Tag 4.4.1

Built from https://develop.svn.wordpress.org/tags/4.4.1@36206 git-svn-id: http://core.svn.wordpress.org/tags/4.4.1@36173 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-06 23:23:09 +00:00
47 changed files with 184 additions and 391 deletions
--- a/readme.html
+++ b/readme.html
@@ -9,7 +9,7 @@
 <body>
 <h1 id="logo">
 	<a href="https://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
-	<br /> Version 4.4.4
+	<br /> Version 4.4.1
 </h1>
 <p style="text-align: center">Semantic Personal Publishing Platform</p>

--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -49,18 +49,7 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 		</h2>

 		<div class="changelog point-releases">
-			<h3><?php _e( 'Maintenance and Security Releases' ); ?> </h3>
-			<p><?php printf( __( '<strong>Version %1$s</strong> addressed some security issues.' ), '4.4.4' ); ?>
-				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.4' ); ?>
-			</p>
-			<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
-				'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 6 ), '4.4.3', number_format_i18n( 6 ) ); ?>
-				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.3' ); ?>
-			</p>
-			<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
-				'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 17 ), '4.4.2', number_format_i18n( 17 ) ); ?>
-				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.2' ); ?>
-			</p>
+			<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 1 ); ?></h3>
 			<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
 				'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 52 ), '4.4.1', number_format_i18n( 52 ) ); ?>
 				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.1' ); ?>
--- a/wp-admin/includes/ajax-actions.php
+++ b/wp-admin/includes/ajax-actions.php
@@ -197,10 +197,8 @@ function wp_ajax_wp_compression_test() {
 			echo $out;
 			wp_die();
 		} elseif ( 'no' == $_GET['test'] ) {
-			check_ajax_referer( 'update_can_compress_scripts' );
 			update_site_option('can_compress_scripts', 0);
 		} elseif ( 'yes' == $_GET['test'] ) {
-			check_ajax_referer( 'update_can_compress_scripts' );
 			update_site_option('can_compress_scripts', 1);
 		}
 	}
@@ -2754,7 +2752,7 @@ function wp_ajax_get_revision_diffs() {
 	if ( ! $post = get_post( (int) $_REQUEST['post_id'] ) )
 		wp_send_json_error();

-	if ( ! current_user_can( 'edit_post', $post->ID ) )
+	if ( ! current_user_can( 'read_post', $post->ID ) )
 		wp_send_json_error();

 	// Really just pre-loading the cache here.
@@ -3310,8 +3308,6 @@ function wp_ajax_save_wporg_username() {
 		wp_send_json_error();
 	}

-	check_ajax_referer( 'save_wporg_username_' . get_current_user_id() );
-
 	$username = isset( $_REQUEST['username'] ) ? wp_unslash( $_REQUEST['username'] ) : false;

 	if ( ! $username ) {
--- a/wp-admin/includes/class-wp-media-list-table.php
+++ b/wp-admin/includes/class-wp-media-list-table.php
@@ -392,7 +392,7 @@ class WP_Media_List_Table extends WP_List_Table {
 			<span class="screen-reader-text"><?php _e( 'File name:' ); ?> </span>
 			<?php
 			$file = get_attached_file( $post->ID );
-			echo esc_html( wp_basename( $file ) );
+			echo wp_basename( $file );
 			?>
 		</p>
 		<?php
--- a/wp-admin/includes/class-wp-plugin-install-list-table.php
+++ b/wp-admin/includes/class-wp-plugin-install-list-table.php
@@ -170,13 +170,8 @@ class WP_Plugin_Install_List_Table extends WP_List_Table {
 				break;

 			case 'favorites':
-				$action = 'save_wporg_username_' . get_current_user_id();
-				if ( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( wp_unslash( $_GET['_wpnonce'] ), $action ) ) {
-					$user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
-					update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
-				} else {
-					$user = get_user_option( 'wporg_favorites' );
-				}
+				$user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
+				update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
 				if ( $user )
 					$args['user'] = $user;
 				else
--- a/wp-admin/includes/image.php
+++ b/wp-admin/includes/image.php
@@ -408,14 +408,12 @@ function wp_read_image_metadata( $file ) {
 		}
 	}

-	foreach ( $meta['keywords'] as $key => $keyword ) {
-		if ( ! seems_utf8( $keyword ) ) {
-			$meta['keywords'][ $key ] = utf8_encode( $keyword );
+	foreach ( $meta as &$value ) {
+		if ( is_string( $value ) ) {
+			$value = wp_kses_post( $value );
 		}
 	}

