( get_site_option('first_comment_author') ); ?>" />
 					<p class="description">
 						<?php _e( 'The author of the first comment on a new site.' ) ?>
 					</p>
--- a/wp-admin/plugins.php
+++ b/wp-admin/plugins.php
@@ -220,6 +220,14 @@ if ( $action ) {
 				exit;
 			}

+			// Bail on all if any paths are invalid.
+			// validate_file() returns truthy for invalid files
+			$invalid_plugin_files = array_filter( $plugins, 'validate_file' );
+			if ( $invalid_plugin_files ) {
+				wp_redirect( self_admin_url("plugins.php?plugin_status=$status&paged=$page&s=$s") );
+				exit;
+			}
+
 			include(ABSPATH . 'wp-admin/update.php');

 			$parent_file = 'plugins.php';
--- a/wp-admin/post.php
+++ b/wp-admin/post.php
@@ -109,8 +109,9 @@ case 'post-quickdraft-save':
 	if ( ! wp_verify_nonce( $nonce, 'add-post' ) )
 		$error_msg = __( 'Unable to submit this form, please refresh and try again.' );

-	if ( ! current_user_can( 'edit_posts' ) )
-		$error_msg = __( 'Oops, you don&#8217;t have access to add new drafts.' );
+	if ( ! current_user_can( 'edit_posts' ) ) {
+		exit;
+	}

 	if ( $error_msg )
 		return wp_dashboard_quick_press( $error_msg );
@@ -157,6 +158,7 @@ case 'edit':
 		wp_die( __( 'You can&#8217;t edit this item because it is in the Trash. Please restore it and try again.' ) );

 	if ( ! empty( $_GET['get-post-lock'] ) ) {
+		check_admin_referer( 'lock-post_' . $post_id );
 		wp_set_post_lock( $post_id );
 		wp_redirect( get_edit_post_link( $post_id, 'url' ) );
 		exit();
--- a/wp-admin/press-this.php
+++ b/wp-admin/press-this.php
@@ -34,8 +34,25 @@ function press_it() {
 	if ( !current_user_can('edit_post', $post_ID) )
 		wp_die(__('You are not allowed to edit this post.'));

-	$post['post_category'] = isset($_POST['post_category']) ? $_POST['post_category'] : '';
-	$post['tax_input'] = isset($_POST['tax_input']) ? $_POST['tax_input'] : '';
+	// Only accept categories if the user actually can assign
+	$category_tax = get_taxonomy( 'category' );
+	if ( current_user_can( $category_tax->cap->assign_terms ) ) {
+		$post['post_category'] = ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array();
+	}
+
+	// Only accept taxonomies if the user can actually assign
+	if ( ! empty( $_POST['tax_input'] ) ) {
+		$tax_input = $_POST['tax_input'];
+		foreach ( $tax_input as $tax => $_ti ) {
+			$tax_object = get_taxonomy( $tax );
+			if ( ! $tax_object || ! current_user_can( $tax_object->cap->assign_terms ) ) {
+				unset( $tax_input[ $tax ] );
+			}
+		}
+
+		$post['tax_input'] = $tax_input;
+	}
+
 	$post['post_title'] = isset($_POST['title']) ? $_POST['title'] : '';
 	$content = isset($_POST['content']) ? $_POST['content'] : '';

@@ -509,75 +526,81 @@ $admin_body_class .= ' locale-' . sanitize_html_class( strtolower( str_replace(
 				</div>
 			</div>

-			<?php $tax = get_taxonomy( 'category' ); ?>
-			<div id="categorydiv" class="postbox">
-				<div class="handlediv" title="<?php esc_attr_e( 'Click to toggle' ); ?>"><br /></div>
-				<h3 class="hndle"><?php _e('Categories') ?></h3>
-				<div class="inside">
-				<div id="taxonomy-category" class="categorydiv">
+			<?php

-					<ul id="category-tabs" class="category-tabs">
-						<li class="tabs"><a href="#category-all"><?php echo $tax->labels->all_items; ?></a></li>
-						<li class="hide-if-no-js"><a href="#category-pop"><?php _e( 'Most Used' ); ?></a></li>
-					</ul>
+			$tax = get_taxonomy( 'category' );
+			if ( current_user_can( $tax->cap->assign_terms ) ) :
+				?>
+				<div id="categorydiv" class="postbox">
+					<div class="handlediv" title="<?php esc_attr_e( 'Click to toggle' ); ?>"><br /></div>
+					<h3 class="hndle"><?php _e('Categories') ?></h3>
+					<div class="inside">
+					<div id="taxonomy-category" class="categorydiv">

-					<div id="category-pop" class="tabs-panel" style="display: none;">
-						<ul id="categorychecklist-pop" class="categorychecklist form-no-clear" >
-							<?php $popular_ids = wp_popular_terms_checklist( 'category' ); ?>
+						<ul id="category-tabs" class="category-tabs">
+							<li class="tabs"><a href="#category-all"><?php echo $tax->labels->all_items; ?></a></li>
+							<li class="hide-if-no-js"><a href="#category-pop"><?php _e( 'Most Used' ); ?></a></li>
 						</ul>
-					</div>

-					<div id="category-all" class="tabs-panel">
-						<ul id="categorychecklist" data-wp-lists="list:category" class="categorychecklist form-no-clear">
-							<?php wp_terms_checklist($post_ID, array( 'taxonomy' => 'category', 'popular_cats' => $popular_ids ) ) ?>
-						</ul>
-					</div>
-
-					<?php if ( !current_user_can($tax->cap->assign_terms) ) : ?>
-					<p><em><?php _e('You cannot modify this Taxonomy.'); ?></em></p>
-					<?php endif; ?>
-					<?php if ( current_user_can($tax->cap->edit_terms) ) : ?>
-						<div id="category-adder" class="wp-hidden-children">
-							<h4>
-								<a id="category-add-toggle" href="#category-add" class="hide-if-no-js">
-									<?php printf( __( '+ %s' ), $tax->labels->add_new_item ); ?>
-								</a>
-							</h4>
-							<p id="category-add" class="category-add wp-hidden-child">
-								<label class="screen-reader-text" for="newcategory"><?php echo $tax->labels->add_new_item; ?></label>
-								<input type="text" name="newcategory" id="newcategory" class="form-required form-input-tip" value="<?php echo esc_attr( $tax->labels->new_item_name ); ?>" aria-required="true"/>
-								<label class="screen-reader-text" for="newcategory_parent">
-									<?php echo $tax->labels->parent_item_colon; ?>
-								</label>
-								<?php wp_dropdown_categories( array( 'taxonomy' => 'category', 'hide_empty' => 0, 'name' => 'newcategory_parent', 'orderby' => 'name', 'hierarchical' => 1, 'show_option_none' => '&mdash; ' . $tax->labels->parent_item . ' &mdash;' ) ); ?>
-								<input type="button" id="category-add-submit" data-wp-lists="add:categorychecklist:category-add" class="button category-add-submit" value="<?php echo esc_attr( $tax->labels->add_new_item ); ?>" />
-								<?php wp_nonce_field( 'add-category', '_ajax_nonce-add-category', false ); ?>
-								<span id="category-ajax-response"></span>
-							</p>
+						<div id="category-pop" class="tabs-panel" style="display: none;">
+							<ul id="categorychecklist-pop" class="categorychecklist form-no-clear" >
+								<?php $popular_ids = wp_popular_terms_checklist( 'category' ); ?>
+							</ul>
 						</div>
-					<?php endif; ?>
-				</div>
-				</div>
-			</div>

-			<div id="tagsdiv-post_tag" class="postbox">
-				<div class="handlediv" title="<?php esc_attr_e( 'Click to toggle' ); ?>"><br /></div>
-				<h3><span><?php _e('Tags'); ?></span></h3>
-				<div class="inside">
-					<div class="tagsdiv" id="post_tag">
-						<div class="jaxtag">
-							<label class="screen-reader-text" for="newtag"><?php _e('Tags'); ?></label>
-							<input type="hidden" name="tax_input[post_tag]" class="the-tags" id="tax-input[post_tag]" value="" />
-							<div class="ajaxtag">
-								<input type="text" name="newtag[post_tag]" class="newtag form-input-tip" size="16" autocomplete="off" value="" />
-								<input type="button" class="button tagadd" value="<?php esc_attr_e('Add'); ?>" />
+						<div id="category-all" class="tabs-panel">
+							<ul id="categorychecklist" data-wp-lists="list:category" class="categorychecklist form-no-clear">
+								<?php wp_terms_checklist($post_ID, array( 'taxonomy' => 'category', 'popular_cats' => $popular_ids ) ) ?>
+							</ul>
+						</div>
+
+						<?php if ( current_user_can($tax->cap->edit_terms) ) : ?>
+							<div id="category-adder" class="wp-hidden-children">
+								<h4>
+									<a id="category-add-toggle" href="#category-add" class="hide-if-no-js">
+										<?php printf( __( '+ %s' ), $tax->labels->add_new_item ); ?>
+									</a>
+								</h4>
+								<p id="category-add" class="category-add wp-hidden-child">
+									<label class="screen-reader-text" for="newcategory"><?php echo $tax->labels->add_new_item; ?></label>
+									<input type="text" name="newcategory" id="newcategory" class="form-required form-input-tip" value="<?php echo esc_attr( $tax->labels->new_item_name ); ?>" aria-required="true"/>
+									<label class="screen-reader-text" for="newcategory_parent">
+										<?php echo $tax->labels->parent_item_colon; ?>
+									</label>
+									<?php wp_dropdown_categories( array( 'taxonomy' => 'category', 'hide_empty' => 0, 'name' => 'newcategory_parent', 'orderby' => 'name', 'hierarchical' => 1, 'show_option_none' => '&mdash; ' . $tax->labels->parent_item . ' &mdash;' ) ); ?>
+									<input type="button" id="category-add-submit" data-wp-lists="add:categorychecklist:category-add" class="button category-add-submit" value="<?php echo esc_attr( $tax->labels->add_new_item ); ?>" />
+									<?php wp_nonce_field( 'add-category', '_ajax_nonce-add-category', false ); ?>
+									<span id="category-ajax-response"></span>
+								</p>
 							</div>
-						</div>
-						<div class="tagchecklist"></div>
+						<?php endif; ?>
+					</div>
 					</div>
-					<p class="tagcloud-link"><a href="#titlediv" class="tagcloud-link" id="link-post_tag"><?php _e('Choose from the most used tags'); ?></a></p>
 				</div>
-			</div>
+			<?php endif;
+
+			$tax = get_taxonomy( 'post_tag' );
+			if ( current_user_can( $tax->cap->assign_terms ) ) :
+				?>
+				<div id="tagsdiv-post_tag" class="postbox">
+					<div class="handlediv" title="<?php esc_attr_e( 'Click to toggle' ); ?>"><br /></div>
+					<h3><span><?php _e('Tags'); ?></span></h3>
+					<div class="inside">
+						<div class="tagsdiv" id="post_tag">
+							<div class="jaxtag">
+								<label class="screen-reader-text" for="newtag"><?php _e('Tags'); ?></label>
+								<input type="hidden" name="tax_input[post_tag]" class="the-tags" id="tax-input[post_tag]" value="" />
+								<div class="ajaxtag">
+									<input type="text" name="newtag[post_tag]" class="newtag form-input-tip" size="16" autocomplete="off" value="" />
+									<input type="button" class="button tagadd" value="<?php esc_attr_e('Add'); ?>" />
+								</div>
+							</div>
+							<div class="tagchecklist"></div>
+						</div>
+						<p class="tagcloud-link"><a href="#titlediv" class="tagcloud-link" id="link-post_tag"><?php _e('Choose from the most used tags'); ?></a></p>
+					</div>
+				</div>
+			<?php endif; ?>
 		</div>
 	</div>
 	<div class="posting">
--- a/wp-admin/revision.php
+++ b/wp-admin/revision.php
@@ -63,7 +63,7 @@ default :
 	if ( ! $post = get_post( $revision->post_parent ) )
 		break;

