Tag 4.0.4.

Built from https://develop.svn.wordpress.org/@32321 git-svn-id: http://core.svn.wordpress.org/tags/4.0.4@32292 1a063a9b-81f0-0310-95a4-ce76da25c4cd
4.0:
2015-04-27 18:56:43 +00:00 · 2015-04-27 17:17:37 +00:00 · 2015-04-27 14:11:37 +00:00 · 2015-04-23 21:35:37 +00:00 · 2015-04-23 11:44:39 +00:00 · 2015-04-21 06:19:40 +00:00
56 changed files with 1237 additions and 199 deletions
--- a/license.txt
+++ b/license.txt
@@ -1,6 +1,6 @@
 WordPress - Web publishing software

-Copyright 2014 by the contributors
+Copyright 2015 by the contributors

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
--- a/readme.html
+++ b/readme.html
@@ -9,7 +9,7 @@
 <body>
 <h1 id="logo">
 	<a href="https://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
-	<br /> Version 4.0
+	<br /> Version 4.0.4
 </h1>
 <p style="text-align: center">Semantic Personal Publishing Platform</p>

--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -41,6 +41,26 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 	</a>
 </h2>

+<div class="changelog point-releases">
+	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 4 ); ?></h3>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 1 ), '4.0.4' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_4.0.4' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed %2$s bug.',
+         '<strong>Version %1$s</strong> addressed %2$s bugs.', 1 ), '4.0.3', number_format_i18n( 1 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.0.3' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
+         '<strong>Version %1$s</strong> addressed some security issues.', 8 ), '4.0.2' ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_4.0.2' ); ?>
+ 	</p>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
+         '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 23 ), '4.0.1', number_format_i18n( 23 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_4.0.1' ); ?>
+ 	</p>
+</div>
+
 <div class="changelog">
 	<div class="about-overview">
 		<?php if ( ( $locale = get_locale() ) && 'en_' === substr( $locale, 0, 3 ) ) : ?>
--- a/wp-admin/includes/class-wp-comments-list-table.php
+++ b/wp-admin/includes/class-wp-comments-list-table.php
@@ -552,9 +552,9 @@ class WP_Comments_List_Table extends WP_List_Table {

 		if ( current_user_can( 'edit_post', $post->ID ) ) {
 			$post_link = "<a href='" . get_edit_post_link( $post->ID ) . "'>";
-			$post_link .= get_the_title( $post->ID ) . '</a>';
+			$post_link .= esc_html( get_the_title( $post->ID ) ) . '</a>';
 		} else {
-			$post_link = get_the_title( $post->ID );
+			$post_link = esc_html( get_the_title( $post->ID ) );
 		}

 		echo '<div class="response-links"><span class="post-com-count-wrapper">';
--- a/wp-admin/includes/class-wp-plugin-install-list-table.php
+++ b/wp-admin/includes/class-wp-plugin-install-list-table.php
@@ -273,7 +273,9 @@ class WP_Plugin_Install_List_Table extends WP_List_Table {
 			return;
 		}

-		if ( 'top' ==  $which ) { ?>
+		if ( 'top' ==  $which ) {
+			wp_referer_field();
+		?>
 			<div class="tablenav top">
 				<div class="alignleft actions">
 					<?php
--- a/wp-admin/includes/dashboard.php
+++ b/wp-admin/includes/dashboard.php
@@ -518,7 +518,7 @@ function wp_dashboard_recent_drafts( $drafts = false ) {
 function _wp_dashboard_recent_comments_row( &$comment, $show_date = true ) {
 	$GLOBALS['comment'] =& $comment;

-	$comment_post_title = strip_tags(get_the_title( $comment->comment_post_ID ));
+	$comment_post_title = _draft_or_post_title( $comment->comment_post_ID );

 	if ( current_user_can( 'edit_post', $comment->comment_post_ID ) ) {
 		$comment_post_url = get_edit_post_link( $comment->comment_post_ID );
--- a/wp-admin/includes/image.php
+++ b/wp-admin/includes/image.php
@@ -401,6 +401,12 @@ function wp_read_image_metadata( $file ) {
 		}
 	}

+	foreach ( $meta as &$value ) {
+		if ( is_string( $value ) ) {
+			$value = wp_kses_post( $value );
+		}
+	}
+
 	/**
 	 * Filter the array of meta data read from an image's exif data.
 	 *
--- a/wp-admin/includes/plugin-install.php
+++ b/wp-admin/includes/plugin-install.php
@@ -235,10 +235,15 @@ function install_plugins_favorites_form() {
 function display_plugins_table() {
 	global $wp_list_table;

-	if ( current_filter() == 'install_plugins_favorites' && empty( $_GET['user'] ) && ! get_user_option( 'wporg_favorites' ) )
-			return;
+	if ( current_filter() == 'install_plugins_favorites' && empty( $_GET['user'] ) && ! get_user_option( 'wporg_favorites' ) ) {
+		return;
+	}

-	$wp_list_table->display();
+	?>
+	<form id="plugin-filter" action="" method="post">
+		<?php $wp_list_table->display(); ?>
+	</form>
+	<?php
 }
 add_action( 'install_plugins_search',    'display_plugins_table' );
 add_action( 'install_plugins_popular',   'display_plugins_table' );
--- a/wp-admin/includes/post.php
+++ b/wp-admin/includes/post.php
@@ -177,6 +177,7 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
 * @return int Post ID.
 */
 function edit_post( $post_data = null ) {
+	global $wpdb;

 	if ( empty($post_data) )
 		$post_data = &$_POST;
@@ -317,7 +318,19 @@ function edit_post( $post_data = null ) {

 	update_post_meta( $post_ID, '_edit_last', get_current_user_id() );

-	wp_update_post( $post_data );
+	$success = wp_update_post( $post_data );
+	// If the save failed, see if we can sanity check the main fields and try again
+	if ( ! $success && is_callable( array( $wpdb, 'strip_invalid_text_for_column' ) ) ) {
+		$fields = array( 'post_title', 'post_content', 'post_excerpt' );
+
+		foreach( $fields as $field ) {
+			if ( isset( $post_data[ $field ] ) ) {
+				$post_data[ $field ] = $wpdb->strip_invalid_text_for_column( $wpdb->posts, $field, $post_data[ $field ] );
+			}
+		}
+
+		wp_update_post( $post_data );
+	}

 	// Now that we have an ID we can fix any attachment anchor hrefs
 	_fix_attachment_links( $post_ID );
@@ -1205,12 +1218,18 @@ function get_sample_permalink_html( $id, $new_title = null, $new_slug = null ) {
 			$return .= '<span id="change-permalinks"><a href="options-permalink.php" class="button button-small" target="_blank">' . __('Change Permalinks') . "</a></span>\n";
 		}
 	} else {
-		if ( function_exists( 'mb_strlen' ) && mb_strlen( $post_name ) > 30 ) {
-			$post_name_abridged = mb_substr( $post_name, 0, 14 ) . '&hellip;' . mb_substr( $post_name, -14 );
-		} elseif ( strlen( $post_name ) > 30 ) {
-			$post_name_abridged = substr( $post_name, 0, 14 ) . '&hellip;' . substr( $post_name, -14 );
+		if ( function_exists( 'mb_strlen' ) ) {
+			if ( mb_strlen( $post_name ) > 30 ) {
+				$post_name_abridged = mb_substr( $post_name, 0, 14 ) . '&hellip;' . mb_substr( $post_name, -14 );
+			} else {
+				$post_name_abridged = $post_name;
+			}
 		} else {
-			$post_name_abridged = $post_name;
+			if ( strlen( $post_name ) > 30 ) {
+				$post_name_abridged = substr( $post_name, 0, 14 ) . '&hellip;' . substr( $post_name, -14 );
+			} else {
+				$post_name_abridged = $post_name;
+			}
 		}

 		$post_name_html = '<span id="editable-post-name" title="' . $title . '">' . $post_name_abridged . '</span>';
--- a/wp-admin/includes/template.php
+++ b/wp-admin/includes/template.php
@@ -1492,7 +1492,7 @@ function _draft_or_post_title( $post = 0 ) {
 	$title = get_the_title( $post );
 	if ( empty( $title ) )
 		$title = __( '(no title)' );
-	return $title;
+	return esc_html( $title );
 }

 /**
--- a/wp-admin/includes/upgrade.php
+++ b/wp-admin/includes/upgrade.php
@@ -440,6 +440,9 @@ function upgrade_all() {
 	if ( $wp_current_db_version < 29630 )
 		upgrade_400();

+	if ( $wp_current_db_version < 29631 )
+		upgrade_404();
+
 	maybe_disable_link_manager();

 	maybe_disable_automattic_widgets();
@@ -1326,6 +1329,33 @@ function upgrade_400() {
 	}
 }

+/**
+ * Execute changes made in WordPress 4.0.4.
+ *
+ * @since 4.0.4
+ */
+function upgrade_404() {
+	global $wp_current_db_version, $wpdb;
+
+	if ( $wp_current_db_version < 29631 ) {
+		$content_length = $wpdb->get_col_length( $wpdb->comments, 'comment_content' );
+		if ( ! $content_length ) {
+			$content_length = 65535;
+		}
+
+		$comments = $wpdb->get_results(
+			"SELECT comment_ID FROM $wpdb->comments
+			WHERE comment_date_gmt > '2015-04-26'
+			AND CHAR_LENGTH( comment_content ) >= $content_length
+			AND ( comment_content LIKE '%<%' OR comment_content LIKE '%>%' )"
+		);
+
+		foreach ( $comments as $comment ) {
+			wp_delete_comment( $comment->comment_ID, true );
+		}
+	}
+}
+
 /**
 * Execute network level changes
 *
--- a/wp-admin/js/editor-expand.js
+++ b/wp-admin/js/editor-expand.js
@@ -2,7 +2,7 @@

 window.wp = window.wp || {};

-jQuery( document ).ready( function($) {
+jQuery( document ).ready( function( $ ) {
 	var $window = $( window ),
 		$document = $( document ),
 		$adminBar = $( '#wpadminbar' ),
@@ -148,6 +148,11 @@ jQuery( document ).ready( function($) {

 	// We need to wait for TinyMCE to initialize.
 	$document.on( 'tinymce-editor-init.editor-expand', function( event, editor ) {
+		var hideFloatPanels = _.debounce( function() {
+			! $( '.mce-floatpanel:hover' ).length && tinymce.ui.FloatPanel.hideAll();
+			$( '.mce-tooltip' ).hide();
+		}, 1000, true );
+
 		// Make sure it's the main editor.
 		if ( editor.id !== 'content' ) {
 			return;
@@ -224,6 +229,8 @@ jQuery( document ).ready( function($) {

 		// Adjust when switching editor modes.
 		function mceShow() {
+			$window.on( 'scroll.mce-float-panels', hideFloatPanels );
+
 			setTimeout( function() {
 				editor.execCommand( 'wpAutoResize' );
 				adjust();
@@ -231,6 +238,8 @@ jQuery( document ).ready( function($) {
 		}

 		function mceHide() {
+			$window.off( 'scroll.mce-float-panels' );
+
 			setTimeout( function() {
 				var top = $contentWrap.offset().top;

@@ -251,6 +260,8 @@ jQuery( document ).ready( function($) {
 			editor.on( 'hide', mceHide );
 			// Adjust when the editor resizes.
 			editor.on( 'setcontent wp-autoresize wp-toolbar-toggle', adjust );
+
+			$window.off( 'scroll.mce-float-panels' ).on( 'scroll.mce-float-panels', hideFloatPanels );
 		};

 		mceUnbind = function() {
@@ -258,6 +269,8 @@ jQuery( document ).ready( function($) {
 			editor.off( 'show', mceShow );
 			editor.off( 'hide', mceHide );
 			editor.off( 'setcontent wp-autoresize wp-toolbar-toggle', adjust );
+
+			$window.off( 'scroll.mce-float-panels' );
 		};

 		if ( $wrap.hasClass( 'wp-editor-expand' ) ) {
@@ -590,6 +603,12 @@ jQuery( document ).ready( function($) {
 				}

 				adjust();
+			}).on( 'wp-window-resized.editor-expand', function() {
+				if ( mceEditor && ! mceEditor.isHidden() ) {
+					mceEditor.execCommand( 'wpAutoResize' );
+				} else {
+					textEditorResize();
+				}
 			});