-	$meta = wp_kses_post_deep( $meta );
-
 	/**
 	 * Filter the array of meta data read from an image's exif data.
 	 *
--- a/wp-admin/includes/plugin-install.php
+++ b/wp-admin/includes/plugin-install.php
@@ -300,8 +300,7 @@ function install_plugins_upload() {
 *
 */
 function install_plugins_favorites_form() {
-	$user   = get_user_option( 'wporg_favorites' );
-	$action = 'save_wporg_username_' . get_current_user_id();
+	$user = ! empty( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
 	?>
 	<p class="install-help"><?php _e( 'If you have marked plugins as favorites on WordPress.org, you can browse them here.' ); ?></p>
 	<form method="get">
@@ -310,7 +309,6 @@ function install_plugins_favorites_form() {
 			<label for="user"><?php _e( 'Your WordPress.org username:' ); ?></label>
 			<input type="search" id="user" name="user" value="<?php echo esc_attr( $user ); ?>" />
 			<input type="submit" class="button" value="<?php esc_attr_e( 'Get Favorites' ); ?>" />
-			<input type="hidden" id="wporg-username-nonce" name="_wpnonce" value="<?php echo esc_attr( wp_create_nonce( $action ) ); ?>" /> 
 		</p>
 	</form>
 	<?php
--- a/wp-admin/includes/post.php
+++ b/wp-admin/includes/post.php
@@ -165,13 +165,6 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
 		$post_data['post_date_gmt'] = get_gmt_from_date( $post_data['post_date'] );
 	}

-	if ( isset( $post_data['post_category'] ) ) {
-		$category_object = get_taxonomy( 'category' );
-		if ( ! current_user_can( $category_object->cap->assign_terms ) ) {
-			unset( $post_data['post_category'] );
-		}
-	}
-
 	return $post_data;
 }

@@ -1309,7 +1302,7 @@ function get_sample_permalink_html( $id, $new_title = null, $new_slug = null ) {
 				$view_link = get_permalink( $post );
 			} else {
 				// Allow non-published (private, future) to be viewed at a pretty permalink.
-				$view_link = str_replace( array( '%pagename%', '%postname%' ), $post->post_name, $permalink );
+				$view_link = str_replace( array( '%pagename%', '%postname%' ), $post->post_name, urldecode( $permalink ) );
 			}
 		}
 	}
@@ -1319,8 +1312,7 @@ function get_sample_permalink_html( $id, $new_title = null, $new_slug = null ) {
 		$return = '<strong>' . __( 'Permalink:' ) . "</strong>\n";

 		if ( false !== $view_link ) {
-			$display_link = urldecode( $view_link );
-			$return .= '<a id="sample-permalink" href="' . esc_url( $view_link ) . '"' . $preview_target . '>' . esc_html( $display_link ) . "</a>\n";
+			$return .= '<a id="sample-permalink" href="' . esc_url( $view_link ) . '"' . $preview_target . '>' . $view_link . "</a>\n";
 		} else {
 			$return .= '<span id="sample-permalink">' . $permalink . "</span>\n";
 		}
@@ -1344,14 +1336,14 @@ function get_sample_permalink_html( $id, $new_title = null, $new_slug = null ) {
 			}
 		}

-		$post_name_html = '<span id="editable-post-name">' . esc_html( $post_name_abridged ) . '</span>';
-		$display_link = str_replace( array( '%pagename%', '%postname%' ), $post_name_html, esc_html( urldecode( $permalink ) ) );
+		$post_name_html = '<span id="editable-post-name">' . $post_name_abridged . '</span>';
+		$display_link = str_replace( array( '%pagename%', '%postname%' ), $post_name_html, urldecode( $permalink ) );

 		$return = '<strong>' . __( 'Permalink:' ) . "</strong>\n";
 		$return .= '<span id="sample-permalink"><a href="' . esc_url( $view_link ) . '"' . $preview_target . '>' . $display_link . "</a></span>\n";
 		$return .= '&lrm;'; // Fix bi-directional text display defect in RTL languages.
 		$return .= '<span id="edit-slug-buttons"><button type="button" class="edit-slug button button-small hide-if-no-js" aria-label="' . __( 'Edit permalink' ) . '">' . __( 'Edit' ) . "</button></span>\n";
-		$return .= '<span id="editable-post-name-full">' . esc_html( $post_name ) . "</span>\n";
+		$return .= '<span id="editable-post-name-full">' . $post_name . "</span>\n";
 	}

 	/**
@@ -1848,4 +1840,4 @@ function redirect_post($post_id = '') {
 	 */
 	wp_redirect( apply_filters( 'redirect_post_location', $location, $post_id ) );
 	exit;
-}
+}
--- a/wp-admin/includes/template.php
+++ b/wp-admin/includes/template.php
@@ -1784,7 +1784,6 @@ function _media_states( $post ) {
 function compression_test() {
 ?>
 	<script type="text/javascript">
-	var compressionNonce = <?php echo wp_json_encode( wp_create_nonce( 'update_can_compress_scripts' ) ); ?>;
 	var testCompression = {
 		get : function(test) {
 			var x;
@@ -1804,7 +1803,7 @@ function compression_test() {
 					}
 				};