-	if ( ! current_user_can( 'read_post', $revision->ID ) || ! current_user_can( 'read_post', $post->ID ) )
+	if ( ! current_user_can( 'read_post', $revision->ID ) || ! current_user_can( 'edit_post', $revision->post_parent ) )
 		break;

 	// Revisions disabled and we're not looking at an autosave
--- a/wp-admin/update-core.php
+++ b/wp-admin/update-core.php
@@ -237,6 +237,8 @@ function list_plugin_updates() {
 	<tbody class="plugins">
 <?php
 	foreach ( (array) $plugins as $plugin_file => $plugin_data) {
+		$plugin_data = (object) _get_plugin_data_markup_translate( $plugin_file, (array) $plugin_data, false, true );
+
 		$info = plugins_api('plugin_information', array('slug' => $plugin_data->update->slug ));
 		// Get plugin compat for running version of WordPress.
 		if ( isset($info->tested) && version_compare($info->tested, $cur_wp_version, '>=') ) {
--- a/wp-admin/user-edit.php
+++ b/wp-admin/user-edit.php
@@ -98,7 +98,7 @@ if ( is_multisite()
 // Execute confirmed email change. See send_confirmation_on_profile_email().
 if ( is_multisite() && IS_PROFILE_PAGE && isset( $_GET[ 'newuseremail' ] ) && $current_user->ID ) {
 	$new_email = get_option( $current_user->ID . '_new_email' );
-	if ( $new_email[ 'hash' ] == $_GET[ 'newuseremail' ] ) {
+	if ( $new_email && hash_equals( $new_email[ 'hash' ], $_GET[ 'newuseremail' ] ) ) {
 		$user = new stdClass;
 		$user->ID = $current_user->ID;
 		$user->user_email = esc_html( trim( $new_email[ 'newemail' ] ) );
@@ -109,7 +109,8 @@ if ( is_multisite() && IS_PROFILE_PAGE && isset( $_GET[ 'newuseremail' ] ) && $c
 		wp_redirect( add_query_arg( array('updated' => 'true'), self_admin_url( 'profile.php' ) ) );
 		die();
 	}
-} elseif ( is_multisite() && IS_PROFILE_PAGE && !empty( $_GET['dismiss'] ) && $current_user->ID . '_new_email' == $_GET['dismiss'] ) {
+} elseif ( is_multisite() && IS_PROFILE_PAGE && !empty( $_GET['dismiss'] ) && $current_user->ID . '_new_email' === $_GET['dismiss'] ) {
+	check_admin_referer( 'dismiss-' . $current_user->ID . '_new_email' );
 	delete_option( $current_user->ID . '_new_email' );
 	wp_redirect( add_query_arg( array('updated' => 'true'), self_admin_url( 'profile.php' ) ) );
 	die();
@@ -406,7 +407,7 @@ if ( is_multisite() && is_network_admin() && ! IS_PROFILE_PAGE && current_user_c
 	$new_email = get_option( $current_user->ID . '_new_email' );
 	if ( $new_email && $new_email['newemail'] != $current_user->user_email && $profileuser->ID == $current_user->ID ) : ?>
 	<div class="updated inline">
-	<p><?php printf( __('There is a pending change of your e-mail to <code>%1$s</code>. <a href="%2$s">Cancel</a>'), $new_email['newemail'], esc_url( self_admin_url( 'profile.php?dismiss=' . $current_user->ID . '_new_email' ) ) ); ?></p>
+	<p><?php printf( __('There is a pending change of your e-mail to <code>%1$s</code>. <a href="%2$s">Cancel</a>'), esc_html( $new_email['newemail'] ), esc_url( wp_nonce_url( self_admin_url( 'profile.php?dismiss=' . $current_user->ID . '_new_email' ), 'dismiss-' . $current_user->ID . '_new_email' ) ) ); ?></p>
 	</div>
 	<?php endif; ?>
 	</td>
--- a/wp-admin/widgets.php
+++ b/wp-admin/widgets.php
@@ -17,6 +17,8 @@ if ( ! current_user_can('edit_theme_options') )

 $widgets_access = get_user_setting( 'widgets_access' );
 if ( isset($_GET['widgets-access']) ) {
+	check_admin_referer( 'widgets-access' );
+
 	$widgets_access = 'on' == $_GET['widgets-access'] ? 'on' : 'off';
 	set_user_setting( 'widgets_access', $widgets_access );
 }
--- a/wp-includes/capabilities.php
+++ b/wp-includes/capabilities.php
@@ -1104,8 +1104,10 @@ function map_meta_cap( $cap, $user_id ) {
 	case 'edit_post':
 	case 'edit_page':
 		$post = get_post( $args[0] );
-		if ( empty( $post ) )
+		if ( empty( $post ) ) {
+			$caps[] = 'do_not_allow';
 			break;
+		}

 		if ( 'revision' == $post->post_type ) {
 			$post = get_post( $post->post_parent );
@@ -1228,7 +1230,16 @@ function map_meta_cap( $cap, $user_id ) {
 		if ( empty( $comment ) )
 			break;
 		$post = get_post( $comment->comment_post_ID );
-		$caps = map_meta_cap( 'edit_post', $user_id, $post->ID );
+
+		/*
+		 * If the post doesn't exist, we have an orphaned comment.
+		 * Fall back to the edit_posts capability, instead.
+		 */
+		if ( $post ) {
+			$caps = map_meta_cap( 'edit_post', $user_id, $post->ID );
+		} else {
+			$caps = map_meta_cap( 'edit_posts', $user_id );
+		}
 		break;
 	case 'unfiltered_upload':
 		if ( defined('ALLOW_UNFILTERED_UPLOADS') && ALLOW_UNFILTERED_UPLOADS && ( !is_multisite() || is_super_admin( $user_id ) )  )
--- a/wp-includes/class-phpmailer.php
+++ b/wp-includes/class-phpmailer.php
--- a/wp-includes/class-smtp.php
+++ b/wp-includes/class-smtp.php
--- a/wp-includes/class-snoopy.php
+++ b/wp-includes/class-snoopy.php
@@ -999,20 +999,23 @@ class Snoopy
 		if(!empty($this->user) || !empty($this->pass))
 			$headers[] = "Authorization: BASIC ".base64_encode($this->user.":".$this->pass);

-		for($curr_header = 0; $curr_header < count($headers); $curr_header++) {
-			$safer_header = strtr( $headers[$curr_header], "\"", " " );
-			$cmdline_params .= " -H \"".$safer_header."\"";
+		$headerfile = tempnam( $this->temp_dir, "sno" );
+		$cmdline_params = '-k -D ' . escapeshellarg( $headerfile );
+
+		foreach ( $headers as $header ) {
+			$cmdline_params .= ' -H ' . escapeshellarg( $header );
 		}

-		if(!empty($body))
-			$cmdline_params .= " -d \"$body\"";
+		if ( ! empty( $body ) ) {
+			$cmdline_params .= ' -d ' . escapeshellarg( $body );
+		}

-		if($this->read_timeout > 0)
-			$cmdline_params .= " -m ".$this->read_timeout;
+		if ( $this->read_timeout > 0 ) {
+			$cmdline_params .= ' -m ' . escapeshellarg( $this->read_timeout );
+		}

-		$headerfile = tempnam($this->temp_dir, "sno");

-		exec($this->curl_path." -k -D \"$headerfile\"".$cmdline_params." \"".escapeshellcmd($URI)."\"",$results,$return);
+		exec( $this->curl_path . ' ' . $cmdline_params . ' ' . escapeshellarg( $URI ), $results, $return );

 		if($return)
 		{
--- a/wp-includes/class-wp-embed.php
+++ b/wp-includes/class-wp-embed.php
@@ -57,7 +57,7 @@ class WP_Embed {
 		add_shortcode( 'embed', array( $this, 'shortcode' ) );

 		// Do the shortcode (only the [embed] one is registered)
-		$content = do_shortcode( $content );
+		$content = do_shortcode( $content, true );

 		// Put the original shortcodes back
 		$shortcode_tags = $orig_shortcode_tags;
@@ -280,7 +280,14 @@ class WP_Embed {
 	 * @return string Potentially modified $content.
 	 */
 	function autoembed( $content ) {
-		return preg_replace_callback( '|^\s*(https?://[^\s"]+)\s*$|im', array( $this, 'autoembed_callback' ), $content );
+		// Replace line breaks from all HTML elements with placeholders.
+		$content = wp_replace_in_html_tags( $content, array( "\n" => '<!-- wp-line-break -->' ) );
+
+		// Find URLs that are on their own line.
+		$content = preg_replace_callback( '|^\s*(https?://[^\s"]+)\s*$|im', array( $this, 'autoembed_callback' ), $content );
+
+		// Put the line breaks back.
+		return str_replace( '<!-- wp-line-break -->', "\n", $content );
 	}

 	/**
--- a/wp-includes/class-wp-theme.php
+++ b/wp-includes/class-wp-theme.php
@@ -215,7 +215,7 @@ final class WP_Theme implements ArrayAccess {
 		} elseif ( ! file_exists( $this->theme_root . '/' . $theme_file ) ) {
 			$this->headers['Name'] = $this->stylesheet;
 			if ( ! file_exists( $this->theme_root . '/' . $this->stylesheet ) )
-				$this->errors = new WP_Error( 'theme_not_found', sprintf( __( 'The theme directory "%s" does not exist.' ), $this->stylesheet ) );
+				$this->errors = new WP_Error( 'theme_not_found', sprintf( __( 'The theme directory "%s" does not exist.' ), esc_html( $this->stylesheet ) ) );
 			else
 				$this->errors = new WP_Error( 'theme_no_stylesheet', __( 'Stylesheet is missing.' ) );
 			$this->template = $this->stylesheet;
@@ -262,7 +262,7 @@ final class WP_Theme implements ArrayAccess {
 				$theme_root_template = $directories[ $this->template ]['theme_root'];
 			} else {
 				// Parent theme is missing.
-				$this->errors = new WP_Error( 'theme_no_parent', sprintf( __( 'The parent theme is missing. Please install the "%s" parent theme.' ), $this->template ) );
+				$this->errors = new WP_Error( 'theme_no_parent', sprintf( __( 'The parent theme is missing. Please install the "%s" parent theme.' ), esc_html( $this->template ) ) );
 				$this->cache_add( 'theme', array( 'headers' => $this->headers, 'errors' => $this->errors, 'stylesheet' => $this->stylesheet, 'template' => $this->template ) );
 				$this->parent = new WP_Theme( $this->template, $this->theme_root, $this );
 				return;
@@ -274,11 +274,11 @@ final class WP_Theme implements ArrayAccess {
 			// If we are a parent, then there is a problem. Only two generations allowed! Cancel things out.
 			if ( is_a( $_child, 'WP_Theme' ) && $_child->template == $this->stylesheet ) {
 				$_child->parent = null;
-				$_child->errors = new WP_Error( 'theme_parent_invalid', sprintf( __( 'The "%s" theme is not a valid parent theme.' ), $_child->template ) );
+				$_child->errors = new WP_Error( 'theme_parent_invalid', sprintf( __( 'The "%s" theme is not a valid parent theme.' ), esc_html( $_child->template ) ) );
 				$_child->cache_add( 'theme', array( 'headers' => $_child->headers, 'errors' => $_child->errors, 'stylesheet' => $_child->stylesheet, 'template' => $_child->template ) );
 				// The two themes actually reference each other with the Template header.
 				if ( $_child->stylesheet == $this->template ) {
-					$this->errors = new WP_Error( 'theme_parent_invalid', sprintf( __( 'The "%s" theme is not a valid parent theme.' ), $this->template ) );
+					$this->errors = new WP_Error( 'theme_parent_invalid', sprintf( __( 'The "%s" theme is not a valid parent theme.' ), esc_html( $this->template ) ) );
 					$this->cache_add( 'theme', array( 'headers' => $this->headers, 'errors' => $this->errors, 'stylesheet' => $this->stylesheet, 'template' => $this->template ) );
 				}
 				return;
@@ -650,8 +650,9 @@ final class WP_Theme implements ArrayAccess {
 	private function markup_header( $header, $value, $translate ) {
 		switch ( $header ) {
 			case 'Name' :
-				if ( empty( $value ) )
-					$value = $this->get_stylesheet();
+				if ( empty( $value ) ) {
+					$value = esc_html( $this->get_stylesheet() );
+				}
 				break;
 			case 'Description' :
 				$value = wptexturize( $value );
--- a/wp-includes/class-wp-xmlrpc-server.php
+++ b/wp-includes/class-wp-xmlrpc-server.php
@@ -989,6 +989,56 @@ class wp_xmlrpc_server extends IXR_Server {
 		return $count > 1;
 	}