 		$textEditor.on( 'focus.editor-expand input.editor-expand propertychange.editor-expand', textEditorResize );
--- a/wp-admin/js/editor-expand.min.js
+++ b/wp-admin/js/editor-expand.min.js
--- a/wp-admin/js/media.js
+++ b/wp-admin/js/media.js
@@ -72,11 +72,15 @@ var findPosts;
 	};

 	$( document ).ready( function() {
+		var $mediaGridWrap = $( '#wp-media-grid' );
+
 		// Open up a manage media frame into the grid.
-		wp.media && wp.media({
-			frame: 'manage',
-			container: $('#wpbody-content > .wrap')
-		}).open();
+		if ( $mediaGridWrap.length && window.wp && window.wp.media ) {
+			window.wp.media({
+				frame: 'manage',
+				container: $mediaGridWrap
+			}).open();
+		}

 		$( '#find-posts-submit' ).click( function( event ) {
 			if ( ! $( '#find-posts-response input[type="radio"]:checked' ).length )
--- a/wp-admin/js/media.min.js
+++ b/wp-admin/js/media.min.js
@@ -1 +1 @@
-var findPosts;!function(a){findPosts={open:function(b,c){var d=a(".ui-find-overlay");return 0===d.length&&(a("body").append('<div class="ui-find-overlay"></div>'),findPosts.overlay()),d.show(),b&&c&&a("#affected").attr("name",b).val(c),a("#find-posts").show(),a("#find-posts-input").focus().keyup(function(a){27==a.which&&findPosts.close()}),findPosts.send(),!1},close:function(){a("#find-posts-response").html(""),a("#find-posts").hide(),a(".ui-find-overlay").hide()},overlay:function(){a(".ui-find-overlay").on("click",function(){findPosts.close()})},send:function(){var b={ps:a("#find-posts-input").val(),action:"find_posts",_ajax_nonce:a("#_ajax_nonce").val()},c=a(".find-box-search .spinner");c.show(),a.ajax(ajaxurl,{type:"POST",data:b,dataType:"json"}).always(function(){c.hide()}).done(function(b){b.success||a("#find-posts-response").text(attachMediaBoxL10n.error),a("#find-posts-response").html(b.data)}).fail(function(){a("#find-posts-response").text(attachMediaBoxL10n.error)})}},a(document).ready(function(){wp.media&&wp.media({frame:"manage",container:a("#wpbody-content > .wrap")}).open(),a("#find-posts-submit").click(function(b){a('#find-posts-response input[type="radio"]:checked').length||b.preventDefault()}),a("#find-posts .find-box-search :input").keypress(function(a){return 13==a.which?(findPosts.send(),!1):void 0}),a("#find-posts-search").click(findPosts.send),a("#find-posts-close").click(findPosts.close),a("#doaction, #doaction2").click(function(b){a('select[name^="action"]').each(function(){"attach"===a(this).val()&&(b.preventDefault(),findPosts.open())})}),a(".find-box-inside").on("click","tr",function(){a(this).find(".found-radio input").prop("checked",!0)})})}(jQuery);
+var findPosts;!function(a){findPosts={open:function(b,c){var d=a(".ui-find-overlay");return 0===d.length&&(a("body").append('<div class="ui-find-overlay"></div>'),findPosts.overlay()),d.show(),b&&c&&a("#affected").attr("name",b).val(c),a("#find-posts").show(),a("#find-posts-input").focus().keyup(function(a){27==a.which&&findPosts.close()}),findPosts.send(),!1},close:function(){a("#find-posts-response").html(""),a("#find-posts").hide(),a(".ui-find-overlay").hide()},overlay:function(){a(".ui-find-overlay").on("click",function(){findPosts.close()})},send:function(){var b={ps:a("#find-posts-input").val(),action:"find_posts",_ajax_nonce:a("#_ajax_nonce").val()},c=a(".find-box-search .spinner");c.show(),a.ajax(ajaxurl,{type:"POST",data:b,dataType:"json"}).always(function(){c.hide()}).done(function(b){b.success||a("#find-posts-response").text(attachMediaBoxL10n.error),a("#find-posts-response").html(b.data)}).fail(function(){a("#find-posts-response").text(attachMediaBoxL10n.error)})}},a(document).ready(function(){var b=a("#wp-media-grid");b.length&&window.wp&&window.wp.media&&window.wp.media({frame:"manage",container:b}).open(),a("#find-posts-submit").click(function(b){a('#find-posts-response input[type="radio"]:checked').length||b.preventDefault()}),a("#find-posts .find-box-search :input").keypress(function(a){return 13==a.which?(findPosts.send(),!1):void 0}),a("#find-posts-search").click(findPosts.send),a("#find-posts-close").click(findPosts.close),a("#doaction, #doaction2").click(function(b){a('select[name^="action"]').each(function(){"attach"===a(this).val()&&(b.preventDefault(),findPosts.open())})}),a(".find-box-inside").on("click","tr",function(){a(this).find(".found-radio input").prop("checked",!0)})})}(jQuery);
--- a/wp-admin/js/nav-menu.js
+++ b/wp-admin/js/nav-menu.js
@@ -453,14 +453,14 @@ var wpNavMenu;
 				if ( ! isPrimaryMenuItem ) {
 					thisLink = menuItem.find( '.menus-move-left' ),
 					thisLinkText = menus.outFrom.replace( '%s', prevItemNameLeft );
-					thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).html( thisLinkText ).css( 'display', 'inline' );
+					thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).text( thisLinkText ).css( 'display', 'inline' );
 				}

 				if ( 0 !== position ) {
 					if ( menuItem.find( '.menu-item-data-parent-id' ).val() !== menuItem.prev().find( '.menu-item-data-db-id' ).val() ) {
 						thisLink = menuItem.find( '.menus-move-right' ),
 						thisLinkText = menus.under.replace( '%s', prevItemNameRight );
-						thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).html( thisLinkText ).css( 'display', 'inline' );
+						thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).text( thisLinkText ).css( 'display', 'inline' );
 					}
 				}

@@ -482,7 +482,7 @@ var wpNavMenu;
 					title = menus.subMenuFocus.replace( '%1$s', itemName ).replace( '%2$d', itemPosition ).replace( '%3$s', parentItemName );
 				}

-				$this.prop('title', title).html( title );
+				$this.prop('title', title).text( title );
 			});
 		},

--- a/wp-admin/js/nav-menu.min.js
+++ b/wp-admin/js/nav-menu.min.js
--- a/wp-admin/plugin-install.php
+++ b/wp-admin/plugin-install.php
@@ -24,8 +24,27 @@ if ( is_multisite() && ! is_network_admin() ) {

 $wp_list_table = _get_list_table('WP_Plugin_Install_List_Table');
 $pagenum = $wp_list_table->get_pagenum();
+
+if ( ! empty( $_REQUEST['_wp_http_referer'] ) ) {
+	$location = remove_query_arg( '_wp_http_referer', wp_unslash( $_SERVER['REQUEST_URI'] ) );
+
+	if ( ! empty( $_REQUEST['paged'] ) ) {
+		$location = add_query_arg( 'paged', (int) $_REQUEST['paged'], $location );
+	}
+
+	wp_redirect( $location );
+	exit;
+}
+
 $wp_list_table->prepare_items();

+$total_pages = $wp_list_table->get_pagination_arg( 'total_pages' );
+
+if ( $pagenum > $total_pages && $total_pages > 0 ) {
+	wp_redirect( add_query_arg( 'paged', $total_pages ) );
+	exit;
+}
+
 $title = __( 'Add Plugins' );
 $parent_file = 'plugins.php';

--- a/wp-admin/press-this.php
+++ b/wp-admin/press-this.php
@@ -63,7 +63,7 @@ function press_it() {
 	// Error handling for media_sideload.
 	if ( is_wp_error($upload) ) {
 		wp_delete_post($post_ID);
-		wp_die($upload);
+		wp_die( esc_html( $upload->get_error_message() ) );
 	} else {
 		// Post formats.
 		if ( isset( $_POST['post_format'] ) ) {
--- a/wp-admin/upload.php
+++ b/wp-admin/upload.php
@@ -57,7 +57,7 @@ if ( 'grid' === $mode ) {

 	require_once( ABSPATH . 'wp-admin/admin-header.php' );
 	?>
-	<div class="wrap">
+	<div class="wrap" id="wp-media-grid">
 		<h2>
 		<?php
 		echo esc_html( $title );
--- a/wp-includes/canonical.php
+++ b/wp-includes/canonical.php
@@ -360,10 +360,6 @@ function redirect_canonical( $requested_url = null, $do_redirect = true ) {
 	else
 		unset($redirect['port']);

-	if ( ! empty( $user_home['scheme'] ) && $user_home['scheme'] === 'https' ) {
-		$redirect['scheme'] = 'https';
-	}
-
 	// trailing /index.php
 	$redirect['path'] = preg_replace('|/' . preg_quote( $wp_rewrite->index, '|' ) . '/*?$|', '/', $redirect['path']);

@@ -421,7 +417,7 @@ function redirect_canonical( $requested_url = null, $do_redirect = true ) {
 		( strtolower($original['host']) != 'www.' . strtolower($redirect['host']) && 'www.' . strtolower($original['host']) != strtolower($redirect['host']) ) )
 		$redirect['host'] = $original['host'];

-	$compare_original = array( $original['scheme'], $original['host'], $original['path'] );
+	$compare_original = array( $original['host'], $original['path'] );

 	if ( !empty( $original['port'] ) )
 		$compare_original[] = $original['port'];
@@ -429,7 +425,7 @@ function redirect_canonical( $requested_url = null, $do_redirect = true ) {
 	if ( !empty( $original['query'] ) )
 		$compare_original[] = $original['query'];

-	$compare_redirect = array( $redirect['scheme'], $redirect['host'], $redirect['path'] );
+	$compare_redirect = array( $redirect['host'], $redirect['path'] );

 	if ( !empty( $redirect['port'] ) )
 		$compare_redirect[] = $redirect['port'];
--- a/wp-includes/capabilities.php
+++ b/wp-includes/capabilities.php
@@ -1371,21 +1371,25 @@ function current_user_can( $capability ) {
 * @return bool
 */
 function current_user_can_for_blog( $blog_id, $capability ) {
-	if ( is_multisite() )
-		switch_to_blog( $blog_id );
+	$switched = is_multisite() ? switch_to_blog( $blog_id ) : false;

 	$current_user = wp_get_current_user();

-	if ( empty( $current_user ) )
+	if ( empty( $current_user ) ) {
+		if ( $switched ) {
+			restore_current_blog();
+		}
 		return false;
+	}

 	$args = array_slice( func_get_args(), 2 );
 	$args = array_merge( array( $capability ), $args );

 	$can = call_user_func_array( array( $current_user, 'has_cap' ), $args );

-	if ( is_multisite() )
+	if ( $switched ) {
 		restore_current_blog();
+	}

 	return $can;
 }
--- a/wp-includes/class-phpass.php
+++ b/wp-includes/class-phpass.php
@@ -214,6 +214,10 @@ class PasswordHash {

 	function HashPassword($password)
 	{
+		if ( strlen( $password ) > 4096 ) {
+			return '*';
+		}
+
 		$random = '';

 		if (CRYPT_BLOWFISH == 1 && !$this->portable_hashes) {
@@ -249,6 +253,10 @@ class PasswordHash {

 	function CheckPassword($password, $stored_hash)
 	{
+		if ( strlen( $password ) > 4096 ) {
+			return false;
+		}
+
 		$hash = $this->crypt_private($password, $stored_hash);
 		if ($hash[0] == '*')
 			$hash = crypt($password, $stored_hash);
--- a/wp-includes/class-wp-editor.php
+++ b/wp-includes/class-wp-editor.php
@@ -116,12 +116,6 @@ final class _WP_Editors {
 			// A cookie (set when a user resizes the editor) overrides the height.
 			$cookie = (int) get_user_setting( 'ed_size' );