-				x.open('GET', ajaxurl + '?action=wp-compression-test&test='+test+'&_ajax_nonce='+compressionNonce+'&'+(new Date()).getTime(), true);
+				x.open('GET', ajaxurl + '?action=wp-compression-test&test='+test+'&'+(new Date()).getTime(), true);
 				x.send('');
 			}
 		},
--- a/wp-admin/js/inline-edit-tax.js
+++ b/wp-admin/js/inline-edit-tax.js
@@ -137,8 +137,6 @@ inlineEditTax = {
 				}
 			}
 		);
-		// Prevent submitting the form when pressing Enter on a focused field.
-		return false;
 	},

 	revert : function() {
--- a/wp-admin/js/inline-edit-tax.min.js
+++ b/wp-admin/js/inline-edit-tax.min.js
@@ -1 +1 @@
-window.wp=window.wp||{};var inlineEditTax;!function(a,b){inlineEditTax={init:function(){var b=this,c=a("#inline-edit");b.type=a("#the-list").attr("data-wp-lists").substr(5),b.what="#"+b.type+"-",a("#the-list").on("click","a.editinline",function(){return inlineEditTax.edit(this),!1}),c.keyup(function(a){return 27===a.which?inlineEditTax.revert():void 0}),a(".cancel",c).click(function(){return inlineEditTax.revert()}),a(".save",c).click(function(){return inlineEditTax.save(this)}),a("input, select",c).keydown(function(a){return 13===a.which?inlineEditTax.save(this):void 0}),a('#posts-filter input[type="submit"]').mousedown(function(){b.revert()})},toggle:function(b){var c=this;"none"===a(c.what+c.getId(b)).css("display")?c.revert():c.edit(b)},edit:function(b){var c,d,e,f=this;return f.revert(),"object"==typeof b&&(b=f.getId(b)),c=a("#inline-edit").clone(!0),d=a("#inline_"+b),a("td",c).attr("colspan",a("th:visible, td:visible",".widefat:first thead").length),a(f.what+b).hide().after(c).after('<tr class="hidden"></tr>'),e=a(".name",d),e.find("img").replaceWith(function(){return this.alt}),e=e.text(),a(':input[name="name"]',c).val(e),e=a(".slug",d),e.find("img").replaceWith(function(){return this.alt}),e=e.text(),a(':input[name="slug"]',c).val(e),a(c).attr("id","edit-"+b).addClass("inline-editor").show(),a(".ptitle",c).eq(0).focus(),!1},save:function(c){var d,e,f=a('input[name="taxonomy"]').val()||"";return"object"==typeof c&&(c=this.getId(c)),a("table.widefat .spinner").addClass("is-active"),d={action:"inline-save-tax",tax_type:this.type,tax_ID:c,taxonomy:f},e=a("#edit-"+c).find(":input").serialize(),d=e+"&"+a.param(d),a.post(ajaxurl,d,function(d){var e,f,g,h=a("#edit-"+c+" .inline-edit-save .error");a("table.widefat .spinner").removeClass("is-active"),d?-1!==d.indexOf("<tr")?(a(inlineEditTax.what+c).siblings("tr.hidden").addBack().remove(),f=a(d).attr("id"),a("#edit-"+c).before(d).remove(),f?(g=f.replace(inlineEditTax.type+"-",""),e=a("#"+f)):(g=c,e=a(inlineEditTax.what+c)),a("#parent").find("option[value="+g+"]").text(e.find(".row-title").text()),e.hide().fadeIn(400,function(){e.find(".row-title").focus(),b.a11y.speak(inlineEditL10n.saved)})):(h.html(d).show(),b.a11y.speak(h.text())):(h.html(inlineEditL10n.error).show(),b.a11y.speak(inlineEditL10n.error))}),!1},revert:function(){var b=a("table.widefat tr.inline-editor").attr("id");b&&(a("table.widefat .spinner").removeClass("is-active"),a("#"+b).siblings("tr.hidden").addBack().remove(),b=b.substr(b.lastIndexOf("-")+1),a(this.what+b).show().find(".row-title").focus())},getId:function(b){var c="TR"===b.tagName?b.id:a(b).parents("tr").attr("id"),d=c.split("-");return d[d.length-1]}},a(document).ready(function(){inlineEditTax.init()})}(jQuery,window.wp);
+window.wp=window.wp||{};var inlineEditTax;!function(a,b){inlineEditTax={init:function(){var b=this,c=a("#inline-edit");b.type=a("#the-list").attr("data-wp-lists").substr(5),b.what="#"+b.type+"-",a("#the-list").on("click","a.editinline",function(){return inlineEditTax.edit(this),!1}),c.keyup(function(a){return 27===a.which?inlineEditTax.revert():void 0}),a(".cancel",c).click(function(){return inlineEditTax.revert()}),a(".save",c).click(function(){return inlineEditTax.save(this)}),a("input, select",c).keydown(function(a){return 13===a.which?inlineEditTax.save(this):void 0}),a('#posts-filter input[type="submit"]').mousedown(function(){b.revert()})},toggle:function(b){var c=this;"none"===a(c.what+c.getId(b)).css("display")?c.revert():c.edit(b)},edit:function(b){var c,d,e,f=this;return f.revert(),"object"==typeof b&&(b=f.getId(b)),c=a("#inline-edit").clone(!0),d=a("#inline_"+b),a("td",c).attr("colspan",a("th:visible, td:visible",".widefat:first thead").length),a(f.what+b).hide().after(c).after('<tr class="hidden"></tr>'),e=a(".name",d),e.find("img").replaceWith(function(){return this.alt}),e=e.text(),a(':input[name="name"]',c).val(e),e=a(".slug",d),e.find("img").replaceWith(function(){return this.alt}),e=e.text(),a(':input[name="slug"]',c).val(e),a(c).attr("id","edit-"+b).addClass("inline-editor").show(),a(".ptitle",c).eq(0).focus(),!1},save:function(c){var d,e,f=a('input[name="taxonomy"]').val()||"";"object"==typeof c&&(c=this.getId(c)),a("table.widefat .spinner").addClass("is-active"),d={action:"inline-save-tax",tax_type:this.type,tax_ID:c,taxonomy:f},e=a("#edit-"+c).find(":input").serialize(),d=e+"&"+a.param(d),a.post(ajaxurl,d,function(d){var e,f,g,h=a("#edit-"+c+" .inline-edit-save .error");a("table.widefat .spinner").removeClass("is-active"),d?-1!==d.indexOf("<tr")?(a(inlineEditTax.what+c).siblings("tr.hidden").addBack().remove(),f=a(d).attr("id"),a("#edit-"+c).before(d).remove(),f?(g=f.replace(inlineEditTax.type+"-",""),e=a("#"+f)):(g=c,e=a(inlineEditTax.what+c)),a("#parent").find("option[value="+g+"]").text(e.find(".row-title").text()),e.hide().fadeIn(400,function(){e.find(".row-title").focus(),b.a11y.speak(inlineEditL10n.saved)})):(h.html(d).show(),b.a11y.speak(h.text())):(h.html(inlineEditL10n.error).show(),b.a11y.speak(inlineEditL10n.error))})},revert:function(){var b=a("table.widefat tr.inline-editor").attr("id");b&&(a("table.widefat .spinner").removeClass("is-active"),a("#"+b).siblings("tr.hidden").addBack().remove(),b=b.substr(b.lastIndexOf("-")+1),a(this.what+b).show().find(".row-title").focus())},getId:function(b){var c="TR"===b.tagName?b.id:a(b).parents("tr").attr("id"),d=c.split("-");return d[d.length-1]}},a(document).ready(function(){inlineEditTax.init()})}(jQuery,window.wp);
--- a/wp-admin/js/theme.js
+++ b/wp-admin/js/theme.js
@@ -1520,7 +1520,6 @@ themes.view.Installer = themes.view.Appearance.extend({
 	// Save the user's WordPress.org username and get his favorite themes.
 	saveUsername: function ( event ) {
 		var username = $( '#wporg-username-input' ).val(),
-			nonce = $( '#wporg-username-nonce' ).val(),
 			request = { browse: 'favorites', user: username },
 			that = this;