+	private function _validate_boolean( $var ) {
+		if ( is_bool( $var ) ) {
+			return $var;
+		}
+
+		if ( is_string( $var ) && 'false' === strtolower( $var ) ) {
+			return false;
+		}
+
+		return (bool) $var;
+	}
+
+	/**
+	 * Encapsulate the logic for sticking a post
+	 * and determining if the user has permission to do so
+	 *
+	 * @since 4.3.0
+	 * @access private
+	 *
+	 * @param array $post_data
+	 * @param bool  $update
+	 * @return void|IXR_Error
+	 */
+	private function _toggle_sticky( $post_data, $update = false ) {
+		$post_type = get_post_type_object( $post_data['post_type'] );
+
+		// Private and password-protected posts cannot be stickied.
+		if ( 'private' === $post_data['post_status'] || ! empty( $post_data['post_password'] ) ) {
+			// Error if the client tried to stick the post, otherwise, silently unstick.
+			if ( ! empty( $post_data['sticky'] ) ) {
+				return new IXR_Error( 401, __( 'Sorry, you cannot stick a private post.' ) );
+			}
+
+			if ( $update ) {
+				unstick_post( $post_data['ID'] );
+			}
+		} elseif ( isset( $post_data['sticky'] ) )  {
+			if ( ! current_user_can( $post_type->cap->edit_others_posts ) ) {
+				return new IXR_Error( 401, __( 'Sorry, you are not allowed to stick this post.' ) );
+			}
+
+			$sticky = $this->_validate_boolean( $post_data['sticky'] );
+			if ( $sticky ) {
+				stick_post( $post_data['ID'] );
+			} else {
+				unstick_post( $post_data['ID'] );
+			}
+		}
+	}
+
 	/**
 	 * Helper method for wp_newPost and wp_editPost, containing shared logic.
 	 *
@@ -1081,20 +1131,9 @@ class wp_xmlrpc_server extends IXR_Server {
 		$post_ID = $post_data['ID'];

 		if ( $post_data['post_type'] == 'post' ) {
-			// Private and password-protected posts cannot be stickied.
-			if ( $post_data['post_status'] == 'private' || ! empty( $post_data['post_password'] ) ) {
-				// Error if the client tried to stick the post, otherwise, silently unstick.
-				if ( ! empty( $post_data['sticky'] ) )
-					return new IXR_Error( 401, __( 'Sorry, you cannot stick a private post.' ) );
-				if ( $update )
-					unstick_post( $post_ID );
-			} elseif ( isset( $post_data['sticky'] ) )  {
-				if ( ! current_user_can( $post_type->cap->edit_others_posts ) )
-					return new IXR_Error( 401, __( 'Sorry, you are not allowed to stick this post.' ) );
-				if ( $post_data['sticky'] )
-					stick_post( $post_ID );
-				else
-					unstick_post( $post_ID );
+			$error = $this->_toggle_sticky( $post_data, $update );
+			if ( $error ) {
+				return $error;
 			}
 		}

@@ -4271,10 +4310,12 @@ class wp_xmlrpc_server extends IXR_Server {

 		// Only posts can be sticky
 		if ( $post_type == 'post' && isset( $content_struct['sticky'] ) ) {
-			if ( $content_struct['sticky'] == true )
-				stick_post( $post_ID );
-			elseif ( $content_struct['sticky'] == false )
-				unstick_post( $post_ID );
+			$data = $postdata;
+			$data['sticky'] = $content_struct['sticky'];
+			$error = $this->_toggle_sticky( $data );
+			if ( $error ) {
+				return $error;
+			}
 		}

 		if ( isset($content_struct['custom_fields']) )
@@ -4538,11 +4579,12 @@ class wp_xmlrpc_server extends IXR_Server {

 		$tags_input = isset( $content_struct['mt_keywords'] ) ? $content_struct['mt_keywords'] : null;

-		if ( ('publish' == $post_status) ) {
-			if ( ( 'page' == $post_type ) && !current_user_can('publish_pages') )
-				return new IXR_Error(401, __('Sorry, you do not have the right to publish this page.'));
-			else if ( !current_user_can('publish_posts') )
-				return new IXR_Error(401, __('Sorry, you do not have the right to publish this post.'));
+		if ( 'publish' == $post_status || 'private' == $post_status ) {
+			if ( 'page' == $post_type && ! current_user_can( 'publish_pages' ) ) {
+				return new IXR_Error( 401, __( 'Sorry, you do not have the right to publish this page.' ) );
+			} elseif ( ! current_user_can( 'publish_posts' ) ) {
+				return new IXR_Error( 401, __( 'Sorry, you do not have the right to publish this post.' ) );
+			}
 		}

 		if ( $post_more )
@@ -4582,10 +4624,13 @@ class wp_xmlrpc_server extends IXR_Server {

 		// Only posts can be sticky
 		if ( $post_type == 'post' && isset( $content_struct['sticky'] ) ) {
-			if ( $content_struct['sticky'] == true )
-				stick_post( $post_ID );
-			elseif ( $content_struct['sticky'] == false )
-				unstick_post( $post_ID );
+			$data = $newpost;
+			$data['sticky'] = $content_struct['sticky'];
+			$data['post_type'] = 'post';
+			$error = $this->_toggle_sticky( $data, true );
+			if ( $error ) {
+				return $error;
+			}
 		}

 		if ( isset($content_struct['custom_fields']) )
--- a/wp-includes/default-widgets.php
+++ b/wp-includes/default-widgets.php
@@ -1144,7 +1144,7 @@ class WP_Widget_Tag_Cloud extends WP_Widget {
 		?>
 		<p>
 			<label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:') ?></label>
-			<input type="text" class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" value="<?php echo $title; ?>" />
+			<input type="text" class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" value="<?php echo esc_attr( $title ); ?>" />
 		</p>
 		<p>
 			<label for="<?php echo $this->get_field_id('nav_menu'); ?>"><?php _e('Select Menu:'); ?></label>
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -247,6 +247,10 @@ function wpautop($pee, $br = true) {
 	$pee = preg_replace('!(<' . $allblocks . '[^>]*>)!', "\n$1", $pee);
 	$pee = preg_replace('!(</' . $allblocks . '>)!', "$1\n\n", $pee);
 	$pee = str_replace(array("\r\n", "\r"), "\n", $pee); // cross-platform newlines
+
+	// Find newlines in all elements and add placeholders.
+	$pee = wp_replace_in_html_tags( $pee, array( "\n" => " <!-- wpnl --> " ) );
+
 	if ( strpos($pee, '<object') !== false ) {
 		$pee = preg_replace('|\s*<param([^>]*)>\s*|', "<param$1>", $pee); // no pee inside object/embed
 		$pee = preg_replace('|\s*</embed>\s*|', '</embed>', $pee);
@@ -277,9 +281,109 @@ function wpautop($pee, $br = true) {
 	if ( !empty($pre_tags) )
 		$pee = str_replace(array_keys($pre_tags), array_values($pre_tags), $pee);

+	// Restore newlines in all elements.
+	$pee = str_replace( " <!-- wpnl --> ", "\n", $pee );
+
 	return $pee;
 }

+/**
+ * Separate HTML elements and comments from the text.
+ *
+ * @since 4.2.4
+ *
+ * @param string $input The text which has to be formatted.
+ * @return array The formatted text.
+ */
+function wp_html_split( $input ) {
+	static $regex;
+
+	if ( ! isset( $regex ) ) {
+		$comments =
+			  '!'           // Start of comment, after the <.
+			. '(?:'         // Unroll the loop: Consume everything until --> is found.
+			.     '-(?!->)' // Dash not followed by end of comment.
+			.     '[^\-]*+' // Consume non-dashes.
+			. ')*+'         // Loop possessively.
+			. '(?:-->)?';   // End of comment. If not found, match all input.
+
+		$cdata =
+			  '!\[CDATA\['  // Start of comment, after the <.
+			. '[^\]]*+'     // Consume non-].
+			. '(?:'         // Unroll the loop: Consume everything until ]]> is found.
+			.     '](?!]>)' // One ] not followed by end of comment.
+			.     '[^\]]*+' // Consume non-].
+			. ')*+'         // Loop possessively.
+			. '(?:]]>)?';   // End of comment. If not found, match all input.
+
+		$regex =
+			  '/('              // Capture the entire match.
+			.     '<'           // Find start of element.
+			.     '(?(?=!--)'   // Is this a comment?
+			.         $comments // Find end of comment.
+			.     '|'
+			.         '(?(?=!\[CDATA\[)' // Is this a comment?
+			.             $cdata // Find end of comment.
+			.         '|'
+			.             '[^>]*>?' // Find end of element. If not found, match all input.
+			.         ')'
+			.     ')'
+			. ')/s';
+	}
+
+	return preg_split( $regex, $input, -1, PREG_SPLIT_DELIM_CAPTURE );
+}
+
+/**
+ * Replace characters or phrases within HTML elements only.
+ *
+ * @since 4.2.3
+ *
+ * @param string $haystack The text which has to be formatted.
+ * @param array $replace_pairs In the form array('from' => 'to', ...).
+ * @return string The formatted text.
+ */
+function wp_replace_in_html_tags( $haystack, $replace_pairs ) {
+	// Find all elements.
+	$textarr = wp_html_split( $haystack );
+	$changed = false;
+
+	// Optimize when searching for one item.
+	if ( 1 === count( $replace_pairs ) ) {
+		// Extract $needle and $replace.
+		foreach ( $replace_pairs as $needle => $replace );
+
+		// Loop through delimeters (elements) only.
+		for ( $i = 1, $c = count( $textarr ); $i < $c; $i += 2 ) { 
+			if ( false !== strpos( $textarr[$i], $needle ) ) {
+				$textarr[$i] = str_replace( $needle, $replace, $textarr[$i] );
+				$changed = true;
+			}
+		}
+	} else {
+		// Extract all $needles.
+		$needles = array_keys( $replace_pairs );
+
+		// Loop through delimeters (elements) only.
+		for ( $i = 1, $c = count( $textarr ); $i < $c; $i += 2 ) { 
+			foreach ( $needles as $needle ) {
+				if ( false !== strpos( $textarr[$i], $needle ) ) {
+					$textarr[$i] = strtr( $textarr[$i], $replace_pairs );
+					$changed = true;
+					// After one strtr() break out of the foreach loop and look at next element.
+					break;
+				}
+			}
+		}
+	}
+
+	if ( $changed ) {
+		$haystack = implode( $textarr );
+	}
+
+	return $haystack;
+}
+
 /**
 * Newline preservation help function for wpautop
 *
@@ -862,7 +966,8 @@ function remove_accents($string) {
 * operating systems and special characters requiring special escaping
 * to manipulate at the command line. Replaces spaces and consecutive
 * dashes with a single dash. Trims period, dash and underscore from beginning
- * and end of filename.
+ * and end of filename. It is not guaranteed that this function will return a
+ * filename that is allowed to be uploaded.
 *
 * @since 2.1.0
 *
@@ -885,6 +990,14 @@ function sanitize_file_name( $filename ) {
 	$filename = preg_replace('/[\s-]+/', '-', $filename);
 	$filename = trim($filename, '.-_');

+	if ( false === strpos( $filename, '.' ) ) {
+		$mime_types = wp_get_mime_types();
+		$filetype = wp_check_filetype( 'test.' . $filename, $mime_types );
+		if ( $filetype['ext'] === $filename ) {
+			$filename = 'unnamed-file.' . $filetype['ext'];
+		}
+	}
+
 	// Split the filename into a base and extension[s]
 	$parts = explode('.', $filename);