-			// Upgrade an old TinyMCE cookie if it is still around, and the new one isn't.
-			if ( ! $cookie && isset( $_COOKIE['TinyMCE_content_size'] ) ) {
-				parse_str( $_COOKIE['TinyMCE_content_size'], $cookie );
- 				$cookie = $cookie['ch'];
-			}
-
 			if ( $cookie )
 				$set['editor_height'] = $cookie;
 		}
--- a/wp-includes/css/media-views-rtl.css
+++ b/wp-includes/css/media-views-rtl.css
@@ -7,6 +7,14 @@
 	box-sizing: content-box;
 }

+.media-frame input,
+.media-frame select,
+.media-frame textarea {
+    -webkit-box-sizing: border-box;
+    -moz-box-sizing: border-box;
+    box-sizing: border-box;
+}
+
 .media-modal,
 .media-frame {
 	font-family: "Open Sans", sans-serif;
@@ -56,9 +64,6 @@
 .media-frame select {
 	font-family: "Open Sans", sans-serif;
 	font-size: 12px;
-	-webkit-box-sizing: border-box;
-	-moz-box-sizing: border-box;
-	box-sizing: border-box;
 	border-width: 1px;
 	border-style: solid;
 	border-color: #dfdfdf;
--- a/wp-includes/css/media-views-rtl.min.css
+++ b/wp-includes/css/media-views-rtl.min.css
--- a/wp-includes/css/media-views.css
+++ b/wp-includes/css/media-views.css
@@ -7,6 +7,14 @@
 	box-sizing: content-box;
 }

+.media-frame input,
+.media-frame select,
+.media-frame textarea {
+    -webkit-box-sizing: border-box;
+    -moz-box-sizing: border-box;
+    box-sizing: border-box;
+}
+
 .media-modal,
 .media-frame {
 	font-family: "Open Sans", sans-serif;
@@ -56,9 +64,6 @@
 .media-frame select {
 	font-family: "Open Sans", sans-serif;
 	font-size: 12px;
-	-webkit-box-sizing: border-box;
-	-moz-box-sizing: border-box;
-	box-sizing: border-box;
 	border-width: 1px;
 	border-style: solid;
 	border-color: #dfdfdf;
--- a/wp-includes/css/media-views.min.css
+++ b/wp-includes/css/media-views.min.css
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -28,7 +28,7 @@
 * @return string The string replaced with html entities
 */
 function wptexturize($text, $reset = false) {
-	global $wp_cockneyreplace;
+	global $wp_cockneyreplace, $shortcode_tags;
 	static $static_characters, $static_replacements, $dynamic_characters, $dynamic_replacements,
 		$default_no_texturize_tags, $default_no_texturize_shortcodes, $run_texturize = true;

@@ -205,21 +205,34 @@ function wptexturize($text, $reset = false) {

 	// Look for shortcodes and HTML elements.

+	$tagnames = array_keys( $shortcode_tags );
+	$tagregexp = join( '|', array_map( 'preg_quote', $tagnames ) );
+	$tagregexp = "(?:$tagregexp)(?![\\w-])"; // Excerpt of get_shortcode_regex().
+
+	$comment_regex =
+		  '!'           // Start of comment, after the <.
+		. '(?:'         // Unroll the loop: Consume everything until --> is found.
+		.     '-(?!->)' // Dash not followed by end of comment.
+		.     '[^\-]*+' // Consume non-dashes.
+		. ')*+'         // Loop possessively.
+		. '-->';        // End of comment.
+
 	$regex =  '/('			// Capture the entire match.
 		.	'<'		// Find start of element.
 		.	'(?(?=!--)'	// Is this a comment?
-		.		'.+?--\s*>'	// Find end of comment
+		.		$comment_regex	// Find end of comment
 		.	'|'
 		.		'[^>]+>'	// Find end of element
 		.	')'
 		. '|'
 		.	'\['		// Find start of shortcode.
-		.	'\[?'		// Shortcodes may begin with [[
+		.	'[\/\[]?'	// Shortcodes may begin with [/ or [[
+		.	$tagregexp	// Only match registered shortcodes, because performance.
 		.	'(?:'
-		.		'[^\[\]<>]'	// Shortcodes do not contain other shortcodes.
+		.		'[^\[\]<>]+'	// Shortcodes do not contain other shortcodes. Quantifier critical.
 		.	'|'
-		.		'<[^>]+>' 	// HTML elements permitted. Prevents matching ] before >.
-		.	')++'
+		.		'<[^\[\]>]*>' 	// HTML elements permitted. Prevents matching ] before >.
+		.	')*+'		// Possessive critical.
 		.	'\]'		// Find end of shortcode.
 		.	'\]?'		// Shortcodes may end with ]]
 		. ')/s';
@@ -241,12 +254,12 @@ function wptexturize($text, $reset = false) {

 			continue;

-		} elseif ( '[' === $first && 1 === preg_match( '/^\[(?:[^\[\]<>]|<[^>]+>)++\]$/', $curl ) ) {
+		} elseif ( '[' === $first && 1 === preg_match( '/^\[\/?' . $tagregexp . '(?:[^\[\]<>]+|<[^\[\]>]*>)*+\]$/', $curl ) ) {
 			// This is a shortcode delimiter.

 			_wptexturize_pushpop_element( $curl, $no_texturize_shortcodes_stack, $no_texturize_shortcodes );

-		} elseif ( '[' === $first && 1 === preg_match( '/^\[\[?(?:[^\[\]<>]|<[^>]+>)++\]\]?$/', $curl ) ) {
+		} elseif ( '[' === $first && 1 === preg_match( '/^\[[\/\[]?' . $tagregexp . '(?:[^\[\]<>]+|<[^\[\]>]*>)*+\]\]?$/', $curl ) ) {
 			// This is an escaped shortcode delimiter.

 			// Do not texturize.
@@ -1292,21 +1305,23 @@ function sanitize_title_with_dashes( $title, $raw_title = '', $context = 'displa
 }

 /**
- * Ensures a string is a valid SQL order by clause.
+ * Ensures a string is a valid SQL 'order by' clause.
 *
- * Accepts one or more columns, with or without ASC/DESC, and also accepts
- * RAND().
+ * Accepts one or more columns, with or without a sort order (ASC / DESC).
+ * e.g. 'column_1', 'column_1, column_2', 'column_1 ASC, column_2 DESC' etc.
+ *
+ * Also accepts 'RAND()'.
 *
 * @since 2.5.1
 *
- * @param string $orderby Order by string to be checked.
- * @return string|bool Returns the order by clause if it is a match, false otherwise.
+ * @param string $orderby Order by clause to be validated.
+ * @return string|bool Returns $orderby if valid, false otherwise.
 */
-function sanitize_sql_orderby( $orderby ){
-	preg_match('/^\s*([a-z0-9_]+(\s+(ASC|DESC))?(\s*,\s*|\s*$))+|^\s*RAND\(\s*\)\s*$/i', $orderby, $obmatches);
-	if ( !$obmatches )
-		return false;
-	return $orderby;
+function sanitize_sql_orderby( $orderby ) {
+	if ( preg_match( '/^\s*(([a-z0-9_]+|`[a-z0-9_]+`)(\s+(ASC|DESC))?\s*(,\s*(?=[a-z0-9_`])|$))+$/i', $orderby ) || preg_match( '/^\s*RAND\(\s*\)\s*$/i', $orderby ) ) {
+		return $orderby;
+	}
+	return false;
 }

 /**
--- a/wp-includes/http.php
+++ b/wp-includes/http.php
@@ -444,8 +444,9 @@ function send_origin_headers() {
 * @return mixed URL or false on failure.
 */
 function wp_http_validate_url( $url ) {
+	$original_url = $url;
 	$url = wp_kses_bad_protocol( $url, array( 'http', 'https' ) );
-	if ( ! $url )
+	if ( ! $url || strtolower( $url ) !== strtolower( $original_url ) )
 		return false;

 	$parsed_url = @parse_url( $url );
@@ -455,7 +456,7 @@ function wp_http_validate_url( $url ) {
 	if ( isset( $parsed_url['user'] ) || isset( $parsed_url['pass'] ) )
 		return false;

-	if ( false !== strpos( $parsed_url['host'], ':' ) )
+	if ( false !== strpbrk( $parsed_url['host'], ':#?[]' ) )
 		return false;

 	$parsed_home = @parse_url( get_option( 'home' ) );
@@ -473,8 +474,7 @@ function wp_http_validate_url( $url ) {
 		}
 		if ( $ip ) {
 			$parts = array_map( 'intval', explode( '.', $ip ) );
-			if ( '127.0.0.1' === $ip
-				|| ( 10 === $parts[0] )
+			if ( 127 === $parts[0] || 10 === $parts[0]
 				|| ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
 				|| ( 192 === $parts[0] && 168 === $parts[1] )
 			) {
--- a/wp-includes/js/media-grid.js
+++ b/wp-includes/js/media-grid.js
@@ -577,10 +577,11 @@
 			return ( this.getCurrentIndex() - 1 ) > -1;
 		},
 		/**
-		 * Respond to the keyboard events: right arrow, left arrow, escape.
+		 * Respond to the keyboard events: right arrow, left arrow, except when
+		 * focus is in a textarea or input field.
 		 */
 		keyEvent: function( event ) {
-			if ( 'INPUT' === event.target.tagName && ! ( event.target.readOnly || event.target.disabled ) ) {
+			if ( ( 'INPUT' === event.target.nodeName || 'TEXTAREA' === event.target.nodeName ) && ! ( event.target.readOnly || event.target.disabled ) ) {
 				return;
 			}

--- a/wp-includes/js/media-grid.min.js
+++ b/wp-includes/js/media-grid.min.js
--- a/wp-includes/js/media-views.js
+++ b/wp-includes/js/media-views.js
@@ -5850,7 +5850,7 @@
 					controller: this.controller,
 					priority: -60,
 					click: function() {
-						var model, changed = [], self = this,
+						var changed = [], removed = [], self = this,
 							selection = this.controller.state().get( 'selection' ),
 							library = this.controller.state().get( 'library' );

@@ -5869,22 +5869,28 @@
 							return;
 						}

-						while ( selection.length > 0 ) {
-							model = selection.at( 0 );
+						selection.each( function( model ) {
+							if ( ! model.get( 'nonces' )['delete'] ) {
+								removed.push( model );
+								return;
+							}
+
 							if ( media.view.settings.mediaTrash && 'trash' === model.get( 'status' ) ) {
 								model.set( 'status', 'inherit' );
 								changed.push( model.save() );
-								selection.remove( model );
+								removed.push( model );
 							} else if ( media.view.settings.mediaTrash ) {
 								model.set( 'status', 'trash' );
 								changed.push( model.save() );
-								selection.remove( model );
+								removed.push( model );
 							} else {
 								model.destroy();
 							}
-						}
+						} );