@@ -1535,7 +1534,6 @@ themes.view.Installer = themes.view.Appearance.extend({

 		return wp.ajax.send( 'save-wporg-username', {
 			data: {
-				_wpnonce: nonce,
 				username: username
 			},
 			success: function () {
--- a/wp-admin/js/theme.min.js
+++ b/wp-admin/js/theme.min.js
--- a/wp-admin/network/settings.php
+++ b/wp-admin/network/settings.php
@@ -258,7 +258,7 @@ if ( isset( $_GET['updated'] ) ) {
 			<tr>
 				<th scope="row"><label for="first_comment_author"><?php _e( 'First Comment Author' ) ?></label></th>
 				<td>
-					<input type="text" size="40" name="first_comment_author" id="first_comment_author" aria-describedby="first-comment-author-desc" value="<?php echo esc_attr( get_site_option('first_comment_author') ); ?>" />
+					<input type="text" size="40" name="first_comment_author" id="first_comment_author" aria-describedby="first-comment-author-desc" value="<?php echo get_site_option('first_comment_author') ?>" />
 					<p class="description" id="first-comment-author-desc">
 						<?php _e( 'The author of the first comment on a new site.' ) ?>
 					</p>
--- a/wp-admin/revision.php
+++ b/wp-admin/revision.php
@@ -63,7 +63,7 @@ default :
 	if ( ! $post = get_post( $revision->post_parent ) )
 		break;

-	if ( ! current_user_can( 'read_post', $revision->ID ) || ! current_user_can( 'edit_post', $revision->post_parent ) )
+	if ( ! current_user_can( 'read_post', $revision->ID ) || ! current_user_can( 'read_post', $post->ID ) )
 		break;

 	// Revisions disabled and we're not looking at an autosave
--- a/wp-admin/theme-install.php
+++ b/wp-admin/theme-install.php
@@ -148,19 +148,13 @@ include(ABSPATH . 'wp-admin/admin-header.php');