--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -1874,7 +1874,7 @@ function wp_check_filetype( $filename, $mimes = null ) {
 * If it's determined that the extension does not match the file's real type,
 * then the "proper_filename" value will be set with a proper filename and extension.
 *
- * Currently this function only supports validating images known to getimagesize().
+ * Currently this function only supports renaming images validated via wp_get_image_mime().
 *
 * @since 3.0.0
 *
@@ -1895,14 +1895,15 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {
 	if ( ! file_exists( $file ) )
 		return compact( 'ext', 'type', 'proper_filename' );

-	// We're able to validate images using GD
-	if ( $type && 0 === strpos( $type, 'image/' ) && function_exists('getimagesize') ) {
+	// Validate image types.
+	if ( $type && 0 === strpos( $type, 'image/' ) ) {

 		// Attempt to figure out what type of image it actually is
-		$imgstats = @getimagesize( $file );
+		$real_mime = wp_get_image_mime( $file );

-		// If getimagesize() knows what kind of image it really is and if the real MIME doesn't match the claimed MIME
-		if ( !empty($imgstats['mime']) && $imgstats['mime'] != $type ) {
+		if ( ! $real_mime ) {
+			$type = $ext = false;
+		} elseif ( $real_mime != $type ) {
 			// This is a simplified array of MIMEs that getimagesize() can detect and their extensions
 			// You shouldn't need to use this filter, but it's here just in case
 			$mime_to_ext = apply_filters( 'getimagesize_mimes_to_exts', array(
@@ -1914,10 +1915,10 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {
 			) );

 			// Replace whatever is after the last period in the filename with the correct extension
-			if ( ! empty( $mime_to_ext[ $imgstats['mime'] ] ) ) {
+			if ( ! empty( $mime_to_ext[ $real_mime ] ) ) {
 				$filename_parts = explode( '.', $filename );
 				array_pop( $filename_parts );
-				$filename_parts[] = $mime_to_ext[ $imgstats['mime'] ];
+				$filename_parts[] = $mime_to_ext[ $real_mime ];
 				$new_filename = implode( '.', $filename_parts );

 				if ( $new_filename != $filename )
@@ -1926,8 +1927,20 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {
 				// Redefine the extension / MIME
 				$wp_filetype = wp_check_filetype( $new_filename, $mimes );
 				extract( $wp_filetype );
+			} else {
+				$type = $ext = false;
 			}
 		}
+	} elseif ( function_exists( 'finfo_file' ) ) {
+		// Use finfo_file if available to validate non-image files.
+		$finfo = finfo_open( FILEINFO_MIME_TYPE );
+		$real_mime = finfo_file( $finfo, $file );
+		finfo_close( $finfo );
+
+		// If the extension does not match the file's real type, return false.
+		if ( $real_mime !== $type ) {
+			$type = $ext = false;
+		}
 	}

 	// Let plugins try and validate other types of files
@@ -1935,6 +1948,38 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {
 	return apply_filters( 'wp_check_filetype_and_ext', compact( 'ext', 'type', 'proper_filename' ), $file, $filename, $mimes );
 }

+/**
+ * Returns the real mime type of an image file.
+ *
+ * This depends on exif_imagetype() or getimagesize() to determine real mime types.
+ *
+ * @since 4.7.1
+ *
+ * @param string $file Full path to the file.
+ * @return string|false The actual mime type or false if the type cannot be determined.
+ */
+function wp_get_image_mime( $file ) {
+	/*
+	 * Use exif_imagetype() to check the mimetype if available or fall back to
+	 * getimagesize() if exif isn't avaialbe. If either function throws an Exception
+	 * we assume the file could not be validated.
+	 */
+	try {
+		if ( is_callable( 'exif_imagetype' ) ) {
+			$mime = image_type_to_mime_type( exif_imagetype( $file ) );
+		} elseif ( function_exists( 'getimagesize' ) ) {
+			$imagesize = getimagesize( $file );
+			$mime = ( isset( $imagesize['mime'] ) ) ? $imagesize['mime'] : false;
+		} else {
+			$mime = false;
+		}
+	} catch ( Exception $e ) {
+		$mime = false;
+	}
+
+	return $mime;
+}
+
 /**
 * Retrieve list of mime types and file extensions.
 *
--- a/wp-includes/http.php
+++ b/wp-includes/http.php
@@ -472,7 +472,7 @@ function wp_http_validate_url( $url ) {

 	if ( ! $same_host ) {
 		$host = trim( $parsed_url['host'], '.' );
-		if ( preg_match( '#^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$#', $host ) ) {
+		if ( preg_match( '#^(([1-9]?\d|1\d\d|25[0-5]|2[0-4]\d)\.){3}([1-9]?\d|1\d\d|25[0-5]|2[0-4]\d)$#', $host ) ) {
 			$ip = $host;
 		} else {
 			$ip = gethostbyname( $host );
@@ -481,7 +481,7 @@ function wp_http_validate_url( $url ) {
 		}
 		if ( $ip ) {
 			$parts = array_map( 'intval', explode( '.', $ip ) );
-			if ( 127 === $parts[0] || 10 === $parts[0]
+			if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]
 				|| ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
 				|| ( 192 === $parts[0] && 168 === $parts[1] )
 			) {
--- a/wp-includes/js/plupload/plupload.flash.js
+++ b/wp-includes/js/plupload/plupload.flash.js
--- a/wp-includes/js/plupload/plupload.flash.swf
+++ b/wp-includes/js/plupload/plupload.flash.swf
--- a/wp-includes/kses.php
+++ b/wp-includes/kses.php
@@ -486,6 +486,82 @@ function wp_kses( $string, $allowed_html, $allowed_protocols = array() ) {
 	return wp_kses_split($string, $allowed_html, $allowed_protocols);
 }

+/**
+ * Filters one attribute only and ensures its value is allowed.
+ *
+ * This function has the advantage of being more secure than esc_attr() and can
+ * escape data in some situations where wp_kses() must strip the whole attribute.
+ *
+ * @since 4.2.3
+ *
+ * @param string $string The 'whole' attribute, including name and value.
+ * @param string $element The element name to which the attribute belongs.
+ * @return string Filtered attribute.
+ */
+function wp_kses_one_attr( $string, $element ) {
+	$uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
+	$allowed_html = wp_kses_allowed_html( 'post' );
+	$allowed_protocols = wp_allowed_protocols();
+	$string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
+	$string = wp_kses_js_entities( $string );
+	$string = wp_kses_normalize_entities( $string );
+
+	// Preserve leading and trailing whitespace.
+	$matches = array();
+	preg_match('/^\s*/', $string, $matches);
+	$lead = $matches[0];
+	preg_match('/\s*$/', $string, $matches);
+	$trail = $matches[0];
+	if ( empty( $trail ) ) {
+		$string = substr( $string, strlen( $lead ) );
+	} else {
+		$string = substr( $string, strlen( $lead ), -strlen( $trail ) );
+	}
+	
+	// Parse attribute name and value from input.
+	$split = preg_split( '/\s*=\s*/', $string, 2 );
+	$name = $split[0];
+	if ( count( $split ) == 2 ) {
+		$value = $split[1];
+
+		// Remove quotes surrounding $value.
+		// Also guarantee correct quoting in $string for this one attribute.
+		if ( '' == $value ) {
+			$quote = '';
+		} else {
+			$quote = $value[0];
+		}
+		if ( '"' == $quote || "'" == $quote ) {
+			if ( substr( $value, -1 ) != $quote ) {
+				return '';
+			}
+			$value = substr( $value, 1, -1 );
+		} else {
+			$quote = '"';
+		}
+
+		// Sanitize quotes and angle braces.
+		$value = htmlspecialchars( $value, ENT_QUOTES, null, false );
+
+		// Sanitize URI values.
+		if ( in_array( strtolower( $name ), $uris ) ) {
+			$value = wp_kses_bad_protocol( $value, $allowed_protocols );
+		}
+
+		$string = "$name=$quote$value$quote";
+		$vless = 'n';
+	} else {
+		$value = '';
+		$vless = 'y';
+	}
+	
+	// Sanitize attribute by name.
+	wp_kses_attr_check( $name, $value, $string, $vless, $element, $allowed_html );
+
+	// Restore whitespace.
+	return $lead . $string . $trail;
+}
+
 /**
 * Return a list of allowed tags and attributes for a given context.
 *
@@ -683,45 +759,11 @@ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) {
 	# Go through $attrarr, and save the allowed attributes for this element
 	# in $attr2
 	$attr2 = '';
-
-	$allowed_attr = $allowed_html[strtolower($element)];
-	foreach ($attrarr as $arreach) {
-		if ( ! isset( $allowed_attr[strtolower($arreach['name'])] ) )
-			continue; # the attribute is not allowed
-
-		$current = $allowed_attr[strtolower($arreach['name'])];
-		if ( $current == '' )
-			continue; # the attribute is not allowed
-
-		if ( strtolower( $arreach['name'] ) == 'style' ) {
-			$orig_value = $arreach['value'];
-			$value = safecss_filter_attr( $orig_value );
-
-			if ( empty( $value ) )
-				continue;
-
-			$arreach['value'] = $value;
-			$arreach['whole'] = str_replace( $orig_value, $value, $arreach['whole'] );
-		}
-
-		if ( ! is_array($current) ) {
+	foreach ( $attrarr as $arreach ) {
+		if ( wp_kses_attr_check( $arreach['name'], $arreach['value'], $arreach['whole'], $arreach['vless'], $element, $allowed_html ) ) {
 			$attr2 .= ' '.$arreach['whole'];
-		# there are no checks
-
-		} else {
-			# there are some checks
-			$ok = true;
-			foreach ($current as $currkey => $currval) {
-				if ( ! wp_kses_check_attr_val($arreach['value'], $arreach['vless'], $currkey, $currval) ) {
-					$ok = false;
-					break;
-				}
-			}
-
-			if ( $ok )
-				$attr2 .= ' '.$arreach['whole']; # it passed them
-		} # if !is_array($current)
-	} # foreach
+		}
+	}

 	# Remove any "<" or ">" characters
 	$attr2 = preg_replace('/[<>]/', '', $attr2);
@@ -729,6 +771,53 @@ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) {
 	return "<$element$attr2$xhtml_slash>";
 }

+/**
+ * Determine whether an attribute is allowed.
+ *
+ * @since 4.2.3
+ *
+ * @param string $name The attribute name. Returns empty string when not allowed.
+ * @param string $value The attribute value. Returns a filtered value.
+ * @param string $whole The name=value input. Returns filtered input.
+ * @param string $vless 'y' when attribute like "enabled", otherwise 'n'.
+ * @param string $element The name of the element to which this attribute belongs.
+ * @param array $allowed_html The full list of allowed elements and attributes.
+ * @return bool Is the attribute allowed?
+ */
+function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) {
+	$allowed_attr = $allowed_html[strtolower( $element )];
+
+	$name_low = strtolower( $name );
+	if ( ! isset( $allowed_attr[$name_low] ) || '' == $allowed_attr[$name_low] ) {
+		$name = $value = $whole = '';
+		return false;
+	}
+
+	if ( 'style' == $name_low ) {
+		$new_value = safecss_filter_attr( $value );
+
+		if ( empty( $new_value ) ) {
+			$name = $value = $whole = '';
+			return false;
+		}
+
+		$whole = str_replace( $value, $new_value, $whole );
+		$value = $new_value;
+	}
+
+	if ( is_array( $allowed_attr[$name_low] ) ) {
+		// there are some checks
+		foreach ( $allowed_attr[$name_low] as $currkey => $currval ) {
+			if ( ! wp_kses_check_attr_val( $value, $vless, $currkey, $currval ) ) {
+				$name = $value = $whole = '';
+				return false;
+			}
+		}
+	}
+
+	return true;
+}
+
 /**
 * Builds an attribute list from string containing attributes.
 *
@@ -858,6 +947,109 @@ function wp_kses_hair($attr, $allowed_protocols) {
 	return $attrarr;
 }

