Tag 3.9.17

Built from https://develop.svn.wordpress.org/tags/3.9.17@40221 git-svn-id: http://core.svn.wordpress.org/tags/3.9.17@40160 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Bump 3.9 branch to version 3.9.17.
2017-03-06 18:16:07 +00:00 · 2017-03-06 16:42:15 +00:00 · 2017-03-06 13:45:58 +00:00 · 2017-03-06 13:05:15 +00:00 · 2017-03-06 08:12:16 +00:00
6 changed files with 20 additions and 4 deletions
--- a/readme.html
+++ b/readme.html
@@ -9,7 +9,7 @@
 <body>
 <h1 id="logo">
 	<a href="https://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
-	<br /> Version 3.9.16
+	<br /> Version 3.9.17
 </h1>
 <p style="text-align: center">Semantic Personal Publishing Platform</p>

--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -39,7 +39,11 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 </h2>

 <div class="changelog point-releases">
-	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 16 ); ?></h3>
+	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 17 ); ?></h3>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 5 ), '3.9.17' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.9.17' ); ?>
+	</p>
 	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
         '<strong>Version %1$s</strong> addressed some security issues.', 3 ), '3.9.16' ); ?>
 		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.9.16' ); ?>
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -2943,6 +2943,8 @@ function wp_read_video_metadata( $file ) {

 	wp_add_id3_tag_data( $metadata, $data );

+	$metadata = wp_kses_post_deep( $metadata );
+
 	return $metadata;
 }

@@ -2982,5 +2984,7 @@ function wp_read_audio_metadata( $file ) {

 	wp_add_id3_tag_data( $metadata, $data );

+	$metadata = wp_kses_post_deep( $metadata );
+
 	return $metadata;
 }
--- a/wp-admin/plugins.php
+++ b/wp-admin/plugins.php
@@ -225,6 +225,14 @@ if ( $action ) {
 				exit;
 			}

+			// Bail on all if any paths are invalid.
+			// validate_file() returns truthy for invalid files
+			$invalid_plugin_files = array_filter( $plugins, 'validate_file' );
+			if ( $invalid_plugin_files ) {
+				wp_redirect( self_admin_url("plugins.php?plugin_status=$status&paged=$page&s=$s") );
+				exit;
+			}
+
 			include(ABSPATH . 'wp-admin/update.php');

 			$parent_file = 'plugins.php';
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -1185,7 +1185,7 @@ if ( !function_exists('wp_validate_redirect') ) :
 * @return string redirect-sanitized URL
 **/
 function wp_validate_redirect($location, $default = '') {
-	$location = trim( $location );
+	$location = trim( $location, " \t\n\r\0\x08\x0B" );
 	// browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
 	if ( substr($location, 0, 2) == '//' )
 		$location = 'http:' . $location;
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
 *
 * @global string $wp_version
 */
-$wp_version = '3.9.16';
+$wp_version = '3.9.17';

 /**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
Author	SHA1	Message	Date
Sergey Biryukov	4081f36fd1	Tag 3.9.17 Built from https://develop.svn.wordpress.org/tags/3.9.17@40221 git-svn-id: http://core.svn.wordpress.org/tags/3.9.17@40160 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-03-06 18:16:07 +00:00
James Nylen	f2ef35f4a9	Bump 3.9 branch to version 3.9.17. Built from https://develop.svn.wordpress.org/branches/3.9@40210 git-svn-id: http://core.svn.wordpress.org/branches/3.9@40149 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-03-06 16:42:15 +00:00
Aaron Campbell	244804028c	Strip control characters before validating redirect. Merges [40183] to 3.9 branch. Built from https://develop.svn.wordpress.org/branches/3.9@40192 git-svn-id: http://core.svn.wordpress.org/branches/3.9@40131 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-03-06 13:45:58 +00:00
Aaron Campbell	fcec9ed6ff	Plugins: Add file check to plugin deletions. Merges [40169] to 3.9 branch. Built from https://develop.svn.wordpress.org/branches/3.9@40178 git-svn-id: http://core.svn.wordpress.org/branches/3.9@40117 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-03-06 13:05:15 +00:00
Jeremy Felt	ca488f141f	Validate video and audio metadata. Merge of [40148] to the 3.9 branch. Built from https://develop.svn.wordpress.org/branches/3.9@40157 git-svn-id: http://core.svn.wordpress.org/branches/3.9@40096 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-03-06 08:12:16 +00:00