 						if ( changed.length ) {
+							selection.remove( removed );
+
 							$.when.apply( null, changed ).then( function() {
 								library._requery( true );
 								self.controller.trigger( 'selection:action:done' );
--- a/wp-includes/js/media-views.min.js
+++ b/wp-includes/js/media-views.min.js
--- a/wp-includes/js/mediaelement/flashmediaelement.swf
+++ b/wp-includes/js/mediaelement/flashmediaelement.swf
--- a/wp-includes/js/mediaelement/mediaelement-and-player.min.js
+++ b/wp-includes/js/mediaelement/mediaelement-and-player.min.js
@@ -10,7 +10,7 @@
 * Copyright 2010-2014, John Dyer (http://j.hn)
 * License: MIT
 *
-*/var mejs=mejs||{};mejs.version="2.15.0";mejs.meIndex=0;
+*/var mejs=mejs||{};mejs.version="2.15.1";mejs.meIndex=0;
 mejs.plugins={silverlight:[{version:[3,0],types:["video/mp4","video/m4v","video/mov","video/wmv","audio/wma","audio/m4a","audio/mp3","audio/wav","audio/mpeg"]}],flash:[{version:[9,0,124],types:["video/mp4","video/m4v","video/mov","video/flv","video/rtmp","video/x-flv","audio/flv","audio/x-flv","audio/mp3","audio/m4a","audio/mpeg","video/youtube","video/x-youtube","application/x-mpegURL"]}],youtube:[{version:null,types:["video/youtube","video/x-youtube","audio/youtube","audio/x-youtube"]}],vimeo:[{version:null,
 types:["video/vimeo","video/x-vimeo"]}]};
 mejs.Utility={encodeUrl:function(a){return encodeURIComponent(a)},escapeHTML:function(a){return a.toString().split("&").join("&amp;").split("<").join("&lt;").split('"').join("&quot;")},absolutizeUrl:function(a){var b=document.createElement("div");b.innerHTML='<a href="'+this.escapeHTML(a)+'">x</a>';return b.firstChild.href},getScriptPath:function(a){for(var b=0,c,d="",e="",g,f,i=document.getElementsByTagName("script"),k=i.length,h=a.length;b<k;b++){g=i[b].src;c=g.lastIndexOf("/");if(c>-1){f=g.substring(c+
@@ -101,21 +101,20 @@ c.hideControls(false);d&&!c.options.alwaysShowControls&&c.hideControls();c.optio
 c.options.pauseOtherPlayers&&!m.paused&&!m.ended&&m.pause();m.hasFocus=false}c.hasFocus=true},false);c.media.addEventListener("ended",function(){if(c.options.autoRewind)try{c.media.setCurrentTime(0)}catch(j){}c.media.pause();c.setProgressRail&&c.setProgressRail();c.setCurrentRail&&c.setCurrentRail();if(c.options.loop)c.play();else!c.options.alwaysShowControls&&c.controlsEnabled&&c.showControls()},false);c.media.addEventListener("loadedmetadata",function(){c.updateDuration&&c.updateDuration();c.updateCurrent&&
 c.updateCurrent();if(!c.isFullScreen){c.setPlayerSize(c.width,c.height);c.setControlsSize()}},false);setTimeout(function(){c.setPlayerSize(c.width,c.height);c.setControlsSize()},50);c.globalBind("resize",function(){c.isFullScreen||mejs.MediaFeatures.hasTrueNativeFullScreen&&document.webkitIsFullScreen||c.setPlayerSize(c.width,c.height);c.setControlsSize()});c.media.pluginType=="youtube"&&c.options.autoplay&&c.container.find(".mejs-overlay-play").hide()}d&&a.pluginType=="native"&&c.play();if(c.options.success)typeof c.options.success==
 "string"?window[c.options.success](c.media,c.domNode,c):c.options.success(c.media,c.domNode,c)}},handleError:function(a){this.controls.hide();this.options.error&&this.options.error(a)},setPlayerSize:function(a,b){if(!this.options.setDimensions)return false;if(typeof a!="undefined")this.width=a;if(typeof b!="undefined")this.height=b;if(this.height.toString().indexOf("%")>0||this.$node.css("max-width")==="100%"||this.$node[0].currentStyle&&this.$node[0].currentStyle.maxWidth==="100%"){var c=this.isVideo?
-this.media.videoWidth&&this.media.videoWidth>0?this.media.videoWidth:this.media.getAttribute("width")!==null?this.media.getAttribute("width"):this.options.defaultVideoWidth:this.options.defaultAudioHeight,e=this.isVideo?this.media.videoHeight&&this.media.videoHeight>0?this.media.videoHeight:this.media.getAttribute("height")!==null?this.media.getAttribute("height"):this.options.defaultVideoHeight:this.options.defaultAudioHeight,d=this.container.parent().closest(":visible").width();c=this.isVideo||
-!this.options.autosizeProgress?parseInt(d*e/c,10)>this.container.parent().closest(":visible").height()?this.container.parent().closest(":visible").height():parseInt(d*e/c,10):e;if(isNaN(c))c=this.container.parent().closest(":visible").height();if(this.container.parent()[0].tagName.toLowerCase()==="body"){d=f(window).width();c=f(window).height()}if(c!=0&&d!=0){this.container.width(d).height(c);this.$media.add(this.container.find(".mejs-shim")).width("100%").height("100%");this.isVideo&&this.media.setVideoSize&&
-this.media.setVideoSize(d,c);this.layers.children(".mejs-layer").width("100%").height("100%")}}else{this.container.width(this.width).height(this.height);this.layers.children(".mejs-layer").width(this.width).height(this.height)}d=this.layers.find(".mejs-overlay-play");c=d.find(".mejs-overlay-button");d.height(this.container.height()-this.controls.height());c.css("margin-top","-"+(c.height()/2-this.controls.height()/2).toString()+"px")},setControlsSize:function(){var a=0,b=0,c=this.controls.find(".mejs-time-rail"),
-e=this.controls.find(".mejs-time-total");this.controls.find(".mejs-time-current");this.controls.find(".mejs-time-loaded");var d=c.siblings(),g=d.last(),k=null;if(!(!this.container.is(":visible")||!c.length||!c.is(":visible"))){if(this.options&&!this.options.autosizeProgress)b=parseInt(c.css("width"));if(b===0||!b){d.each(function(){var j=f(this);if(j.css("position")!="absolute"&&j.is(":visible"))a+=f(this).outerWidth(true)});b=this.controls.width()-a-(c.outerWidth(true)-c.width())}do{c.width(b);e.width(b-
-(e.outerWidth(true)-e.width()));if(g.css("position")!="absolute"){k=g.position();b--}}while(k!=null&&k.top>0&&b>0);this.setProgressRail&&this.setProgressRail();this.setCurrentRail&&this.setCurrentRail()}},buildposter:function(a,b,c,e){var d=f('<div class="mejs-poster mejs-layer"></div>').appendTo(c);b=a.$media.attr("poster");if(a.options.poster!=="")b=a.options.poster;b!==""&&b!=null?this.setPoster(b):d.hide();e.addEventListener("play",function(){d.hide()},false);a.options.showPosterWhenEnded&&a.options.autoRewind&&
-e.addEventListener("ended",function(){d.show()},false)},setPoster:function(a){var b=this.container.find(".mejs-poster"),c=b.find("img");if(c.length==0)c=f('<img width="100%" height="100%" />').appendTo(b);c.attr("src",a);b.css({"background-image":"url("+a+")"})},buildoverlays:function(a,b,c,e){var d=this;if(a.isVideo){var g=f('<div class="mejs-overlay mejs-layer"><div class="mejs-overlay-loading"><span></span></div></div>').hide().appendTo(c),k=f('<div class="mejs-overlay mejs-layer"><div class="mejs-overlay-error"></div></div>').hide().appendTo(c),
-j=f('<div class="mejs-overlay mejs-layer mejs-overlay-play"><div class="mejs-overlay-button"></div></div>').appendTo(c).bind("click",function(){d.options.clickToPlayPause&&e.paused&&e.play()});e.addEventListener("play",function(){j.hide();g.hide();b.find(".mejs-time-buffering").hide();k.hide()},false);e.addEventListener("playing",function(){j.hide();g.hide();b.find(".mejs-time-buffering").hide();k.hide()},false);e.addEventListener("seeking",function(){g.show();b.find(".mejs-time-buffering").show()},
-false);e.addEventListener("seeked",function(){g.hide();b.find(".mejs-time-buffering").hide()},false);e.addEventListener("pause",function(){mejs.MediaFeatures.isiPhone||j.show()},false);e.addEventListener("waiting",function(){g.show();b.find(".mejs-time-buffering").show()},false);e.addEventListener("loadeddata",function(){g.show();b.find(".mejs-time-buffering").show()},false);e.addEventListener("canplay",function(){g.hide();b.find(".mejs-time-buffering").hide()},false);e.addEventListener("error",function(){g.hide();
-b.find(".mejs-time-buffering").hide();k.show();k.find("mejs-overlay-error").html("Error loading this resource")},false);e.addEventListener("keydown",function(m){d.onkeydown(a,e,m)},false)}},buildkeyboard:function(a,b,c,e){var d=this;d.globalBind("keydown",function(g){return d.onkeydown(a,e,g)});d.globalBind("click",function(g){a.hasFocus=f(g.target).closest(".mejs-container").length!=0})},onkeydown:function(a,b,c){if(a.hasFocus&&a.options.enableKeyboard)for(var e=0,d=a.options.keyActions.length;e<
-d;e++)for(var g=a.options.keyActions[e],k=0,j=g.keys.length;k<j;k++)if(c.keyCode==g.keys[k]){typeof c.preventDefault=="function"&&c.preventDefault();g.action(a,b,c.keyCode);return false}return true},findTracks:function(){var a=this,b=a.$media.find("track");a.tracks=[];b.each(function(c,e){e=f(e);a.tracks.push({srclang:e.attr("srclang")?e.attr("srclang").toLowerCase():"",src:e.attr("src"),kind:e.attr("kind"),label:e.attr("label")||"",entries:[],isLoaded:false})})},changeSkin:function(a){this.container[0].className=
-"mejs-container "+a;this.setPlayerSize(this.width,this.height);this.setControlsSize()},play:function(){this.load();this.media.play()},pause:function(){try{this.media.pause()}catch(a){}},load:function(){this.isLoaded||this.media.load();this.isLoaded=true},setMuted:function(a){this.media.setMuted(a)},setCurrentTime:function(a){this.media.setCurrentTime(a)},getCurrentTime:function(){return this.media.currentTime},setVolume:function(a){this.media.setVolume(a)},getVolume:function(){return this.media.volume},
-setSrc:function(a){this.media.setSrc(a)},remove:function(){var a,b;for(a in this.options.features){b=this.options.features[a];if(this["clean"+b])try{this["clean"+b](this)}catch(c){}}if(this.isDynamic)this.$node.insertBefore(this.container);else{this.$media.prop("controls",true);this.$node.clone().insertBefore(this.container).show();this.$node.remove()}this.media.pluginType!=="native"&&this.media.remove();delete mejs.players[this.id];typeof this.container=="object"&&this.container.remove();this.globalUnbind();
-delete this.node.player}};(function(){function a(c,e){var d={d:[],w:[]};f.each((c||"").split(" "),function(g,k){var j=k+"."+e;if(j.indexOf(".")===0){d.d.push(j);d.w.push(j)}else d[b.test(k)?"w":"d"].push(j)});d.d=d.d.join(" ");d.w=d.w.join(" ");return d}var b=/^((after|before)print|(before)?unload|hashchange|message|o(ff|n)line|page(hide|show)|popstate|resize|storage)\b/;mejs.MediaElementPlayer.prototype.globalBind=function(c,e,d){c=a(c,this.id);c.d&&f(document).bind(c.d,e,d);c.w&&f(window).bind(c.w,
-e,d)};mejs.MediaElementPlayer.prototype.globalUnbind=function(c,e){c=a(c,this.id);c.d&&f(document).unbind(c.d,e);c.w&&f(window).unbind(c.w,e)}})();if(typeof f!="undefined"){f.fn.mediaelementplayer=function(a){a===false?this.each(function(){var b=f(this).data("mediaelementplayer");b&&b.remove();f(this).removeData("mediaelementplayer")}):this.each(function(){f(this).data("mediaelementplayer",new mejs.MediaElementPlayer(this,a))});return this};f(document).ready(function(){f(".mejs-player").mediaelementplayer()})}window.MediaElementPlayer=
-mejs.MediaElementPlayer})(mejs.$);
+this.media.videoWidth&&this.media.videoWidth>0?this.media.videoWidth:this.media.getAttribute("width")!==null?this.media.getAttribute("width"):this.options.defaultVideoWidth:this.options.defaultAudioWidth,e=this.isVideo?this.media.videoHeight&&this.media.videoHeight>0?this.media.videoHeight:this.media.getAttribute("height")!==null?this.media.getAttribute("height"):this.options.defaultVideoHeight:this.options.defaultAudioHeight,d=this.container.parent().closest(":visible").width(),g=this.container.parent().closest(":visible").height();
+c=this.isVideo||!this.options.autosizeProgress?parseInt(d*e/c,10):e;if(isNaN(c)||g!=0&&c>g)c=g;if(this.container.parent()[0].tagName.toLowerCase()==="body"){d=f(window).width();c=f(window).height()}if(c!=0&&d!=0){this.container.width(d).height(c);this.$media.add(this.container.find(".mejs-shim")).width("100%").height("100%");this.isVideo&&this.media.setVideoSize&&this.media.setVideoSize(d,c);this.layers.children(".mejs-layer").width("100%").height("100%")}}else{this.container.width(this.width).height(this.height);