 		<div class="favorites-form">
 			<?php
-			$action = 'save_wporg_username_' . get_current_user_id();
-			if ( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( wp_unslash( $_GET['_wpnonce'] ), $action ) ) {
-				$user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
-				update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
-			} else {
-				$user = get_user_option( 'wporg_favorites' );
-			}
+			$user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
+			update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
 			?>
 			<p class="install-help"><?php _e( 'If you have marked themes as favorites on WordPress.org, you can browse them here.' ); ?></p>

 			<p>
 				<label for="user"><?php _e( 'Your WordPress.org username:' ); ?></label>
-				<input type="hidden" id="wporg-username-nonce" name="_wpnonce" value="<?php echo esc_attr( wp_create_nonce( $action ) ); ?>" />
 				<input type="search" id="wporg-username-input" value="<?php echo esc_attr( $user ); ?>" />
 				<input type="button" class="button button-secondary favorites-form-submit" value="<?php esc_attr_e( 'Get Favorites' ); ?>" />
 			</p>
--- a/wp-admin/user-edit.php
+++ b/wp-admin/user-edit.php
@@ -83,7 +83,7 @@ if ( is_multisite()
 // Execute confirmed email change. See send_confirmation_on_profile_email().
 if ( is_multisite() && IS_PROFILE_PAGE && isset( $_GET[ 'newuseremail' ] ) && $current_user->ID ) {
 	$new_email = get_option( $current_user->ID . '_new_email' );
-	if ( $new_email && hash_equals( $new_email[ 'hash' ], $_GET[ 'newuseremail' ] ) ) {
+	if ( $new_email[ 'hash' ] == $_GET[ 'newuseremail' ] ) {
 		$user = new stdClass;
 		$user->ID = $current_user->ID;
 		$user->user_email = esc_html( trim( $new_email[ 'newemail' ] ) );
@@ -94,8 +94,7 @@ if ( is_multisite() && IS_PROFILE_PAGE && isset( $_GET[ 'newuseremail' ] ) && $c
 		wp_redirect( add_query_arg( array('updated' => 'true'), self_admin_url( 'profile.php' ) ) );
 		die();
 	}
-} elseif ( is_multisite() && IS_PROFILE_PAGE && !empty( $_GET['dismiss'] ) && $current_user->ID . '_new_email' === $_GET['dismiss'] ) {
-	check_admin_referer( 'dismiss-' . $current_user->ID . '_new_email' );
+} elseif ( is_multisite() && IS_PROFILE_PAGE && !empty( $_GET['dismiss'] ) && $current_user->ID . '_new_email' == $_GET['dismiss'] ) {
 	delete_option( $current_user->ID . '_new_email' );
 	wp_redirect( add_query_arg( array('updated' => 'true'), self_admin_url( 'profile.php' ) ) );
 	die();
@@ -390,8 +389,8 @@ if ( is_multisite() && is_network_admin() && ! IS_PROFILE_PAGE && current_user_c
 	<p><?php
 		printf(
 			__( 'There is a pending change of your email to %1$s. <a href="%2$s">Cancel</a>' ),
-			'<code>' . esc_html( $new_email['newemail'] ) . '</code>',
-			esc_url( wp_nonce_url( self_admin_url( 'profile.php?dismiss=' . $current_user->ID . '_new_email' ), 'dismiss-' . $current_user->ID . '_new_email' ) )
+			'<code>' . $new_email['newemail'] . '</code>',
+			esc_url( self_admin_url( 'profile.php?dismiss=' . $current_user->ID . '_new_email' ) )
 	); ?></p>
 	</div>
 	<?php endif; ?>
--- a/wp-admin/widgets.php
+++ b/wp-admin/widgets.php
@@ -406,13 +406,10 @@ foreach ( $wp_registered_sidebars as $sidebar => $registered_sidebar ) {
 		if ( !empty( $registered_sidebar['class'] ) )
 			$wrap_class .= ' ' . $registered_sidebar['class'];

-		$is_inactive_widgets = 'wp_inactive_widgets' == $registered_sidebar['id'];
 		?>
 		<div class="<?php echo esc_attr( $wrap_class ); ?>">
 			<div class="widget-holder inactive">
 				<?php wp_list_widget_controls( $registered_sidebar['id'], $registered_sidebar['name'] ); ?>
-
-				<?php if ( $is_inactive_widgets ) { ?>
 				<div class="remove-inactive-widgets">
 					<form action="" method="post">
 						<p>
@@ -430,11 +427,8 @@ foreach ( $wp_registered_sidebars as $sidebar => $registered_sidebar ) {
 						<?php wp_nonce_field( 'remove-inactive-widgets', '_wpnonce_remove_inactive_widgets' ); ?>
 					</form>
 				</div>
-				<?php } ?>
 			</div>
-			<?php if ( $is_inactive_widgets ) { ?>
 			<p class="description"><?php _e( 'This will clear all items from the inactive widgets list. You will not be able to restore any customizations.' ); ?></p>
-			<?php } ?>
 		</div>
 		<?php