+/**
+ * Finds all attributes of an HTML element.
+ *
+ * Does not modify input.  May return "evil" output.
+ *
+ * Based on wp_kses_split2() and wp_kses_attr()
+ *
+ * @since 4.2.3
+ *
+ * @param string $element HTML element/tag
+ * @return array|bool List of attributes found in $element. Returns false on failure.
+ */
+function wp_kses_attr_parse( $element ) {
+	$valid = preg_match('%^(<\s*)(/\s*)?([a-zA-Z0-9]+\s*)([^>]*)(>?)$%', $element, $matches);
+	if ( 1 !== $valid ) {
+		return false;
+	}
+
+	$begin =  $matches[1];
+	$slash =  $matches[2];
+	$elname = $matches[3];
+	$attr =   $matches[4];
+	$end =    $matches[5];
+
+	if ( '' !== $slash ) {
+		// Closing elements do not get parsed.
+		return false;
+	}
+
+	// Is there a closing XHTML slash at the end of the attributes?
+	if ( 1 === preg_match( '%\s*/\s*$%', $attr, $matches ) ) {
+		$xhtml_slash = $matches[0];
+		$attr = substr( $attr, 0, -strlen( $xhtml_slash ) );
+	} else {
+		$xhtml_slash = '';
+	}
+	
+	// Split it
+	$attrarr = wp_kses_hair_parse( $attr );
+	if ( false === $attrarr ) {
+		return false;
+	}
+
+	// Make sure all input is returned by adding front and back matter.
+	array_unshift( $attrarr, $begin . $slash . $elname );
+	array_push( $attrarr, $xhtml_slash . $end );
+	
+	return $attrarr;
+}
+
+/**
+ * Builds an attribute list from string containing attributes.
+ *
+ * Does not modify input.  May return "evil" output.
+ * In case of unexpected input, returns false instead of stripping things.
+ *
+ * Based on wp_kses_hair() but does not return a multi-dimensional array.
+ *
+ * @since 4.2.3
+ *
+ * @param string $attr Attribute list from HTML element to closing HTML element tag
+ * @return array|bool List of attributes found in $attr. Returns false on failure.
+ */
+function wp_kses_hair_parse( $attr ) {
+	if ( '' === $attr ) {
+		return array();
+	}
+
+	$regex =
+	  '(?:'
+	.     '[-a-zA-Z:]+'   // Attribute name.
+	. '|'
+	.     '\[\[?[^\[\]]+\]\]?' // Shortcode in the name position implies unfiltered_html.
+	. ')'
+	. '(?:'               // Attribute value.
+	.     '\s*=\s*'       // All values begin with '='
+	.     '(?:'
+	.         '"[^"]*"'   // Double-quoted
+	.     '|'
+	.         "'[^']*'"   // Single-quoted
+	.     '|'
+	.         '[^\s"\']+' // Non-quoted
+	.         '(?:\s|$)'  // Must have a space
+	.     ')'
+	. '|'
+	.     '(?:\s|$)'      // If attribute has no value, space is required.
+	. ')'
+	. '\s*';              // Trailing space is optional except as mentioned above.
+
+	// Although it is possible to reduce this procedure to a single regexp,
+	// we must run that regexp twice to get exactly the expected result.
+
+	$validation = "%^($regex)+$%";
+	$extraction = "%$regex%";
+
+	if ( 1 === preg_match( $validation, $attr ) ) {
+		preg_match_all( $extraction, $attr, $attrarr );
+		return $attrarr[0];
+	} else {
+		return false;
+	}
+}
+
 /**
 * Performs different checks for attribute values.
 *
--- a/wp-includes/media.php
+++ b/wp-includes/media.php
@@ -634,6 +634,8 @@ function img_caption_shortcode($attr, $content = null) {
 			$content = $matches[1];
 			$attr['caption'] = trim( $matches[2] );
 		}
+	} elseif ( strpos( $attr['caption'], '<' ) !== false ) {
+		$attr['caption'] = wp_kses( $attr['caption'], 'post' );
 	}

 	// Allow plugins/themes to override the default caption template.
@@ -1637,7 +1639,7 @@ function wp_plupload_default_settings() {
 	$max_upload_size = wp_max_upload_size();

 	$defaults = array(
-		'runtimes'            => 'html5,silverlight,flash,html4',
+		'runtimes'            => 'html5,silverlight,html4',
 		'file_data_name'      => 'async-upload', // key passed to $_FILE.
 		'multiple_queues'     => true,
 		'max_file_size'       => $max_upload_size . 'b',
--- a/wp-includes/ms-functions.php
+++ b/wp-includes/ms-functions.php
@@ -715,7 +715,7 @@ function wpmu_validate_blog_signup( $blogname, $blog_title, $user = '' ) {
 function wpmu_signup_blog( $domain, $path, $title, $user, $user_email, $meta = array() )  {
 	global $wpdb;

-	$key = substr( md5( time() . rand() . $domain ), 0, 16 );
+	$key = substr( md5( time() . wp_rand() . $domain ), 0, 16 );
 	$meta = serialize($meta);

 	$wpdb->insert( $wpdb->signups, array(
@@ -751,7 +751,7 @@ function wpmu_signup_user( $user, $user_email, $meta = array() ) {
 	// Format data
 	$user = preg_replace( '/\s+/', '', sanitize_user( $user, true ) );
 	$user_email = sanitize_email( $user_email );
-	$key = substr( md5( time() . rand() . $user_email ), 0, 16 );
+	$key = substr( md5( time() . wp_rand() . $user_email ), 0, 16 );
 	$meta = serialize($meta);

 	$wpdb->insert( $wpdb->signups, array(
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -755,10 +755,14 @@ function auth_redirect() {
 		}
 	}

-	if ( is_user_admin() )
-		$scheme = 'logged_in';
-	else
-		$scheme = apply_filters( 'auth_redirect_scheme', '' );
+	/**
+	 * Filters the authentication redirect scheme.
+	 *
+	 * @since 2.9.0
+	 *
+	 * @param string $scheme Authentication redirect scheme. Default empty.
+	 */
+	$scheme = apply_filters( 'auth_redirect_scheme', '' );

 	if ( $user_id = wp_validate_auth_cookie( '',  $scheme) ) {
 		do_action('auth_redirect', $user_id);
@@ -965,7 +969,7 @@ if ( !function_exists('wp_validate_redirect') ) :
 * @return string redirect-sanitized URL
 **/
 function wp_validate_redirect($location, $default = '') {
-	$location = trim( $location );
+	$location = trim( $location, " \t\n\r\0\x08\x0B" );
 	// browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
 	if ( substr($location, 0, 2) == '//' )
 		$location = 'http:' . $location;
@@ -973,7 +977,8 @@ function wp_validate_redirect($location, $default = '') {
 	// In php 5 parse_url may fail if the URL query part contains http://, bug #38143
 	$test = ( $cut = strpos($location, '?') ) ? substr( $location, 0, $cut ) : $location;

-	$lp  = parse_url($test);
+	// @-operator is used to prevent possible warnings in PHP < 5.3.3.
+	$lp = @parse_url($test);

 	// Give up if malformed URL
 	if ( false === $lp )
@@ -983,9 +988,17 @@ function wp_validate_redirect($location, $default = '') {
 	if ( isset($lp['scheme']) && !('http' == $lp['scheme'] || 'https' == $lp['scheme']) )
 		return $default;

-	// Reject if scheme is set but host is not. This catches urls like https:host.com for which parse_url does not set the host field.
-	if ( isset($lp['scheme'])  && !isset($lp['host']) )
+	// Reject if certain components are set but host is not. This catches urls like https:host.com for which parse_url does not set the host field.
+	if ( ! isset( $lp['host'] ) && ( isset( $lp['scheme'] ) || isset( $lp['user'] ) || isset( $lp['pass'] ) || isset( $lp['port'] ) ) ) {
 		return $default;
+	}
+
+	// Reject malformed components parse_url() can return on odd inputs.
+	foreach ( array( 'user', 'pass', 'host' ) as $component ) {
+		if ( isset( $lp[ $component ] ) && strpbrk( $lp[ $component ], ':/?#@' ) ) {
+			return $default;
+		}
+	}

 	$wpp = parse_url(home_url());

--- a/wp-includes/post-template.php
+++ b/wp-includes/post-template.php
@@ -1204,7 +1204,7 @@ function wp_get_attachment_link( $id = 0, $size = 'thumbnail', $permalink = fals
 	if ( trim( $link_text ) == '' )
 		$link_text = $_post->post_title;

-	return apply_filters( 'wp_get_attachment_link', "<a href='$url'>$link_text</a>", $id, $size, $permalink, $icon, $text );
+	return apply_filters( 'wp_get_attachment_link', "<a href='" . esc_url( $url ) . "'>$link_text</a>", $id, $size, $permalink, $icon, $text );
 }

 /**
--- a/wp-includes/post.php
+++ b/wp-includes/post.php
@@ -2534,10 +2534,11 @@ function wp_untrash_post_comments($post = null) {

 	foreach ( $group_by_status as $status => $comments ) {
 		// Sanity check. This shouldn't happen.
-		if ( 'post-trashed' == $status )
+		if ( 'post-trashed' == $status ) {
 			$status = '0';
-		$comments_in = implode( "', '", $comments );
-		$wpdb->query( "UPDATE $wpdb->comments SET comment_approved = '$status' WHERE comment_ID IN ('" . $comments_in . "')" );
+		}
+		$comments_in = implode( ', ', array_map( 'intval', $comments ) );
+		$wpdb->query( $wpdb->prepare( "UPDATE $wpdb->comments SET comment_approved = %s WHERE comment_ID IN ($comments_in)", $status ) );
 	}

 	clean_comment_cache( array_keys($statuses) );
--- a/wp-includes/query.php
+++ b/wp-includes/query.php
@@ -2675,14 +2675,15 @@ class WP_Query {

 		if ( 'any' == $post_type ) {
 			$in_search_post_types = get_post_types( array('exclude_from_search' => false) );
-			if ( empty( $in_search_post_types ) )
+			if ( empty( $in_search_post_types ) ) {
 				$where .= ' AND 1=0 ';
-			else
-				$where .= " AND $wpdb->posts.post_type IN ('" . join("', '", $in_search_post_types ) . "')";
+			} else {
+				$where .= " AND {$wpdb->posts}.post_type IN ('" . join( "', '", array_map( 'esc_sql', $in_search_post_types ) ) . "')";
+			}
 		} elseif ( !empty( $post_type ) && is_array( $post_type ) ) {
-			$where .= " AND $wpdb->posts.post_type IN ('" . join("', '", $post_type) . "')";
+			$where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", esc_sql( $post_type ) ) . "')";
 		} elseif ( ! empty( $post_type ) ) {
-			$where .= " AND $wpdb->posts.post_type = '$post_type'";
+			$where .= $wpdb->prepare( " AND {$wpdb->posts}.post_type = %s", $post_type );
 			$post_type_object = get_post_type_object ( $post_type );
 		} elseif ( $this->is_attachment ) {
 			$where .= " AND $wpdb->posts.post_type = 'attachment'";
--- a/wp-includes/script-loader.php
+++ b/wp-includes/script-loader.php
@@ -244,12 +244,15 @@ function wp_default_scripts( &$scripts ) {

 	$scripts->add( 'plupload', '/wp-includes/js/plupload/plupload.js', array(), '1.5.7' );
 	$scripts->add( 'plupload-html5', '/wp-includes/js/plupload/plupload.html5.js', array('plupload'), '1.5.7' );
-	$scripts->add( 'plupload-flash', '/wp-includes/js/plupload/plupload.flash.js', array('plupload'), '1.5.7' );
+
+	// Not used, kept for dependency back-compat.
+	$scripts->add( 'plupload-flash', false, array(), '1.5.7' );
+
 	$scripts->add( 'plupload-silverlight', '/wp-includes/js/plupload/plupload.silverlight.js', array('plupload'), '1.5.7' );
 	$scripts->add( 'plupload-html4', '/wp-includes/js/plupload/plupload.html4.js', array('plupload'), '1.5.7' );