+this.layers.children(".mejs-layer").width(this.width).height(this.height)}d=this.layers.find(".mejs-overlay-play");g=d.find(".mejs-overlay-button");d.height(this.container.height()-this.controls.height());g.css("margin-top","-"+(g.height()/2-this.controls.height()/2).toString()+"px")},setControlsSize:function(){var a=0,b=0,c=this.controls.find(".mejs-time-rail"),e=this.controls.find(".mejs-time-total");this.controls.find(".mejs-time-current");this.controls.find(".mejs-time-loaded");var d=c.siblings(),
+g=d.last(),k=null;if(!(!this.container.is(":visible")||!c.length||!c.is(":visible"))){if(this.options&&!this.options.autosizeProgress)b=parseInt(c.css("width"));if(b===0||!b){d.each(function(){var j=f(this);if(j.css("position")!="absolute"&&j.is(":visible"))a+=f(this).outerWidth(true)});b=this.controls.width()-a-(c.outerWidth(true)-c.width())}do{c.width(b);e.width(b-(e.outerWidth(true)-e.width()));if(g.css("position")!="absolute"){k=g.position();b--}}while(k!=null&&k.top>0&&b>0);this.setProgressRail&&
+this.setProgressRail();this.setCurrentRail&&this.setCurrentRail()}},buildposter:function(a,b,c,e){var d=f('<div class="mejs-poster mejs-layer"></div>').appendTo(c);b=a.$media.attr("poster");if(a.options.poster!=="")b=a.options.poster;b!==""&&b!=null?this.setPoster(b):d.hide();e.addEventListener("play",function(){d.hide()},false);a.options.showPosterWhenEnded&&a.options.autoRewind&&e.addEventListener("ended",function(){d.show()},false)},setPoster:function(a){var b=this.container.find(".mejs-poster"),
+c=b.find("img");if(c.length==0)c=f('<img width="100%" height="100%" />').appendTo(b);c.attr("src",a);b.css({"background-image":"url("+a+")"})},buildoverlays:function(a,b,c,e){var d=this;if(a.isVideo){var g=f('<div class="mejs-overlay mejs-layer"><div class="mejs-overlay-loading"><span></span></div></div>').hide().appendTo(c),k=f('<div class="mejs-overlay mejs-layer"><div class="mejs-overlay-error"></div></div>').hide().appendTo(c),j=f('<div class="mejs-overlay mejs-layer mejs-overlay-play"><div class="mejs-overlay-button"></div></div>').appendTo(c).bind("click",
+function(){d.options.clickToPlayPause&&e.paused&&e.play()});e.addEventListener("play",function(){j.hide();g.hide();b.find(".mejs-time-buffering").hide();k.hide()},false);e.addEventListener("playing",function(){j.hide();g.hide();b.find(".mejs-time-buffering").hide();k.hide()},false);e.addEventListener("seeking",function(){g.show();b.find(".mejs-time-buffering").show()},false);e.addEventListener("seeked",function(){g.hide();b.find(".mejs-time-buffering").hide()},false);e.addEventListener("pause",function(){mejs.MediaFeatures.isiPhone||
+j.show()},false);e.addEventListener("waiting",function(){g.show();b.find(".mejs-time-buffering").show()},false);e.addEventListener("loadeddata",function(){g.show();b.find(".mejs-time-buffering").show()},false);e.addEventListener("canplay",function(){g.hide();b.find(".mejs-time-buffering").hide()},false);e.addEventListener("error",function(){g.hide();b.find(".mejs-time-buffering").hide();k.show();k.find("mejs-overlay-error").html("Error loading this resource")},false);e.addEventListener("keydown",
+function(m){d.onkeydown(a,e,m)},false)}},buildkeyboard:function(a,b,c,e){var d=this;d.globalBind("keydown",function(g){return d.onkeydown(a,e,g)});d.globalBind("click",function(g){a.hasFocus=f(g.target).closest(".mejs-container").length!=0})},onkeydown:function(a,b,c){if(a.hasFocus&&a.options.enableKeyboard)for(var e=0,d=a.options.keyActions.length;e<d;e++)for(var g=a.options.keyActions[e],k=0,j=g.keys.length;k<j;k++)if(c.keyCode==g.keys[k]){typeof c.preventDefault=="function"&&c.preventDefault();
+g.action(a,b,c.keyCode);return false}return true},findTracks:function(){var a=this,b=a.$media.find("track");a.tracks=[];b.each(function(c,e){e=f(e);a.tracks.push({srclang:e.attr("srclang")?e.attr("srclang").toLowerCase():"",src:e.attr("src"),kind:e.attr("kind"),label:e.attr("label")||"",entries:[],isLoaded:false})})},changeSkin:function(a){this.container[0].className="mejs-container "+a;this.setPlayerSize(this.width,this.height);this.setControlsSize()},play:function(){this.load();this.media.play()},
+pause:function(){try{this.media.pause()}catch(a){}},load:function(){this.isLoaded||this.media.load();this.isLoaded=true},setMuted:function(a){this.media.setMuted(a)},setCurrentTime:function(a){this.media.setCurrentTime(a)},getCurrentTime:function(){return this.media.currentTime},setVolume:function(a){this.media.setVolume(a)},getVolume:function(){return this.media.volume},setSrc:function(a){this.media.setSrc(a)},remove:function(){var a,b;for(a in this.options.features){b=this.options.features[a];if(this["clean"+
+b])try{this["clean"+b](this)}catch(c){}}if(this.isDynamic)this.$node.insertBefore(this.container);else{this.$media.prop("controls",true);this.$node.clone().insertBefore(this.container).show();this.$node.remove()}this.media.pluginType!=="native"&&this.media.remove();delete mejs.players[this.id];typeof this.container=="object"&&this.container.remove();this.globalUnbind();delete this.node.player}};(function(){function a(c,e){var d={d:[],w:[]};f.each((c||"").split(" "),function(g,k){var j=k+"."+e;if(j.indexOf(".")===
+0){d.d.push(j);d.w.push(j)}else d[b.test(k)?"w":"d"].push(j)});d.d=d.d.join(" ");d.w=d.w.join(" ");return d}var b=/^((after|before)print|(before)?unload|hashchange|message|o(ff|n)line|page(hide|show)|popstate|resize|storage)\b/;mejs.MediaElementPlayer.prototype.globalBind=function(c,e,d){c=a(c,this.id);c.d&&f(document).bind(c.d,e,d);c.w&&f(window).bind(c.w,e,d)};mejs.MediaElementPlayer.prototype.globalUnbind=function(c,e){c=a(c,this.id);c.d&&f(document).unbind(c.d,e);c.w&&f(window).unbind(c.w,e)}})();
+if(typeof f!="undefined"){f.fn.mediaelementplayer=function(a){a===false?this.each(function(){var b=f(this).data("mediaelementplayer");b&&b.remove();f(this).removeData("mediaelementplayer")}):this.each(function(){f(this).data("mediaelementplayer",new mejs.MediaElementPlayer(this,a))});return this};f(document).ready(function(){f(".mejs-player").mediaelementplayer()})}window.MediaElementPlayer=mejs.MediaElementPlayer})(mejs.$);
 (function(f){f.extend(mejs.MepDefaults,{playpauseText:mejs.i18n.t("Play/Pause")});f.extend(MediaElementPlayer.prototype,{buildplaypause:function(a,b,c,e){var d=f('<div class="mejs-button mejs-playpause-button mejs-play" ><button type="button" aria-controls="'+this.id+'" title="'+this.options.playpauseText+'" aria-label="'+this.options.playpauseText+'"></button></div>').appendTo(b).click(function(g){g.preventDefault();e.paused?e.play():e.pause();return false});e.addEventListener("play",function(){d.removeClass("mejs-play").addClass("mejs-pause")},
 false);e.addEventListener("playing",function(){d.removeClass("mejs-play").addClass("mejs-pause")},false);e.addEventListener("pause",function(){d.removeClass("mejs-pause").addClass("mejs-play")},false);e.addEventListener("paused",function(){d.removeClass("mejs-pause").addClass("mejs-play")},false)}})})(mejs.$);
 (function(f){f.extend(mejs.MepDefaults,{stopText:"Stop"});f.extend(MediaElementPlayer.prototype,{buildstop:function(a,b,c,e){f('<div class="mejs-button mejs-stop-button mejs-stop"><button type="button" aria-controls="'+this.id+'" title="'+this.options.stopText+'" aria-label="'+this.options.stopText+'"></button></div>').appendTo(b).click(function(){e.paused||e.pause();if(e.currentTime>0){e.setCurrentTime(0);e.pause();b.find(".mejs-time-current").width("0px");b.find(".mejs-time-handle").css("left",
@@ -149,7 +148,7 @@ setTimeout(c,500)}},500)}else if(mejs.MediaFeatures.hasSemiNativeFullScreen){a.m
 a.fullscreenBtn&&a.fullscreenBtn.removeClass("mejs-fullscreen").addClass("mejs-unfullscreen");a.setControlsSize();a.isFullScreen=true;a.container.find(".mejs-captions-text").css("font-size",screen.width/a.width*1*100+"%");a.container.find(".mejs-captions-position").css("bottom","45px")}},exitFullScreen:function(){clearTimeout(this.containerSizeTimeout);if(this.media.pluginType!=="native"&&mejs.MediaFeatures.isFirefox)this.media.setFullscreen(false);else{if(mejs.MediaFeatures.hasTrueNativeFullScreen&&
 (mejs.MediaFeatures.isFullScreen()||this.isFullScreen))mejs.MediaFeatures.cancelFullScreen();f(document.documentElement).removeClass("mejs-fullscreen");this.container.removeClass("mejs-container-fullscreen").width(normalWidth).height(normalHeight);if(this.media.pluginType==="native")this.$media.width(normalWidth).height(normalHeight);else{this.container.find(".mejs-shim").width(normalWidth).height(normalHeight);this.media.setVideoSize(normalWidth,normalHeight)}this.layers.children("div").width(normalWidth).height(normalHeight);
 this.fullscreenBtn.removeClass("mejs-unfullscreen").addClass("mejs-fullscreen");this.setControlsSize();this.isFullScreen=false;this.container.find(".mejs-captions-text").css("font-size","");this.container.find(".mejs-captions-position").css("bottom","")}}})})(mejs.$);
-(function(f){f.extend(mejs.MepDefaults,{speeds:["1.50","1.25","1.00","0.75"],defaultSpeed:"1.00"});f.extend(MediaElementPlayer.prototype,{buildspeed:function(a,b,c,e){if(a.isVideo)if(this.media.pluginType=="native"){c='<div class="mejs-button mejs-speed-button"><button type="button">'+this.options.defaultSpeed+'x</button><div class="mejs-speed-selector"><ul>';var d;f.inArray(this.options.defaultSpeed,this.options.speeds)===-1&&this.options.speeds.push(this.options.defaultSpeed);this.options.speeds.sort(function(g,
+(function(f){f.extend(mejs.MepDefaults,{speeds:["1.50","1.25","1.00","0.75"],defaultSpeed:"1.00"});f.extend(MediaElementPlayer.prototype,{buildspeed:function(a,b,c,e){if(this.media.pluginType=="native"){c='<div class="mejs-button mejs-speed-button"><button type="button">'+this.options.defaultSpeed+'x</button><div class="mejs-speed-selector"><ul>';var d;f.inArray(this.options.defaultSpeed,this.options.speeds)===-1&&this.options.speeds.push(this.options.defaultSpeed);this.options.speeds.sort(function(g,
 k){return parseFloat(k)-parseFloat(g)});for(d=0;d<this.options.speeds.length;d++){c+='<li><input type="radio" name="speed" value="'+this.options.speeds[d]+'" id="'+this.options.speeds[d]+'" ';if(this.options.speeds[d]==this.options.defaultSpeed){c+="checked=true ";c+='/><label for="'+this.options.speeds[d]+'" class="mejs-speed-selected">'+this.options.speeds[d]+"x</label></li>"}else c+='/><label for="'+this.options.speeds[d]+'">'+this.options.speeds[d]+"x</label></li>"}c+="</ul></div></div>";a.speedButton=
 f(c).appendTo(b);a.playbackspeed=this.options.defaultSpeed;a.speedButton.on("click","input[type=radio]",function(){a.playbackspeed=f(this).attr("value");e.playbackRate=parseFloat(a.playbackspeed);a.speedButton.find("button").text(a.playbackspeed+"x");a.speedButton.find(".mejs-speed-selected").removeClass("mejs-speed-selected");a.speedButton.find("input[type=radio]:checked").next().addClass("mejs-speed-selected")});b=a.speedButton.find(".mejs-speed-selector");b.height(this.speedButton.find(".mejs-speed-selector ul").outerHeight(true)+
 a.speedButton.find(".mejs-speed-translations").outerHeight(true));b.css("top",-1*b.height()+"px")}}})})(mejs.$);
--- a/wp-includes/js/plupload/plupload.flash.swf
+++ b/wp-includes/js/plupload/plupload.flash.swf
--- a/wp-includes/js/quicktags.js
+++ b/wp-includes/js/quicktags.js
@@ -384,10 +384,10 @@ function edButton(id, display, tagStart, tagEnd, access) {