--- a/wp-includes/class-oembed.php
+++ b/wp-includes/class-oembed.php
@@ -284,32 +284,10 @@ class WP_oEmbed {
 	 * @return false|string False on failure, otherwise the UNSANITIZED (and potentially unsafe) HTML that should be used to embed.
 	 */
 	public function get_html( $url, $args = '' ) {
-		/**
-		 * Filters the oEmbed result before any HTTP requests are made.
-		 *
-		 * This allows one to short-circuit the default logic, perhaps by
-		 * replacing it with a routine that is more optimal for your setup.
-		 *
-		 * Passing a non-null value to the filter will effectively short-circuit retrieval,
-		 * returning the passed value instead.
-		 *
-		 * @since 4.5.3
-		 *
-		 * @param null|string $result The UNSANITIZED (and potentially unsafe) HTML that should be used to embed. Default null.
-		 * @param string      $url    The URL to the content that should be attempted to be embedded.
-		 * @param array       $args   Optional. Arguments, usually passed from a shortcode. Default empty.
-		 */
-		$pre = apply_filters( 'pre_oembed_result', null, $url, $args );
-
-		if ( null !== $pre ) {
-			return $pre;
-		}
-
 		$provider = $this->get_provider( $url, $args );

-		if ( ! $provider || false === $data = $this->fetch( $provider, $url, $args ) ) {
+		if ( !$provider || false === $data = $this->fetch( $provider, $url, $args ) )
 			return false;
-		}

 		/**
 		 * Filter the HTML returned by the oEmbed provider.
--- a/wp-includes/class-snoopy.php
+++ b/wp-includes/class-snoopy.php
@@ -999,23 +999,20 @@ class Snoopy
 		if(!empty($this->user) || !empty($this->pass))
 			$headers[] = "Authorization: BASIC ".base64_encode($this->user.":".$this->pass);

-		$headerfile = tempnam( $this->temp_dir, "sno" );
-		$cmdline_params = '-k -D ' . escapeshellarg( $headerfile );
-
-		foreach ( $headers as $header ) {
-			$cmdline_params .= ' -H ' . escapeshellarg( $header );
+		for($curr_header = 0; $curr_header < count($headers); $curr_header++) {
+			$safer_header = strtr( $headers[$curr_header], "\"", " " );
+			$cmdline_params .= " -H \"".$safer_header."\"";
 		}

-		if ( ! empty( $body ) ) {
-			$cmdline_params .= ' -d ' . escapeshellarg( $body );
-		}
+		if(!empty($body))
+			$cmdline_params .= " -d \"$body\"";

-		if ( $this->read_timeout > 0 ) {
-			$cmdline_params .= ' -m ' . escapeshellarg( $this->read_timeout );
-		}
+		if($this->read_timeout > 0)
+			$cmdline_params .= " -m ".$this->read_timeout;

+		$headerfile = tempnam($this->temp_dir, "sno");

-		exec( $this->curl_path . ' ' . $cmdline_params . ' ' . escapeshellarg( $URI ), $results, $return );
+		exec($this->curl_path." -k -D \"$headerfile\"".$cmdline_params." \"".escapeshellcmd($URI)."\"",$results,$return);

 		if($return)
 		{
--- a/wp-includes/class-wp-comment-query.php
+++ b/wp-includes/class-wp-comment-query.php
@@ -59,17 +59,6 @@ class WP_Comment_Query {
 		'limits'  => '',
 	);

-	/**
-	 * SQL WHERE clause.
-	 *
-	 * Stored after the 'comments_clauses' filter is run on the compiled WHERE sub-clauses.
-	 *
-	 * @since 4.4.2
-	 * @access protected
-	 * @var string
-	 */
-	protected $filtered_where_clause;
-
 	/**
 	 * Date query container
 	 *
@@ -758,7 +747,7 @@ class WP_Comment_Query {
 			foreach ( $post_fields as $field_name => $field_value ) {
 				// $field_value may be an array.
 				$esses = array_fill( 0, count( (array) $field_value ), '%s' );
-				$this->sql_clauses['where'][ $field_name ] = $wpdb->prepare( " {$wpdb->posts}.{$field_name} IN (" . implode( ',', $esses ) . ')', $field_value );
+				$this->sql_clauses['where']['post_fields'] = $wpdb->prepare( " {$wpdb->posts}.{$field_name} IN (" . implode( ',', $esses ) . ')', $field_value );
 			}
 		}

@@ -827,8 +816,6 @@ class WP_Comment_Query {
 		$limits = isset( $clauses[ 'limits' ] ) ? $clauses[ 'limits' ] : '';
 		$groupby = isset( $clauses[ 'groupby' ] ) ? $clauses[ 'groupby' ] : '';

-		$this->filtered_where_clause = $where;
-
 		if ( $where ) {
 			$where = 'WHERE ' . $where;
 		}
@@ -880,27 +867,12 @@ class WP_Comment_Query {
 			0 => wp_list_pluck( $comments, 'comment_ID' ),
 		);