 	// cannot use the plupload.full.js, as it loads browserplus init JS from Yahoo
-	$scripts->add( 'plupload-all', false, array('plupload', 'plupload-html5', 'plupload-flash', 'plupload-silverlight', 'plupload-html4'), '1.5.7' );
+	$scripts->add( 'plupload-all', false, array('plupload', 'plupload-html5', 'plupload-silverlight', 'plupload-html4'), '1.5.7' );

 	$scripts->add( 'plupload-handlers', "/wp-includes/js/plupload/handlers$suffix.js", array('plupload-all', 'jquery') );
 	did_action( 'init' ) && $scripts->localize( 'plupload-handlers', 'pluploadL10n', $uploader_l10n );
--- a/wp-includes/shortcodes.php
+++ b/wp-includes/shortcodes.php
@@ -176,16 +176,37 @@ function has_shortcode( $content, $tag ) {
 * @uses get_shortcode_regex() Gets the search pattern for searching shortcodes.
 *
 * @param string $content Content to search for shortcodes
+ * @param bool $ignore_html When true, shortcodes inside HTML elements will be skipped.
 * @return string Content with shortcodes filtered out.
 */
-function do_shortcode($content) {
+function do_shortcode( $content, $ignore_html = false ) {
 	global $shortcode_tags;

+	if ( false === strpos( $content, '[' ) ) {
+		return $content;
+	}
+
 	if (empty($shortcode_tags) || !is_array($shortcode_tags))
 		return $content;

+	$tagnames = array_keys($shortcode_tags);
+	$tagregexp = join( '|', array_map('preg_quote', $tagnames) );
+	$pattern = "/\\[($tagregexp)/s";
+
+	if ( 1 !== preg_match( $pattern, $content ) ) {
+		// Avoids parsing HTML when there are no shortcodes or embeds anyway.
+		return $content;
+	}
+
+	$content = do_shortcodes_in_html_tags( $content, $ignore_html );
+
 	$pattern = get_shortcode_regex();
-	return preg_replace_callback( "/$pattern/s", 'do_shortcode_tag', $content );
+	$content = preg_replace_callback( "/$pattern/s", 'do_shortcode_tag', $content );
+	
+	// Always restore square braces so we don't break things like <!--[if IE ]>
+	$content = unescape_invalid_shortcodes( $content );
+	
+	return $content;
 }

 /**
@@ -277,6 +298,127 @@ function do_shortcode_tag( $m ) {
 	}
 }

+/**
+ * Search only inside HTML elements for shortcodes and process them.
+ *
+ * Any [ or ] characters remaining inside elements will be HTML encoded
+ * to prevent interference with shortcodes that are outside the elements.
+ * Assumes $content processed by KSES already.  Users with unfiltered_html
+ * capability may get unexpected output if angle braces are nested in tags.
+ *
+ * @since 4.2.3
+ *
+ * @param string $content Content to search for shortcodes
+ * @param bool $ignore_html When true, all square braces inside elements will be encoded.
+ * @return string Content with shortcodes filtered out.
+ */
+function do_shortcodes_in_html_tags( $content, $ignore_html ) {
+	// Normalize entities in unfiltered HTML before adding placeholders.
+	$trans = array( '&#91;' => '&#091;', '&#93;' => '&#093;' );
+	$content = strtr( $content, $trans );
+	$trans = array( '[' => '&#91;', ']' => '&#93;' );
+	
+	$pattern = get_shortcode_regex();
+	$textarr = wp_html_split( $content );
+
+	foreach ( $textarr as &$element ) {
+		if ( '' == $element || '<' !== $element[0] ) {
+			continue;
+		}
+
+		$noopen = false === strpos( $element, '[' );
+		$noclose = false === strpos( $element, ']' );
+		if ( $noopen || $noclose ) {
+			// This element does not contain shortcodes.
+			if ( $noopen xor $noclose ) {
+				// Need to encode stray [ or ] chars.
+				$element = strtr( $element, $trans );
+			}
+			continue;
+		}
+
+		if ( $ignore_html || '<!--' === substr( $element, 0, 4 ) || '<![CDATA[' === substr( $element, 0, 9 ) ) {
+			// Encode all [ and ] chars.
+			$element = strtr( $element, $trans );
+			continue;
+		}
+
+		$attributes = wp_kses_attr_parse( $element );
+		if ( false === $attributes ) {
+			// Some plugins are doing things like [name] <[email]>.
+			if ( 1 === preg_match( '%^<\s*\[\[?[^\[\]]+\]%', $element ) ) {
+				$element = preg_replace_callback( "/$pattern/s", 'do_shortcode_tag', $element );
+			}
+
+			// Looks like we found some crazy unfiltered HTML.  Skipping it for sanity.
+			$element = strtr( $element, $trans );
+			continue;
+		}
+		
+		// Get element name
+		$front = array_shift( $attributes );
+		$back = array_pop( $attributes );
+		$matches = array();
+		preg_match('%[a-zA-Z0-9]+%', $front, $matches);
+		$elname = $matches[0];
+		
+		// Look for shortcodes in each attribute separately.
+		foreach ( $attributes as &$attr ) {
+			$open = strpos( $attr, '[' );
+			$close = strpos( $attr, ']' );
+			if ( false === $open || false === $close ) {
+				continue; // Go to next attribute.  Square braces will be escaped at end of loop.
+			}
+			$double = strpos( $attr, '"' );
+			$single = strpos( $attr, "'" );
+			if ( ( false === $single || $open < $single ) && ( false === $double || $open < $double ) ) {
+				// $attr like '[shortcode]' or 'name = [shortcode]' implies unfiltered_html.
+				// In this specific situation we assume KSES did not run because the input
+				// was written by an administrator, so we should avoid changing the output
+				// and we do not need to run KSES here.
+				$attr = preg_replace_callback( "/$pattern/s", 'do_shortcode_tag', $attr );
+			} else {
+				// $attr like 'name = "[shortcode]"' or "name = '[shortcode]'"
+				// We do not know if $content was unfiltered. Assume KSES ran before shortcodes.
+				$count = 0;
+				$new_attr = preg_replace_callback( "/$pattern/s", 'do_shortcode_tag', $attr, -1, $count );
+				if ( $count > 0 ) {
+					// Sanitize the shortcode output using KSES.
+					$new_attr = wp_kses_one_attr( $new_attr, $elname );
+					if ( '' !== $new_attr ) {
+						// The shortcode is safe to use now.
+						$attr = $new_attr;
+					}
+				}
+			}
+		}
+		$element = $front . implode( '', $attributes ) . $back;
+		
+		// Now encode any remaining [ or ] chars.
+		$element = strtr( $element, $trans );
+	}
+	
+	$content = implode( '', $textarr );
+	
+	return $content;
+}
+
+/**
+ * Remove placeholders added by do_shortcodes_in_html_tags().
+ *
+ * @since 4.2.3
+ *
+ * @param string $content Content to search for placeholders.
+ * @return string Content with placeholders removed.
+ */
+function unescape_invalid_shortcodes( $content ) {
+        // Clean up entire string, avoids re-parsing HTML.
+        $trans = array( '&#91;' => '[', '&#93;' => ']' );
+        $content = strtr( $content, $trans );
+        
+        return $content;
+}
+
 /**
 * Retrieve all attributes from the shortcodes tag.
 *
@@ -306,6 +448,15 @@ function shortcode_parse_atts($text) {
 			elseif (isset($m[8]))
 				$atts[] = stripcslashes($m[8]);
 		}
+
+		// Reject any unclosed HTML elements
+		foreach( $atts as &$value ) {
+			if ( false !== strpos( $value, '<' ) ) {
+				if ( 1 !== preg_match( '/^[^<]*+(?:<[^>]*+>[^<]*+)*+$/', $value ) ) {
+					$value = '';
+				}
+			}
+		}
 	} else {
 		$atts = ltrim($text);
 	}
@@ -371,9 +522,15 @@ function strip_shortcodes( $content ) {
 	if (empty($shortcode_tags) || !is_array($shortcode_tags))
 		return $content;

-	$pattern = get_shortcode_regex();
+	$content = do_shortcodes_in_html_tags( $content, true );

-	return preg_replace_callback( "/$pattern/s", 'strip_shortcode_tag', $content );
+	$pattern = get_shortcode_regex();
+	$content = preg_replace_callback( "/$pattern/s", 'strip_shortcode_tag', $content );
+
+	// Always restore square braces so we don't break things like <!--[if IE ]>
+	$content = unescape_invalid_shortcodes( $content );
+	
+	return $content;
 }

 function strip_shortcode_tag( $m ) {
--- a/wp-includes/taxonomy.php
+++ b/wp-includes/taxonomy.php
@@ -589,7 +589,7 @@ function get_objects_in_term( $term_ids, $taxonomies, $args = array() ) {

 	$term_ids = array_map('intval', $term_ids );

-	$taxonomies = "'" . implode( "', '", $taxonomies ) . "'";
+	$taxonomies = "'" . implode( "', '", array_map( 'esc_sql', $taxonomies ) ) . "'";
 	$term_ids = "'" . implode( "', '", $term_ids ) . "'";

 	$object_ids = $wpdb->get_col("SELECT tr.object_id FROM $wpdb->term_relationships AS tr INNER JOIN $wpdb->term_taxonomy AS tt ON tr.term_taxonomy_id = tt.term_taxonomy_id WHERE tt.taxonomy IN ($taxonomies) AND tt.term_id IN ($term_ids) ORDER BY tr.object_id $order");
@@ -1348,7 +1348,7 @@ function get_terms($taxonomies, $args = '') {
 	if ( '' !== $order && !in_array( $order, array( 'ASC', 'DESC' ) ) )
 		$order = 'ASC';

-	$where = "tt.taxonomy IN ('" . implode("', '", $taxonomies) . "')";
+	$where = "tt.taxonomy IN ('" . implode("', '", array_map( 'esc_sql', $taxonomies ) ) . "')";
 	$inclusions = '';
 	if ( ! empty( $include ) ) {
 		$exclude = '';
@@ -2027,7 +2027,7 @@ function wp_get_object_terms($object_ids, $taxonomies, $args = array()) {
 	if ( '' !== $order && ! in_array( $order, array( 'ASC', 'DESC' ) ) )
 		$order = 'ASC';

-	$taxonomies = "'" . implode("', '", $taxonomies) . "'";
+	$taxonomies = "'" . implode("', '", array_map( 'esc_sql', $taxonomies ) ) . "'";
 	$object_ids = implode(', ', $object_ids);

 	$select_this = '';
--- a/wp-includes/theme.php
+++ b/wp-includes/theme.php
@@ -665,8 +665,6 @@ function preview_theme() {

 	// Prevent theme mods to current theme being used on theme being previewed
 	add_filter( 'pre_option_theme_mods_' . get_option( 'stylesheet' ), '__return_empty_array' );
-
-	ob_start( 'preview_theme_ob_filter' );
 }
 add_action('setup_theme', 'preview_theme');

@@ -704,7 +702,7 @@ function _preview_theme_stylesheet_filter() {
 * @return string
 */
 function preview_theme_ob_filter( $content ) {
-	return preg_replace_callback( "|(<a.*?href=([\"']))(.*?)([\"'].*?>)|", 'preview_theme_ob_filter_callback', $content );
+	return $content;
 }

 /**
@@ -719,26 +717,7 @@ function preview_theme_ob_filter( $content ) {
 * @return string
 */
 function preview_theme_ob_filter_callback( $matches ) {
-	if ( strpos($matches[4], 'onclick') !== false )
-		$matches[4] = preg_replace('#onclick=([\'"]).*?(?<!\\\)\\1#i', '', $matches[4]); //Strip out any onclicks from rest of <a>. (?<!\\\) means to ignore the '" if it's escaped by \  to prevent breaking mid-attribute.
-	if (
-		( false !== strpos($matches[3], '/wp-admin/') )
-	||
-		( false !== strpos( $matches[3], '://' ) && 0 !== strpos( $matches[3], home_url() ) )
-	||
-		( false !== strpos($matches[3], '/feed/') )
-	||
-		( false !== strpos($matches[3], '/trackback/') )
-	)
-		return $matches[1] . "#$matches[2] onclick=$matches[2]return false;" . $matches[4];
-
-	$stylesheet = isset( $_GET['stylesheet'] ) ? $_GET['stylesheet'] : '';
-	$template   = isset( $_GET['template'] )   ? $_GET['template']   : '';
-
-	$link = add_query_arg( array( 'preview' => 1, 'template' => $template, 'stylesheet' => $stylesheet, 'preview_iframe' => 1 ), $matches[3] );
-	if ( 0 === strpos($link, 'preview=1') )
-		$link = "?$link";
-	return $matches[1] . esc_attr( $link ) . $matches[4];
+	return $matches[0];
 }