 			canvas.value = text.substring(0, startPos) + content + text.substring(endPos, text.length);

-			canvas.focus();
 			canvas.selectionStart = startPos + content.length;
 			canvas.selectionEnd = startPos + content.length;
 			canvas.scrollTop = scrollTop;
+			canvas.focus();
 		} else {
 			canvas.value += content;
 			canvas.focus();
@@ -509,10 +509,10 @@ function edButton(id, display, tagStart, tagEnd, access) {
 				}
 			}

-			canvas.focus();
 			canvas.selectionStart = cursorPos;
 			canvas.selectionEnd = cursorPos;
 			canvas.scrollTop = scrollTop;
+			canvas.focus();
 		} else { // other browsers?
 			if ( !endTag ) {
 				canvas.value += t.tagStart;
--- a/wp-includes/js/quicktags.min.js
+++ b/wp-includes/js/quicktags.min.js
--- a/wp-includes/js/tinymce/plugins/wpeditimage/plugin.js
+++ b/wp-includes/js/tinymce/plugins/wpeditimage/plugin.js
@@ -1,6 +1,7 @@
 /* global tinymce */
 tinymce.PluginManager.add( 'wpeditimage', function( editor ) {
-	var toolbarActive = false,
+	var serializer,
+		toolbarActive = false,
 		editingImage = false;

 	function parseShortcode( content ) {
@@ -82,7 +83,7 @@ tinymce.PluginManager.add( 'wpeditimage', function( editor ) {
 				return '';
 			}

-			out = b.replace( /<dl ([^>]+)>\s*<dt [^>]+>([\s\S]+?)<\/dt>\s*<dd [^>]+>([\s\S]*?)<\/dd>\s*<\/dl>/gi, function( a, b, c, caption ) {
+			out = b.replace( /\s*<dl ([^>]+)>\s*<dt [^>]+>([\s\S]+?)<\/dt>\s*<dd [^>]+>([\s\S]*?)<\/dd>\s*<\/dl>\s*/gi, function( a, b, c, caption ) {
 				var id, classes, align, width;

 				width = c.match( /width="([0-9]*)"/ );
@@ -116,7 +117,7 @@ tinymce.PluginManager.add( 'wpeditimage', function( editor ) {
 				return '[caption id="' + id + '" align="' + align + '" width="' + width + '"' + classes + ']' + c + ' ' + caption + '[/caption]';
 			});

-			if ( out.indexOf('[caption') !== 0 ) {
+			if ( out.indexOf('[caption') === -1 ) {
 				// the caption html seems broken, try to find the image that may be wrapped in a link
 				// and may be followed by <p> with the caption text.
 				out = b.replace( /[\s\S]*?((?:<a [^>]+>)?<img [^>]+>(?:<\/a>)?)(<p>[\s\S]*<\/p>)?[\s\S]*/gi, '<p>$1</p>$2' );
@@ -226,6 +227,19 @@ tinymce.PluginManager.add( 'wpeditimage', function( editor ) {
 		return node && !! ( node.textContent || node.innerText );
 	}

+	// Verify HTML in captions
+	function verifyHTML( caption ) {
+		if ( ! caption || ( caption.indexOf( '<' ) === -1 && caption.indexOf( '>' ) === -1 ) ) {
+			return caption;
+		}
+
+		if ( ! serializer ) {
+			serializer = new tinymce.html.Serializer( {}, editor.schema );
+		}
+
+		return serializer.serialize( editor.parser.parse( caption, { forced_root_block: false } ) );
+	}
+
 	function updateImage( imageNode, imageData ) {
 		var classes, className, node, html, parent, wrap, linkNode,
 			captionNode, dd, dl, id, attrs, linkAttrs, width, height, align,
@@ -303,6 +317,7 @@ tinymce.PluginManager.add( 'wpeditimage', function( editor ) {
 		}

 		if ( imageData.caption ) {
+			imageData.caption = verifyHTML( imageData.caption );

 			id = imageData.attachment_id ? 'attachment_' + imageData.attachment_id : null;
 			align = 'align' + ( imageData.align || 'none' );
@@ -645,6 +660,7 @@ tinymce.PluginManager.add( 'wpeditimage', function( editor ) {

 				// Convert remaining line breaks to <br>
 				caption = caption.replace( /(<br[^>]*>)\s*\n\s*/g, '$1' ).replace( /\s*\n\s*/g, '<br />' );
+				caption = verifyHTML( caption );
 			}

 			if ( ! imgNode ) {
--- a/wp-includes/js/tinymce/plugins/wpeditimage/plugin.min.js
+++ b/wp-includes/js/tinymce/plugins/wpeditimage/plugin.min.js
--- a/wp-includes/js/tinymce/plugins/wpview/plugin.js
+++ b/wp-includes/js/tinymce/plugins/wpview/plugin.js
@@ -12,7 +12,7 @@ tinymce.PluginManager.add( 'wpview', function( editor ) {
 		firstFocus = true,
 		_noop = function() { return false; },
 		isios = /iPad|iPod|iPhone/.test( navigator.userAgent ),
-		cursorInterval, lastKeyDownNode, setViewCursorTries, focus, execCommandView;
+		cursorInterval, lastKeyDownNode, setViewCursorTries, focus, execCommandView, execCommandBefore;

 	function getView( node ) {
 		return getParent( node, 'wpview-wrap' );
@@ -368,7 +368,7 @@ tinymce.PluginManager.add( 'wpview', function( editor ) {
 	// Ref: https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent.keyCode
 	function isSpecialKey( key ) {
 		return ( ( key <= 47 && key !== VK.SPACEBAR && key !== VK.ENTER && key !== VK.DELETE && key !== VK.BACKSPACE && ( key < 37 || key > 40 ) ) ||
-			key >= 224 || // OEM or non-printable 
+			key >= 224 || // OEM or non-printable
 			( key >= 144 && key <= 150 ) || // Num Lock, Scroll Lock, OEM
 			( key >= 91 && key <= 93 ) || // Windows keys
 			( key >= 112 && key <= 135 ) ); // F keys
@@ -649,8 +649,8 @@ tinymce.PluginManager.add( 'wpview', function( editor ) {
 		var node = editor.selection.getNode(),
 			view;

-		if ( node && ( node.className === 'wpview-selection-before' || node.className === 'wpview-selection-after' ) && ( view = getView( node ) ) ) {
-			handleEnter( view );
+		if ( node && ( ( execCommandBefore = node.className === 'wpview-selection-before' ) || node.className === 'wpview-selection-after' ) && ( view = getView( node ) ) ) {
+			handleEnter( view, execCommandBefore );
 			execCommandView = view;
 		}
 	});
@@ -665,11 +665,11 @@ tinymce.PluginManager.add( 'wpview', function( editor ) {
 		}

 		if ( execCommandView ) {
-			node = execCommandView.nextSibling;
+			node = execCommandView[ execCommandBefore ? 'previousSibling' : 'nextSibling' ];

 			if ( node && node.nodeName === 'P' && editor.dom.isEmpty( node ) ) {
 				editor.dom.remove( node );
-				setViewCursor( false, execCommandView );
+				setViewCursor( execCommandBefore, execCommandView );
 			}

 			execCommandView = false;
--- a/wp-includes/js/tinymce/plugins/wpview/plugin.min.js
+++ b/wp-includes/js/tinymce/plugins/wpview/plugin.min.js
--- a/wp-includes/js/tinymce/wp-tinymce.js.gz
+++ b/wp-includes/js/tinymce/wp-tinymce.js.gz
--- a/wp-includes/kses.php
+++ b/wp-includes/kses.php
@@ -1440,7 +1440,7 @@ function safecss_filter_attr( $css, $deprecated = '' ) {
 	$css = wp_kses_no_null($css);
 	$css = str_replace(array("\n","\r","\t"), '', $css);

-	if ( preg_match( '%[\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
+	if ( preg_match( '%[\\\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
 		return '';

 	$css_array = explode( ';', trim( $css ) );
--- a/wp-includes/link-template.php
+++ b/wp-includes/link-template.php
@@ -257,10 +257,12 @@ function get_post_permalink( $id = 0, $leavename = false, $sample = false ) {

 	$post_type = get_post_type_object($post->post_type);

+	if ( $post_type->hierarchical ) {
+		$slug = get_page_uri( $id );
+	}
+
 	if ( !empty($post_link) && ( !$draft_or_pending || $sample ) ) {
 		if ( ! $leavename ) {
-			if ( $post_type->hierarchical )
-				$slug = get_page_uri($id);
 			$post_link = str_replace("%$post->post_type%", $slug, $post_link);
 		}
 		$post_link = home_url( user_trailingslashit($post_link) );
@@ -1511,7 +1513,7 @@ function get_adjacent_post( $in_same_term = false, $excluded_terms = '', $previo
 		}

 		if ( ! empty( $excluded_terms ) ) {
-			$where .= " AND p.ID NOT IN ( SELECT object_id FROM $wpdb->term_relationships WHERE term_taxonomy_id IN (" . implode( $excluded_terms, ',' ) . ') )';
+			$where .= " AND p.ID NOT IN ( SELECT tr.object_id FROM $wpdb->term_relationships tr LEFT JOIN $wpdb->term_taxonomy tt ON (tr.term_taxonomy_id = tt.term_taxonomy_id) WHERE tt.term_id IN (" . implode( $excluded_terms, ',' ) . ') )';
 		}
 	}

--- a/wp-includes/media-template.php
+++ b/wp-includes/media-template.php
@@ -312,7 +312,7 @@ function wp_print_media_templates() {
 				<# } #>

 				<div class="attachment-actions">
-					<# if ( 'image' === data.type && ! data.uploading && data.sizes ) { #>
+					<# if ( 'image' === data.type && ! data.uploading && data.sizes && data.can.save ) { #>
 						<a class="button edit-attachment" href="#"><?php _e( 'Edit Image' ); ?></a>
 					<# } #>
 				</div>
@@ -394,7 +394,7 @@ function wp_print_media_templates() {
 					<span class="name"><?php _e( 'Uploaded By' ); ?></span>
 					<span class="value">{{ data.authorName }}</span>
 				</label>
-				<# if ( data.uploadedTo ) { #>
+				<# if ( data.uploadedToTitle ) { #>
 					<label class="setting">
 						<span class="name"><?php _e( 'Uploaded To' ); ?></span>
 						<# if ( data.uploadedToLink ) { #>
@@ -408,19 +408,21 @@ function wp_print_media_templates() {
 			</div>