-		/*
-		 * The WHERE clause for the descendant query is the same as for the top-level
-		 * query, minus the `parent`, `parent__in`, and `parent__not_in` sub-clauses.
-		 */
-		$_where = $this->filtered_where_clause;
-		$exclude_keys = array( 'parent', 'parent__in', 'parent__not_in' );
-		foreach ( $exclude_keys as $exclude_key ) {
-			if ( isset( $this->sql_clauses['where'][ $exclude_key ] ) ) {
-				$clause = $this->sql_clauses['where'][ $exclude_key ];
-
-				// Strip the clause as well as any adjacent ANDs.
-				$pattern = '|(?:AND)?\s*' . $clause . '\s*(?:AND)?|';
-				$_where_parts = preg_split( $pattern, $_where );
-
-				// Remove empties.
-				$_where_parts = array_filter( array_map( 'trim', $_where_parts ) );
-
-				// Reassemble with an AND.
-				$_where = implode( ' AND ', $_where_parts );
-			}
-		}
+		$where_clauses = $this->sql_clauses['where'];
+		unset(
+			$where_clauses['parent'],
+			$where_clauses['parent__in'],
+			$where_clauses['parent__not_in']
+		);

 		// Fetch an entire level of the descendant tree at a time.
 		$level = 0;
@@ -910,7 +882,7 @@ class WP_Comment_Query {
 				break;
 			}

-			$where = 'WHERE ' . $_where . ' AND comment_parent IN (' . implode( ',', array_map( 'intval', $parent_ids ) ) . ')';
+			$where = 'WHERE ' . implode( ' AND ', $where_clauses ) . ' AND comment_parent IN (' . implode( ',', array_map( 'intval', $parent_ids ) ) . ')';
 			$comment_ids = $wpdb->get_col( "{$this->sql_clauses['select']} {$this->sql_clauses['from']} {$where} {$this->sql_clauses['groupby']} ORDER BY comment_date_gmt ASC, comment_ID ASC" );

 			$level++;
--- a/wp-includes/class-wp-customize-manager.php
+++ b/wp-includes/class-wp-customize-manager.php
@@ -1489,7 +1489,6 @@ final class WP_Customize_Manager {
 	 * @param string $preview_url URL to be previewed.
 	 */
 	public function set_preview_url( $preview_url ) {
-		$preview_url = esc_url_raw( $preview_url );
 		$this->preview_url = wp_validate_redirect( $preview_url, home_url( '/' ) );
 	}

@@ -1521,7 +1520,6 @@ final class WP_Customize_Manager {
 	 * @param string $return_url URL for return link.
 	 */
 	public function set_return_url( $return_url ) {
-		$return_url = esc_url_raw( $return_url );
 		$return_url = remove_query_arg( wp_removable_query_args(), $return_url );
 		$return_url = wp_validate_redirect( $return_url );
 		$this->return_url = $return_url;
@@ -1537,11 +1535,9 @@ final class WP_Customize_Manager {
 	 */
 	public function get_return_url() {
 		$referer = wp_get_referer();
-		$excluded_referer_basenames = array( 'customize.php', 'wp-login.php' );
-
 		if ( $this->return_url ) {
 			$return_url = $this->return_url;
-		} else if ( $referer && ! in_array( basename( parse_url( $referer, PHP_URL_PATH ) ), $excluded_referer_basenames, true ) ) {
+		} else if ( $referer && 'customize.php' !== basename( parse_url( $referer, PHP_URL_PATH ) ) ) {
 			$return_url = $referer;
 		} else if ( $this->preview_url ) {
 			$return_url = $this->preview_url;
--- a/wp-includes/comment-template.php
+++ b/wp-includes/comment-template.php
@@ -1285,16 +1285,11 @@ function comments_template( $file = '/comments.php', $separate_comments = false
 		'order' => 'ASC',
 		'status'  => 'approve',
 		'post_id' => $post->ID,
+		'hierarchical' => 'threaded',
 		'no_found_rows' => false,
 		'update_comment_meta_cache' => false, // We lazy-load comment meta for performance.
 	);

-	if ( get_option('thread_comments') ) {
-		$comment_args['hierarchical'] = 'threaded';
-	} else {
-		$comment_args['hierarchical'] = false;
-	}
-
 	if ( $user_ID ) {
 		$comment_args['include_unapproved'] = array( $user_ID );
 	} elseif ( ! empty( $comment_author_email ) ) {
@@ -1322,13 +1317,10 @@ function comments_template( $file = '/comments.php', $separate_comments = false
 				'count'   => true,
 				'orderby' => false,
 				'post_id' => $post->ID,
+				'parent'  => 0,
 				'status'  => 'approve',
 			);

-			if ( $comment_args['hierarchical'] ) {
-				$top_level_args['parent'] = 0;
-			}
-
 			if ( isset( $comment_args['include_unapproved'] ) ) {
 				$top_level_args['include_unapproved'] = $comment_args['include_unapproved'];
 			}
@@ -1343,22 +1335,18 @@ function comments_template( $file = '/comments.php', $separate_comments = false
 	$_comments = $comment_query->comments;