 /**
--- a/wp-includes/update.php
+++ b/wp-includes/update.php
@@ -154,7 +154,20 @@ function wp_version_check( $extra_stats = array(), $force_check = false ) {
 	if ( isset( $body['translations'] ) )
 		$updates->translations = $body['translations'];

-	set_site_transient( 'update_core',  $updates);
+	set_site_transient( 'update_core', $updates );
+
+	if ( ! empty( $body['ttl'] ) ) {
+		$ttl = (int) $body['ttl'];
+		if ( $ttl && ( time() + $ttl < wp_next_scheduled( 'wp_version_check' ) ) ) {
+			// Queue an event to re-run the update check in $ttl seconds.
+			wp_schedule_single_event( time() + $ttl, 'wp_version_check' );
+		}
+	}
+
+	// Trigger background updates if running non-interactively, and we weren't called from the update handler.
+	if ( defined( 'DOING_CRON' ) && DOING_CRON && 'wp_maybe_auto_update' != current_filter() ) {
+		do_action( 'wp_maybe_auto_update' );
+	}
 }

 /**
@@ -205,7 +218,11 @@ function wp_update_plugins( $extra_stats = array() ) {
 			$timeout = HOUR_IN_SECONDS;
 			break;
 		default :
-			$timeout = 12 * HOUR_IN_SECONDS;
+			if ( defined( 'DOING_CRON' ) && DOING_CRON ) {
+				$timeout = 0;
+			} else {
+				$timeout = 12 * HOUR_IN_SECONDS;
+			}
 	}

 	$time_not_changed = isset( $current->last_checked ) && $timeout > ( time() - $current->last_checked );
@@ -352,7 +369,11 @@ function wp_update_themes( $extra_stats = array() ) {
 			$timeout = HOUR_IN_SECONDS;
 			break;
 		default :
-			$timeout = 12 * HOUR_IN_SECONDS;
+			if ( defined( 'DOING_CRON' ) && DOING_CRON ) {
+				$timeout = 0;
+			} else {
+				$timeout = 12 * HOUR_IN_SECONDS;
+			}
 	}

 	$time_not_changed = isset( $last_update->last_checked ) && $timeout > ( time() - $last_update->last_checked );
@@ -593,19 +614,8 @@ function wp_schedule_update_checks() {
 	if ( !wp_next_scheduled('wp_update_themes') && !defined('WP_INSTALLING') )
 		wp_schedule_event(time(), 'twicedaily', 'wp_update_themes');

-	if ( ! wp_next_scheduled( 'wp_maybe_auto_update' ) && ! defined( 'WP_INSTALLING' ) ) {
-		// Schedule auto updates for 7 a.m. and 7 p.m. in the timezone of the site.
-		$next = strtotime( 'today 7am' );
-		$now = time();
-		// Find the next instance of 7 a.m. or 7 p.m., but skip it if it is within 3 hours from now.
-		while ( ( $now + 3 * HOUR_IN_SECONDS ) > $next ) {
-			$next += 12 * HOUR_IN_SECONDS;
-		}
-		$next = $next - get_option( 'gmt_offset' ) * HOUR_IN_SECONDS;
-		// Add a random number of minutes, so we don't have all sites trying to update exactly on the hour
-		$next = $next + rand( 0, 59 ) * MINUTE_IN_SECONDS;
-		wp_schedule_event( $next, 'twicedaily', 'wp_maybe_auto_update' );
-	}
+	if ( ( wp_next_scheduled( 'wp_maybe_auto_update' ) > ( time() + HOUR_IN_SECONDS ) ) && ! defined('WP_INSTALLING') )
+		wp_clear_scheduled_hook( 'wp_maybe_auto_update' );
 }

 if ( ( ! is_main_site() && ! is_network_admin() ) || ( defined( 'DOING_AJAX' ) && DOING_AJAX ) )
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
 *
 * @global string $wp_version
 */
-$wp_version = '3.8.8';
+$wp_version = '3.8.19';

 /**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
--- a/wp-includes/wp-db.php
+++ b/wp-includes/wp-db.php
@@ -2408,7 +2408,7 @@ class wpdb {
 				. '|REPLACE(?:\s+LOW_PRIORITY|\s+DELAYED)?(?:\s+INTO)?'
 				. '|UPDATE(?:\s+LOW_PRIORITY)?(?:\s+IGNORE)?'
 				. '|DELETE(?:\s+LOW_PRIORITY|\s+QUICK|\s+IGNORE)*(?:\s+FROM)?'
-				. ')\s+((?:[0-9a-zA-Z$_.`]|[\xC2-\xDF][\x80-\xBF])+)/is', $query, $maybe ) ) {
+				. ')\s+((?:[0-9a-zA-Z$_.`-]|[\xC2-\xDF][\x80-\xBF])+)/is', $query, $maybe ) ) {
 			return str_replace( '`', '', $maybe[1] );
 		}

@@ -2416,7 +2416,7 @@ class wpdb {
 		if ( preg_match( '/^\s*(?:'
 				. 'SHOW\s+TABLE\s+STATUS.+(?:LIKE\s+|WHERE\s+Name\s*=\s*)'
 				. '|SHOW\s+(?:FULL\s+)?TABLES.+(?:LIKE\s+|WHERE\s+Name\s*=\s*)'
-				. ')\W((?:[0-9a-zA-Z$_.`]|[\xC2-\xDF][\x80-\xBF])+)\W/is', $query, $maybe ) ) {
+				. ')\W((?:[0-9a-zA-Z$_.`-]|[\xC2-\xDF][\x80-\xBF])+)\W/is', $query, $maybe ) ) {
 			return str_replace( '`', '', $maybe[1] );
 		}

@@ -2435,7 +2435,7 @@ class wpdb {
 				. '|LOAD\s+DATA.*INFILE.*INTO\s+TABLE'
 				. '|(?:GRANT|REVOKE).*ON\s+TABLE'
 				. '|SHOW\s+(?:.*FROM|.*TABLE)'
-				. ')\s+\(*\s*((?:[0-9a-zA-Z$_.`]|[\xC2-\xDF][\x80-\xBF])+)\s*\)*/is', $query, $maybe ) ) {
+				. ')\s+\(*\s*((?:[0-9a-zA-Z$_.`-]|[\xC2-\xDF][\x80-\xBF])+)\s*\)*/is', $query, $maybe ) ) {
 			return str_replace( '`', '', $maybe[1] );
 		}

--- a/wp-mail.php
+++ b/wp-mail.php
@@ -14,6 +14,12 @@ require(dirname(__FILE__) . '/wp-load.php');
 if ( ! apply_filters( 'enable_post_by_email_configuration', true ) )
 	wp_die( __( 'This action has been disabled by the administrator.' ) );