 			<div class="actions">
-				<a class="view-attachment" href="{{ data.link }}"><?php _e( 'View attachment page' ); ?></a> |
-				<a href="post.php?post={{ data.id }}&action=edit"><?php _e( 'Edit more details' ); ?></a>
+				<a class="view-attachment" href="{{ data.link }}"><?php _e( 'View attachment page' ); ?></a>
+				<# if ( data.can.save ) { #> |
+					<a href="post.php?post={{ data.id }}&action=edit"><?php _e( 'Edit more details' ); ?></a>
+				<# } #>
 				<# if ( ! data.uploading && data.can.remove ) { #> |
-						<?php if ( MEDIA_TRASH ): ?>
+					<?php if ( MEDIA_TRASH ): ?>
 						<# if ( 'trash' === data.status ) { #>
 							<a class="untrash-attachment" href="#"><?php _e( 'Untrash' ); ?></a>
 						<# } else { #>
 							<a class="trash-attachment" href="#"><?php _e( 'Trash' ); ?></a>
 						<# } #>
-						<?php else: ?>
-							<a class="delete-attachment" href="#"><?php _e( 'Delete Permanently' ); ?></a>
-						<?php endif; ?>
-					<# } #>
+					<?php else: ?>
+						<a class="delete-attachment" href="#"><?php _e( 'Delete Permanently' ); ?></a>
+					<?php endif; ?>
+				<# } #>
 			</div>

 		</div>
--- a/wp-includes/media.php
+++ b/wp-includes/media.php
@@ -1247,6 +1247,10 @@ function wp_playlist_shortcode( $attr ) {
 		$atts['orderby'] = 'none';
 	}

+	if ( $atts['type'] !== 'audio' ) {
+		$atts['type'] = 'video';
+	}
+
 	$args = array(
 		'post_status' => 'inherit',
 		'post_type' => 'attachment',
@@ -1596,8 +1600,8 @@ function wp_audio_shortcode( $attr, $content = '' ) {
 	$html_atts = array(
 		'class'    => apply_filters( 'wp_audio_shortcode_class', 'wp-audio-shortcode' ),
 		'id'       => sprintf( 'audio-%d-%d', $post_id, $instances ),
-		'loop'     => $atts['loop'],
-		'autoplay' => $atts['autoplay'],
+		'loop'     => wp_validate_boolean( $atts['loop'] ),
+		'autoplay' => wp_validate_boolean( $atts['autoplay'] ),
 		'preload'  => $atts['preload'],
 		'style'    => 'width: 100%; visibility: hidden;',
 	);
@@ -1822,8 +1826,8 @@ function wp_video_shortcode( $attr, $content = '' ) {
 		'width'    => absint( $atts['width'] ),
 		'height'   => absint( $atts['height'] ),
 		'poster'   => esc_url( $atts['poster'] ),
-		'loop'     => $atts['loop'],
-		'autoplay' => $atts['autoplay'],
+		'loop'     => wp_validate_boolean( $atts['loop'] ),
+		'autoplay' => wp_validate_boolean( $atts['autoplay'] ),
 		'preload'  => $atts['preload'],
 	);

@@ -2643,6 +2647,11 @@ function wp_prepare_attachment_for_js( $attachment ) {

 	if ( $attachment->post_parent ) {
 		$post_parent = get_post( $attachment->post_parent );
+	} else {
+		$post_parent = false;
+	}
+
+	if ( $post_parent ) {
 		$parent_type = get_post_type_object( $post_parent->post_type );
 		if ( $parent_type && $parent_type->show_ui && current_user_can( 'edit_post', $attachment->post_parent ) ) {
 			$response['uploadedToLink'] = get_edit_post_link( $attachment->post_parent, 'raw' );
--- a/wp-includes/ms-functions.php
+++ b/wp-includes/ms-functions.php
@@ -1379,7 +1379,9 @@ function install_blog( $blog_id, $blog_title = '' ) {
 	make_db_current_silent( 'blog' );
 	populate_options();
 	populate_roles();
-	$wp_roles->_init();
+
+	// populate_roles() clears previous role definitions so we start over.
+	$wp_roles = new WP_Roles();

 	$url = untrailingslashit( $url );

--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -669,7 +669,10 @@ function wp_validate_auth_cookie($cookie = '', $scheme = '') {
 	$pass_frag = substr($user->user_pass, 8, 4);

 	$key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
-	$hash = hash_hmac( 'sha256', $username . '|' . $expiration . '|' . $token, $key );
+
+	// If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
+	$algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
+	$hash = hash_hmac( $algo, $username . '|' . $expiration . '|' . $token, $key );

 	if ( ! hash_equals( $hash, $hmac ) ) {
 		/**
@@ -734,7 +737,10 @@ function wp_generate_auth_cookie( $user_id, $expiration, $scheme = 'auth', $toke
 	$pass_frag = substr($user->user_pass, 8, 4);

 	$key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );
-	$hash = hash_hmac( 'sha256', $user->user_login . '|' . $expiration . '|' . $token, $key );
+
+	// If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
+	$algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
+	$hash = hash_hmac( $algo, $user->user_login . '|' . $expiration . '|' . $token, $key );

 	$cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;

@@ -1933,7 +1939,7 @@ function wp_check_password($password, $hash, $user_id = '') {

 	// If the hash is still md5...
 	if ( strlen($hash) <= 32 ) {
-		$check = ( $hash == md5($password) );
+		$check = hash_equals( $hash, md5( $password ) );
 		if ( $check && $user_id ) {
 			// Rehash using new hash.
 			wp_set_password($password, $user_id);
--- a/wp-includes/post.php
+++ b/wp-includes/post.php
@@ -4719,10 +4719,15 @@ function is_local_attachment($url) {
 function wp_insert_attachment( $args, $file = false, $parent = 0 ) {
 	$defaults = array(
 		'file'        => $file,
-		'post_parent' => $parent
+		'post_parent' => 0
 	);
+
 	$data = wp_parse_args( $args, $defaults );

+	if ( ! empty( $parent ) ) {
+		$data['post_parent'] = $parent;
+	}
+
 	$data['post_type'] = 'attachment';

 	return wp_insert_post( $data );
--- a/wp-includes/session.php
+++ b/wp-includes/session.php
@@ -61,7 +61,12 @@ abstract class WP_Session_Tokens {
 	 * @return string A hash of the session token (a verifier).
 	 */
 	final private function hash_token( $token ) {
-		return hash( 'sha256', $token );
+		// If ext/hash is not present, use sha1() instead.
+		if ( function_exists( 'hash' ) ) {
+			return hash( 'sha256', $token );
+		} else {
+			return sha1( $token );
+		}
 	}

 	/**
--- a/wp-includes/user.php
+++ b/wp-includes/user.php
@@ -1818,6 +1818,9 @@ function wp_insert_user( $userdata ) {
 	$data = wp_unslash( $compacted );

 	if ( $update ) {
+		if ( $user_email !== $old_user_data->user_email ) {
+			$data['user_activation_key'] = '';
+		}
 		$wpdb->update( $wpdb->users, $data, compact( 'ID' ) );
 		$user_id = (int) $ID;
 	} else {
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,14 +4,14 @@
 *
 * @global string $wp_version
 */
-$wp_version = '4.0';
+$wp_version = '4.0.4';

 /**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
 *
 * @global int $wp_db_version
 */
-$wp_db_version = 29630;
+$wp_db_version = 29631;

 /**
 * Holds the TinyMCE version
--- a/wp-includes/wp-db.php
+++ b/wp-includes/wp-db.php
--- a/wp-login.php
+++ b/wp-login.php
@@ -571,6 +571,9 @@ case 'rp' :
 	if ( isset( $_COOKIE[ $rp_cookie ] ) && 0 < strpos( $_COOKIE[ $rp_cookie ], ':' ) ) {
 		list( $rp_login, $rp_key ) = explode( ':', wp_unslash( $_COOKIE[ $rp_cookie ] ), 2 );
 		$user = check_password_reset_key( $rp_key, $rp_login );
+		if ( isset( $_POST['pass1'] ) && ! hash_equals( $rp_key, $_POST['rp_key'] ) ) {
+			$user = false;
+		}
 	} else {
 		$user = false;
 	}
@@ -640,6 +643,7 @@ case 'rp' :
 	 */
 	do_action( 'resetpass_form', $user );
 	?>
+	<input type="hidden" name="rp_key" value="<?php echo esc_attr( $rp_key ); ?>" />
 	<p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e('Reset Password'); ?>" /></p>
 </form>
Author	SHA1	Message	Date
Helen Hou-Sandí	048f3e757b	Tag 4.0.4. Built from https://develop.svn.wordpress.org/@32321 git-svn-id: http://core.svn.wordpress.org/tags/4.0.4@32292 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-27 18:56:43 +00:00
Gary Pendergast	4fe0310d7a	4.0: - WPDB: Sanity check that any strings being stored in the DB are not too long to store correctly. - When upgrading, remove any suspicious comments. Built from https://develop.svn.wordpress.org/branches/4.0@32313 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32284 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-27 17:17:37 +00:00
Gary Pendergast	4b6fa85282	4.0 branch is now 4.0.4. Built from https://develop.svn.wordpress.org/branches/4.0@32302 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32273 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-27 14:11:37 +00:00
Helen Hou-Sandí	8254664893	The 4.0 branch is now 4.0.3. Built from https://develop.svn.wordpress.org/branches/4.0@32283 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32254 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-23 21:35:37 +00:00
Gary Pendergast	488576e125	WPDB: When sanity checking a string by sending it to MySQL for conversion checks, the incorrect data structure was being returned from wpdb::strip_invalid_text(), causing all write queries to fail for some character sets when the query contained non-ASCII characters. Merge of [32261] to the 4.0 branch. See #32051. Built from https://develop.svn.wordpress.org/branches/4.0@32272 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32243 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-23 11:44:39 +00:00
Gary Pendergast	e20485b9cb	WPDB: When deciding if a query needs extra sanity checking based on collation, return early when we can. Merges [32232] and [32233] to the 4.0 branch. See #32029. Built from https://develop.svn.wordpress.org/branches/4.0@32235 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32209 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-21 06:19:40 +00:00
Gary Pendergast	530a462ba1	Fix some `wpdb::check_safe_collation()` calls missed in [32181]. Built from https://develop.svn.wordpress.org/branches/4.0@32225 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32199 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 19:06:42 +00:00
Gary Pendergast	d4d995bb8e	Bump 4.0 branch to 4.0.2. Built from https://develop.svn.wordpress.org/branches/4.0@32219 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32193 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 17:40:10 +00:00
Gary Pendergast	7c0efb9bd2	4.0: Update about.php. Built from https://develop.svn.wordpress.org/branches/4.0@32218 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32192 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 17:39:35 +00:00
Gary Pendergast	26e7a95cf3	Ensure post titles are correctly escaped on the Dashboard. Merge of [32175] to the 4.0 branch. Props helen, ocean90, dd32, pento. Built from https://develop.svn.wordpress.org/branches/4.0@32203 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32176 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 13:36:34 +00:00
Gary Pendergast	2af7429643	In Multisite, prevent plugins from unintentionally switching sites. Merge of [32173] to the 4.0 branch. Props mdawaffe, pento. Built from https://develop.svn.wordpress.org/branches/4.0@32199 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32172 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 13:20:36 +00:00
Gary Pendergast	c5dbb01a4c	Update the Plupload Flash file to the latest version. Merge of [32168] to the 4.0 branch. Props azaozz. Built from https://develop.svn.wordpress.org/branches/4.0@32197 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32170 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 13:04:35 +00:00
Gary Pendergast	766a6f6fa1	Remove some old backwards compatibility code from TinyMCE. Merge of [32166] to the 4.0 branch. Props azaozz. Built from https://develop.svn.wordpress.org/branches/4.0@32193 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32166 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 12:49:33 +00:00
Gary Pendergast	3170d00fa6	Clean up some edge cases in `sanitize_sql_orderby()`. Merge of [32164] to the 4.0 branch. Props vortfu, dd32. Built from https://develop.svn.wordpress.org/branches/4.0@32189 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32162 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 12:32:39 +00:00
Gary Pendergast	55be6d3e44	`wpdb::$checking_collation` was incorrectly marked as `protected` instead of `private` in [32181]. Built from https://develop.svn.wordpress.org/branches/4.0@32184 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32157 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 11:21:35 +00:00
Gary Pendergast	548201e950	Merge the query sanity checks from #21212 to the 4.0 branch. Props pento, nacin, mdawaffe, DrewAPicture. Built from https://develop.svn.wordpress.org/branches/4.0@32181 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32154 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 10:54:40 +00:00
Gary Pendergast	d114ee8600	4.0: Bump package.json, readme.html and license.txt. Built from https://develop.svn.wordpress.org/branches/4.0@32154 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32129 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 03:36:39 +00:00
Gary Pendergast	285af6e86c	The 4.0 branch is now 4.0.2-alpha. Built from https://develop.svn.wordpress.org/branches/4.0@32153 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32128 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-20 03:34:41 +00:00
Gary Pendergast	be559a4584	Backport the PHPUnit test fixes from [31622] to the 4.0 branch. Props boonebgorges. See #31537. Built from https://develop.svn.wordpress.org/branches/4.0@32148 git-svn-id: http://core.svn.wordpress.org/branches/4.0@32126 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-04-19 07:43:42 +00:00
Andrew Nacin	3e79a92b69	Update Akismet external in trunk to 3.1. git-svn-id: http://core.svn.wordpress.org/branches/4.0@31771 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2015-03-16 02:08:52 +00:00
Andrew Nacin	e34cfb7c73	Undo changes to the 4.0 branch caused by clean-css 2.2.8 (branch) versus 2.2.16 (trunk). git-svn-id: http://core.svn.wordpress.org/branches/4.0@30472 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 17:41:01 +00:00
Andrew Nacin	d9f6f1c2ea	4.0.1 version bumps. Built from https://develop.svn.wordpress.org/branches/4.0@30475 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30466 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 16:32:32 +00:00
Andrew Nacin	39c7ff2304	Prevent high resource usage when hashing large passwords. props mdawaffe, pento Merges [30466] to the 4.0 branch. Built from https://develop.svn.wordpress.org/branches/4.0@30467 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30458 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 16:05:39 +00:00
Andrew Nacin	6e658f81cf	Validate image data. Merges [30458] to the 4.0 branch. Built from https://develop.svn.wordpress.org/branches/4.0@30462 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30453 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 15:53:38 +00:00
Andrew Nacin	d9cd72430f	Anchor texturize to shortcodes to improve regex efficiency. For the 4.0 branch; see [30449] for trunk. props miqrogroove. see #29557 for segfault issues. Built from https://develop.svn.wordpress.org/branches/4.0@30450 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30444 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 14:30:37 +00:00
Andrew Nacin	be45cc1d6a	Better validation of the URL used in core HTTP requests. Merges [30443] to the 4.0 branch. Built from https://develop.svn.wordpress.org/branches/4.0@30444 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30439 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 14:01:52 +00:00
Andrew Nacin	45ca5407f0	Press This: Ensure the error message is printed. props johnbillion Merges [30438] to the 4.0 branch. Built from https://develop.svn.wordpress.org/branches/4.0@30439 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30434 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 13:58:56 +00:00
Andrew Nacin	50a4318776	TinyMCE: Verify HTML in captions. props azaozz Merges [30435] to the 4.0 branch. Built from https://develop.svn.wordpress.org/branches/4.0@30436 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30431 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 13:50:41 +00:00
Andrew Nacin	65ac1b9a84	Invalidate password keys when a user's email changes. Merges [30430] to the 4.0 branch. Built from https://develop.svn.wordpress.org/branches/4.0@30431 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30426 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 13:40:53 +00:00
Andrew Nacin	5fcfb73bf6	Fix typo in style filter. props miqrogroove Merges [30425] to the 4.0 branch. Built from https://develop.svn.wordpress.org/branches/4.0@30426 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30421 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 13:16:29 +00:00
Andrew Nacin	dd9f42a1f6	Playlists are video by default. props duck_ Merges [30422] to the 4.0 branch. Built from https://develop.svn.wordpress.org/branches/4.0@30423 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30418 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 13:12:31 +00:00
Andrew Nacin	133bfe6a23	Form validation for password resets. Merges [30417] to the 4.0 branch. Built from https://develop.svn.wordpress.org/branches/4.0@30418 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30413 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 12:23:33 +00:00
Andrew Nacin	432912f7e9	Use hash_equals() for old md5 hashes. Merges [30412] to the 4.0 branch. Built from https://develop.svn.wordpress.org/branches/4.0@30413 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30408 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 12:02:35 +00:00
Andrew Nacin	8e04e41e42	Revert [28948] for the 4.0 branch, which caused a regression. see #29573 for 4.0. see #28350. Built from https://develop.svn.wordpress.org/branches/4.0@30410 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30405 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 11:12:37 +00:00
Andrew Nacin	3a108f5bce	Media Grid: Don't attempt to delete an attachment that can't be deleted. Merges [29755] to the 4.0 branch. props wonderboymusic. fixes #29597. Built from https://develop.svn.wordpress.org/branches/4.0@30409 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30404 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 11:09:32 +00:00
Andrew Nacin	e2cf18d5b9	Don't display Edit links for attachments user cannot edit. Merges [29723] to the 4.0 branch. props skaeser. fixes #29596. Built from https://develop.svn.wordpress.org/branches/4.0@30408 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30403 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 11:07:36 +00:00
Andrew Nacin	94f0e4dfb6	Media Grid: when the modal is open, don't respond to arrow keys when `<textarea>` has focus. Merges [29777] (and [30378]) to the 4.0 branch. Props ryelle, adamsilverstein. Fixes #29725. Built from https://develop.svn.wordpress.org/branches/4.0@30407 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30402 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 11:06:29 +00:00
Andrew Nacin	3f256ab656	TinyMCE: fix image captions regexp when wpautop is disabled in wp_editor(). Merges [29730] to the 4.0 branch. props azaozz. fixes #29592. Built from https://develop.svn.wordpress.org/branches/4.0@30406 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30401 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 11:00:51 +00:00
Andrew Nacin	0e76113043	In get_adjacent_post(), $excluded_terms should check term_id rather than term_taxonomy_id. Merges [30263] (and [30264] [30401]) to the 4.0 branch. props boonebgorges. fixes #29663, see #22112. Built from https://develop.svn.wordpress.org/branches/4.0@30405 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30400 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-20 10:59:35 +00:00
Andrew Nacin	59ae9aa3a7	Media Frames: Set the box-sizing CSS property to border-box for checkboxes and radio buttons. Merges [29727] to the 4.0 branch. props mlteal. fixes #29493. Built from https://develop.svn.wordpress.org/branches/4.0@30262 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30262 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 13:24:42 +00:00
Andrew Nacin	4f14d9f7f8	In `wp_audio\|video_shortcode()`, make sure that `autoplay` and `loop` are booleans. Passing `'false'` to them will force them to be active, which is bad. Merges [30185] to the 4.0 branch. props wonderboymusic. fixes #29825. Built from https://develop.svn.wordpress.org/branches/4.0@30261 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30261 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 08:23:29 +00:00
Andrew Nacin	eec6b41e3d	Create correct permalinks for child posts of hierarchical post types when default permalinks are used. Merges [29765] to the 4.0 branch. props loushou. fixes #29615. Built from https://develop.svn.wordpress.org/branches/4.0@30260 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30260 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 08:22:35 +00:00
Andrew Nacin	7be0716c9f	Avoid PHP notices in media modal caused by orphaned attachments. Merges [29724] to the 4.0 branch. props SergeyBiryukov. fixes #29566. Built from https://develop.svn.wordpress.org/branches/4.0@30259 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30259 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 08:16:33 +00:00
Andrew Nacin	8930d00db0	Make sure the $parent argument of wp_insert_attachment() still works as expected after [28579]. Merges [29745] to the 4.0 branch. props jesin, dikiy_forester. fixes #29646. Built from https://develop.svn.wordpress.org/branches/4.0@30258 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30258 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 08:15:30 +00:00
Andrew Nacin	5add2ed4b1	TinyMCE wpView: when pasting/inserting content before a view, add new paragraph above it and insert the content there. Merges [29766] to the 4.0 branch. props avryl. fixes #29380. Built from https://develop.svn.wordpress.org/branches/4.0@30257 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30257 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 08:13:29 +00:00
Andrew Nacin	c943b712b3	Editor expand: hide TinyMCE float panels and tooltips when scrolling. Merges [29738] to the 4.0 branch. props avryl. see #29516. Built from https://develop.svn.wordpress.org/branches/4.0@30256 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30256 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 08:12:34 +00:00
Andrew Nacin	b94cfff6ad	Create new $wp_roles object in install_blog() to avoid protected _init() call Merges [30242] to the 4.0 branch. Our call to `$wp_roles->_init()` relied on the `__call()` method in `WP_Roles` to handle the link to the protected method. This works back to PHP 5.2.9, when a bug was fixed allowing access to protected methods through this exact approach. `install_blog()` needs a fresh `$wp_roles` object after `populate_roles()` resets everything in its path. We can create this new object from scratch, effectively doing the same thing with the call to `_init()` via the constructor. props jeremyfelt. fixes #29692. Built from https://develop.svn.wordpress.org/branches/4.0@30255 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30255 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 08:09:05 +00:00
Andrew Nacin	d7245bcacc	Make sure we're on the media grid page before calling wp.media(). Merges [29725] to the 4.0 branch. props azaozz. fixes #29520. Built from https://develop.svn.wordpress.org/branches/4.0@30254 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30254 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 08:08:35 +00:00
Andrew Nacin	2db717b03b	Revert [28610] in order to avoid infinite redirect loops on reverse proxies which proxy from HTTPS to HTTP. Merges [30090] to the 4.0 branch. fixes #28610. Built from https://develop.svn.wordpress.org/branches/4.0@30253 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30253 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 07:16:39 +00:00
Andrew Nacin	f904bbceb5	Upgrade MediaElement to 2.15.1. Merges [29733] to the 4.0 branch. Changes from 2.15.0: https://github.com/johndyer/mediaelement/compare/2.15.0...2.15.1 Continues to revert upstream commit b7f82b4 to restore the status quo for Chromium support. props wonderboymusic. fixes #29620. Built from https://develop.svn.wordpress.org/branches/4.0@30252 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30252 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 07:11:31 +00:00
Andrew Nacin	b2217fa712	Editor-expand: reset the editor height after the window is resized. Merges [29886] to the 4.0 branch. props azaozz. fixes #29952. Built from https://develop.svn.wordpress.org/branches/4.0@30251 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30251 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 07:07:30 +00:00
Andrew Nacin	e2c870f41b	Quicktags: move focusing the editor after inserting content to the end of the code blocks. Merges [29884] to the 4.0 branch. Fixes a bug in Chrome where both the textarea and the window may auto-scroll to unexpected position on clicking a Quicktags button. props azaozz, avryl. fixes #29944. Built from https://develop.svn.wordpress.org/branches/4.0@30250 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30250 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 07:03:32 +00:00
Andrew Nacin	aaec5126c6	Plugin search: Wrap results in a form to fix pagination's `paged` input field. Merges [29829] to the 4.0 branch. props jesin, ocean90. fixes #18724. Built from https://develop.svn.wordpress.org/branches/4.0@30249 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30249 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 07:01:34 +00:00
Andrew Nacin	bab3933829	The 4.0 branch is 4.0.1-alpha. Built from https://develop.svn.wordpress.org/branches/4.0@30248 git-svn-id: http://core.svn.wordpress.org/branches/4.0@30248 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-11-06 06:49:37 +00:00
Andrew Nacin	4edbc74e65	Add safeguards for when ext/hash is not compiled with PHP. Merges [29751] to the 4.0 branch. fixes #29518. Built from https://develop.svn.wordpress.org/branches/4.0@29761 git-svn-id: http://core.svn.wordpress.org/branches/4.0@29533 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-09-23 18:14:39 +00:00
Andrew Nacin	b3f1257a69	Branch 4.0. Built from https://develop.svn.wordpress.org/@29710 git-svn-id: http://core.svn.wordpress.org/branches/4.0@29484 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2014-09-04 16:09:30 +00:00