+$mailserver_url = get_option( 'mailserver_url' );
+
+if ( 'mail.example.com' === $mailserver_url || empty( $mailserver_url ) ) {
+	wp_die( __( 'This action has been disabled by the administrator.' ), 403 );
+}
+
 /**
 * Fires to allow a plugin to do a complete takeover of Post by Email.
 *
Author	SHA1	Message	Date
Sergey Biryukov	fa841b90b6	Tag 3.8.19 Built from https://develop.svn.wordpress.org/tags/3.8.19@40222 git-svn-id: http://core.svn.wordpress.org/tags/3.8.19@40161 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-03-06 18:17:07 +00:00
James Nylen	36d019a209	Bump 3.8 branch to version 3.8.19. Built from https://develop.svn.wordpress.org/branches/3.8@40211 git-svn-id: http://core.svn.wordpress.org/branches/3.8@40150 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-03-06 16:47:12 +00:00
Aaron Campbell	44f0839610	Strip control characters before validating redirect. Merges [40183] to 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@40193 git-svn-id: http://core.svn.wordpress.org/branches/3.8@40132 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-03-06 13:46:12 +00:00
Aaron Campbell	86030b9a10	Plugins: Add file check to plugin deletions. Merges [40169] to 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@40179 git-svn-id: http://core.svn.wordpress.org/branches/3.8@40118 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-03-06 13:05:26 +00:00
Jeremy Felt	d3dda7134b	Validate video and audio metadata. Merge of [40148] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@40158 git-svn-id: http://core.svn.wordpress.org/branches/3.8@40097 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-03-06 08:13:13 +00:00
Aaron Campbell	095894746a	Bump 3.8 branch to version 3.8.18. Built from https://develop.svn.wordpress.org/branches/3.8@40005 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39942 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-26 18:30:15 +00:00
John Blackbourn	a4a900c2d5	Posts, Post Types: When using Excerpt mode on the Posts list table, ensure the excerpt output matches what was manually entered into the Excerpt field. Merges [39956] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@39988 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39925 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-26 14:22:12 +00:00
Dominik Schilling	163e5d1759	Press This: Do not show Categories & Tags UI for users who cannot assign terms to posts anyways. Merge of [39968] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@39981 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39918 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-26 14:16:12 +00:00
Dominik Schilling	f3a21e789a	Query: Ensure that queries work correctly with post type names with special characters. Merge of [39952] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@39965 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39902 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-26 13:53:13 +00:00
Aaron Campbell	33ff9ebd58	Bump 3.8 branch to version 3.8.17. Built from https://develop.svn.wordpress.org/branches/3.8@39869 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39806 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-11 17:00:14 +00:00
Joe McGill	58094a53d4	Media: Fix exif_imagetype check in wp_get_image_mime This is a follow up to [39831]. Merges [39850] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@39860 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39797 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-11 16:46:13 +00:00
Joe McGill	3aaa559785	Media: Improve image filetype checking. This adds a new function `wp_get_image_mime()` which is used by `wp_check_filetype_and_ext()` to validate image files using `exif_imagetype()` if available instead of `getimagesize()`. `getimagesize()` is less performant than `exif_imagetype()` and is dependent on GD. If `exif_imagetype()` is not available, it falls back to `getimagesize()` as before. If `wp_check_filetype_and_ext()` can't validate the filetype, we now return `false` for ext/MIME values. Merges [39831] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@39841 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39779 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-11 13:20:26 +00:00
Dominik Schilling	629289cdfc	Updates: Translate plugin data on the Updates screen. Merge of [39808] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@39829 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39767 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-11 11:43:34 +00:00
Dominik Schilling	da5862aba9	Themes: Fix markup for theme name fallbacks. Merge of [39807] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@39818 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39756 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-11 11:13:05 +00:00
Jeremy Felt	bc842883f9	Multisite: Use `wp_rand()` in signup key creation. Merges [39795] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@39805 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39743 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-11 05:36:43 +00:00
Dion Hulse	d970573179	Update PHPMailer to 5.2.22. The full list of changes is available here: https://github.com/PHPMailer/PHPMailer/compare/v5.2.21...v5.2.22 Merges [39759] to the 3.8 branch. Fixes #37210 for 3.8. Built from https://develop.svn.wordpress.org/branches/3.8@39793 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39731 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-11 05:27:12 +00:00
Jeremy Felt	9c787c79bc	Mail: Disable wp-mail.php when `mailserver_url` is mail.example.com. Merges [39772] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@39782 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39720 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-11 05:21:26 +00:00
Aaron Campbell	a14953582a	Add nonce for widget accessibility mode. Props vortfu. See #23328. Merges [39765] to 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@39770 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39708 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-11 01:52:27 +00:00
Dion Hulse	6c336f5205	Mail: Upgrade PHPMailer to 5.2.21. Merges [39645], [36083], [33142], [33124], [29783], [27385] to the 3.8 branch. See #37210. Built from https://develop.svn.wordpress.org/branches/3.8@39730 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39670 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-06 22:07:06 +00:00
Joe McGill	782e3451c1	Media: Improved media titles when created from filename. Preserves spaces and generally creates more accurate, cleaner titles from filenames of uploaded media. Merge of [38615] to the 3.8 branch. Fixes #37989. Built from https://develop.svn.wordpress.org/branches/3.8@39718 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39658 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-06 22:02:09 +00:00
Dion Hulse	4ecc963755	General: Update copyright year to 2017 in license.txt. Props Nikschavan. Merges [39659] to the 3.8 branch. Fixes #39433. Built from https://develop.svn.wordpress.org/branches/3.8@39706 git-svn-id: http://core.svn.wordpress.org/branches/3.8@39646 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-01-06 21:55:39 +00:00
Jeremy Felt	86c36d0e72	Bump 3.8 branch to 3.8.16. Built from https://develop.svn.wordpress.org/branches/3.8@38557 git-svn-id: http://core.svn.wordpress.org/branches/3.8@38500 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-09-07 15:02:28 +00:00
Jeremy Felt	f229de6fb2	Media: Sanitize upload filename. Merge of [38538] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@38547 git-svn-id: http://core.svn.wordpress.org/branches/3.8@38490 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-09-07 14:00:44 +00:00
Pascal Birchler	b42c9261b6	Upgrade/Install: Sanitize file name in `File_Upload_Upgrader`. Merge of [38524] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@38533 git-svn-id: http://core.svn.wordpress.org/branches/3.8@38474 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-09-06 18:04:12 +00:00
Boone Gorges	06c510f23b	Bump 3.8 branch to 3.8.15. Built from https://develop.svn.wordpress.org/branches/3.8@37835 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37800 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-06-21 16:49:09 +00:00
Joe McGill	f65775fd46	Media: Improve handling of extensionless filenames. Merge of [37756] to the 3.8 branch. See #37111. Built from https://develop.svn.wordpress.org/branches/3.8@37824 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37789 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-06-21 15:00:19 +00:00
Nikolay Bachiyski	d0ad7b828e	Admin: escape URL-encoded permalinks Merge of [37801] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@37821 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37786 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-06-21 14:59:10 +00:00
Rachel Baker	3b59453453	Revisions: Change the capability needed to view revision diffs to `edit_post`. Merge of [37779] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@37805 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37770 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-06-21 14:49:36 +00:00
Nikolay Bachiyski	dea46f4d1c	Admin: Escape attachment name in case it contains special characters Merge of [37774] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@37794 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37759 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-06-21 14:29:11 +00:00
Boone Gorges	7f00fb5298	Taxonomy: More specific cap check when processing category data on post save. Ports [37691] to the 3.8 branch. Props dlh. Fixes #36379. Built from https://develop.svn.wordpress.org/branches/3.8@37787 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37752 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-06-21 14:25:33 +00:00
Dominik Schilling	40ad99fab7	Customize: Make sure that preview and return URLs are URLs. Merge of [37527] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@37778 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37743 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-06-21 14:21:59 +00:00
Jeremy Felt	bea4197fb1	Admin: Allow for the consistent filtering of `auth_redirect_scheme` Merge of [37651] to the 3.8 branch. See #37047. Built from https://develop.svn.wordpress.org/branches/3.8@37765 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37730 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-06-21 14:14:01 +00:00
Dominik Schilling	00de4f6c3c	Bump 3.8 branch to 3.8.14. Built from https://develop.svn.wordpress.org/branches/3.8@37391 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37357 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-05-06 18:16:09 +00:00
Nikolay Bachiyski	c3120b8be8	External Libraries: Disable Flash backend for Plupload Built from https://develop.svn.wordpress.org/branches/3.8@37373 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37339 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-05-06 17:54:10 +00:00
Nikolay Bachiyski	27290d9a33	Taxonomies: make sure taxonomy functions work correctly with taxonomy names with special characters The codex says that taxonomy names "should only contain lowercase letters and the underscore character", but that's not enforced. It's too late to enforce it, since some plugins haven't been following it and the official phpdoc doesn't mention this restriction. Merge of [37133] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@37141 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37108 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-03-30 17:41:10 +00:00
Jeremy Felt	41e2e17277	Multisite: Improve escaping in network settings. Merge of [37124] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@37131 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37098 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-03-30 16:07:10 +00:00
Dominik Schilling	6a6a02e76e	HTTP: Improve detection of valid IP addresses. Merge of [37115] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@37122 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37089 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-03-30 15:53:10 +00:00
Dominik Schilling	6ebee04c9a	Multisite: Validate new email address confirmations. Merge of [37103] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@37110 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37077 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-03-30 14:51:24 +00:00
Nikolay Bachiyski	33c549723e	Snoopy: use escapeshellarg instead of escapeshellcmd We are escaping arguments, not commands, so we'd better use the semantically correct function, even though they are similar. Merges [37094] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@37101 git-svn-id: http://core.svn.wordpress.org/branches/3.8@37068 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-03-30 14:14:10 +00:00
Dominik Schilling	51f81f7262	Bump 3.8 branch to 3.8.13. Built from https://develop.svn.wordpress.org/branches/3.8@36461 git-svn-id: http://core.svn.wordpress.org/branches/3.8@36428 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-02-02 17:30:23 +00:00
Dominik Schilling	00190002da	Better validation of the URL used in HTTP redirects. Merges [36444] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@36453 git-svn-id: http://core.svn.wordpress.org/branches/3.8@36420 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-02-02 17:01:28 +00:00
Dominik Schilling	cd14a4ddd0	HTTP: `0.1.2.3` is not a valid IP. Merges [36435] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@36442 git-svn-id: http://core.svn.wordpress.org/branches/3.8@36409 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-02-02 13:06:11 +00:00
Dominik Schilling	d1b04bbaff	Bump 3.8 branch to 3.8.12. Built from https://develop.svn.wordpress.org/branches/3.8@36202 git-svn-id: http://core.svn.wordpress.org/branches/3.8@36169 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-01-06 18:51:23 +00:00
Aaron Jorbin	e8765983bf	Theme: Escape error messages [36185] for 3.8 branch Built from https://develop.svn.wordpress.org/branches/3.8@36192 git-svn-id: http://core.svn.wordpress.org/branches/3.8@36159 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-01-06 17:29:10 +00:00
Dion Hulse	25f17b93f4	Background Updates: Remove the 7am/7pm background update check. This changeset is a more basic version of [36180], clearing the extra now redundant schedule. As the functionality for this was introduced in 3.9, [28129] has been backported to 3.7/3.8, allowing the API TTL to be respected by those versions. See #27772. Fixes #35323. Built from https://develop.svn.wordpress.org/trunk@36184 git-svn-id: http://core.svn.wordpress.org/branches/3.8@36151 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2016-01-06 13:24:33 +00:00
Dion Hulse	e1cc3b4567	Update Akismet externals git-svn-id: http://core.svn.wordpress.org/branches/3.8@35107 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-10-13 17:19:01 +00:00
Dominik Schilling	22bac7afad	Finish bumping the 3.8 branch to 3.8.11. Built from https://develop.svn.wordpress.org/branches/3.8@34195 git-svn-id: http://core.svn.wordpress.org/branches/3.8@34162 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-09-15 14:52:44 +00:00
Helen Hou-Sandí	772523fac7	Bump 3.8 branch to 3.8.11. Built from https://develop.svn.wordpress.org/branches/3.8@34186 git-svn-id: http://core.svn.wordpress.org/branches/3.8@34154 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-09-15 14:29:57 +00:00
Dominik Schilling	16ea036050	XMLRPC: Don't allow private posts to be sticky. Merge of [33325], [33612], and [34135] to the 3.8 branch. See #20662. Built from https://develop.svn.wordpress.org/branches/3.8@34156 git-svn-id: http://core.svn.wordpress.org/branches/3.8@34124 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-09-14 23:03:09 +00:00
Nikolay Bachiyski	f062575157	Shortcodes: don't allow unclosed HTML elements in attributes Merges [34134] for 3.8 branch Built from https://develop.svn.wordpress.org/branches/3.8@34149 git-svn-id: http://core.svn.wordpress.org/branches/3.8@34117 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-09-14 22:49:39 +00:00
Nikolay Bachiyski	0c6eeb9ad1	List tables: escape user e-mails Merges [34133] for 3.8 branch Built from https://develop.svn.wordpress.org/branches/3.8@34142 git-svn-id: http://core.svn.wordpress.org/branches/3.8@34110 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-09-14 22:45:11 +00:00
Gary Pendergast	9699996c49	WPDB: `get_table_from_query()` didn't find table names with hyphens in them. Merge of [33718] to the 3.8 branch. Props dustinbolton, pento. See #33470. Built from https://develop.svn.wordpress.org/branches/3.8@33996 git-svn-id: http://core.svn.wordpress.org/branches/3.8@33965 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-09-10 07:14:10 +00:00
Gary Pendergast	22068b9926	Capabilities: Fall back to the `edit_posts` capability for orphaned comments. Merge of the `capabilities.php` part of [33614] to the 3.8 branch. Props pento, dd32. See #33154. Built from https://develop.svn.wordpress.org/branches/3.8@33976 git-svn-id: http://core.svn.wordpress.org/branches/3.8@33945 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-09-09 06:22:10 +00:00
Dominik Schilling	09a38682f8	Bump 3.8 branch to version 3.8.10. Built from https://develop.svn.wordpress.org/branches/3.8@33576 git-svn-id: http://core.svn.wordpress.org/branches/3.8@33543 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-08-04 11:52:44 +00:00
Dion Hulse	32274112c6	Fix `do_shortcode('<[shortcode]')` edge case. Props miqrogroove. Merges [33499] to the 3.8 branch. See #33116. Built from https://develop.svn.wordpress.org/branches/3.8@33567 git-svn-id: http://core.svn.wordpress.org/branches/3.8@33534 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-08-04 07:18:54 +00:00
Dominik Schilling	0128210d88	Comments: IDs are integers. Merge of [33555] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@33560 git-svn-id: http://core.svn.wordpress.org/branches/3.8@33527 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-08-04 05:00:15 +00:00
Dominik Schilling	6d3a23c410	Themes: Fix some broken links in the legacy theme preview. Merge of [33549] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@33553 git-svn-id: http://core.svn.wordpress.org/branches/3.8@33520 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-08-04 04:58:04 +00:00
Dominik Schilling	ebe4779cea	Heartbeat: Ensure post locks are released. Merge of [33542] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@33547 git-svn-id: http://core.svn.wordpress.org/branches/3.8@33514 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-08-04 04:56:15 +00:00
Dominik Schilling	7641da2980	Nav menus: Consistent titles in widgets. Merge of [33529] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@33533 git-svn-id: http://core.svn.wordpress.org/branches/3.8@33500 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-08-03 20:58:59 +00:00
Andrew Ozz	53f980d4be	Backport r33469 and r33470 to 3.8. See #33106. Built from https://develop.svn.wordpress.org/branches/3.8@33524 git-svn-id: http://core.svn.wordpress.org/branches/3.8@33491 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-07-31 01:45:23 +00:00
Gary Pendergast	b796308091	Bump 3.9 branch to version 3.8.9. Built from https://develop.svn.wordpress.org/branches/3.8@33399 git-svn-id: http://core.svn.wordpress.org/branches/3.8@33367 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-07-23 11:09:09 +00:00
Gary Pendergast	fbc90de16c	Shortcodes: Improve the reliablity of shortcodes inside HTML tags. Merge of [33359] to the 3.8 branch. Props miqrogroove. See #15694. Built from https://develop.svn.wordpress.org/branches/3.8@33388 git-svn-id: http://core.svn.wordpress.org/branches/3.8@33356 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-07-23 05:09:09 +00:00
Gary Pendergast	9a0402d634	Capabilities: When creating an auto-draft, ensure that the current user still has permission to do so. Merge of [33357] to the 3.8 branch. Built from https://develop.svn.wordpress.org/branches/3.8@33378 git-svn-id: http://core.svn.wordpress.org/branches/3.8@33349 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-07-23 04:19:10 +00:00