 	// Trees must be flattened before they're passed to the walker.
-	if ( $comment_args['hierarchical'] ) {
-		$comments_flat = array();
-		foreach ( $_comments as $_comment ) {
-			$comments_flat[]  = $_comment;
-			$comment_children = $_comment->get_children( array(
-				'format' => 'flat',
-				'status' => $comment_args['status'],
-				'orderby' => $comment_args['orderby']
-			) );
+	$comments_flat = array();
+	foreach ( $_comments as $_comment ) {
+		$comments_flat[]  = $_comment;
+		$comment_children = $_comment->get_children( array(
+			'format' => 'flat',
+			'status' => $comment_args['status'],
+			'orderby' => $comment_args['orderby']
+		) );

-			foreach ( $comment_children as $comment_child ) {
-				$comments_flat[] = $comment_child;
-			}
+		foreach ( $comment_children as $comment_child ) {
+			$comments_flat[] = $comment_child;
 		}
-	} else {
-		$comments_flat = $_comments;
 	}

 	/**
@@ -1937,6 +1925,27 @@ function wp_list_comments( $args = array(), $comments = null ) {
 	 */
 	$r = apply_filters( 'wp_list_comments_args', $r );

+	/*
+	 * If 'page' or 'per_page' has been passed, and does not match what's in $wp_query,
+	 * perform a separate comment query and allow Walker_Comment to paginate.
+	 */
+	if ( is_singular() && ( $r['page'] || $r['per_page'] ) ) {
+		$current_cpage = get_query_var( 'cpage' );
+		if ( ! $current_cpage ) {
+			$current_cpage = 'newest' === get_option( 'default_comments_page' ) ? 1 : $wp_query->max_num_comment_pages;
+		}
+
+		$current_per_page = get_query_var( 'comments_per_page' );
+		if ( $r['page'] != $current_cpage || $r['per_page'] != $current_per_page ) {
+			$comments = get_comments( array(
+				'post_id' => get_queried_object_id(),
+				'orderby' => 'comment_date_gmt',
+				'order' => 'ASC',
+				'status' => 'all',
+			) );
+		}
+	}
+
 	// Figure out what comments we'll be looping through ($_comments)
 	if ( null !== $comments ) {
 		$comments = (array) $comments;
@@ -1951,71 +1960,34 @@ function wp_list_comments( $args = array(), $comments = null ) {
 			$_comments = $comments;
 		}
 	} else {
-		/*
-		 * If 'page' or 'per_page' has been passed, and does not match what's in $wp_query,
-		 * perform a separate comment query and allow Walker_Comment to paginate.
-		 */
-		if ( $r['page'] || $r['per_page'] ) {
-			$current_cpage = get_query_var( 'cpage' );
-			if ( ! $current_cpage ) {
-				$current_cpage = 'newest' === get_option( 'default_comments_page' ) ? 1 : $wp_query->max_num_comment_pages;
-			}
-
-			$current_per_page = get_query_var( 'comments_per_page' );
-			if ( $r['page'] != $current_cpage || $r['per_page'] != $current_per_page ) {
-
-				$comments = get_comments( array(
-					'post_id' => get_the_ID(),
-					'orderby' => 'comment_date_gmt',
-					'order' => 'ASC',
-					'status' => 'all',
-				) );
-
-				if ( 'all' != $r['type'] ) {
-					$comments_by_type = separate_comments( $comments );
-					if ( empty( $comments_by_type[ $r['type'] ] ) ) {
-						return;
-					}
-
-					$_comments = $comments_by_type[ $r['type'] ];
-				} else {
-					$_comments = $comments;
-				}
-			}
-
-		// Otherwise, fall back on the comments from `$wp_query->comments`.
-		} else {
-			if ( empty($wp_query->comments) )
+		if ( empty($wp_query->comments) )
+			return;
+		if ( 'all' != $r['type'] ) {
+			if ( empty($wp_query->comments_by_type) )
+				$wp_query->comments_by_type = separate_comments($wp_query->comments);
+			if ( empty($wp_query->comments_by_type[$r['type']]) )
 				return;
-			if ( 'all' != $r['type'] ) {
-				if ( empty($wp_query->comments_by_type) )
-					$wp_query->comments_by_type = separate_comments($wp_query->comments);
-				if ( empty($wp_query->comments_by_type[$r['type']]) )
-					return;
-				$_comments = $wp_query->comments_by_type[$r['type']];
+			$_comments = $wp_query->comments_by_type[$r['type']];
+		} else {
+			$_comments = $wp_query->comments;
+		}
+
+		// Pagination is already handled by `WP_Comment_Query`, so we tell Walker not to bother.
+		if ( $wp_query->max_num_comment_pages ) {
+			$default_comments_page = get_option( 'default_comments_page' );
+			$cpage = get_query_var( 'cpage' );
+			if ( 'newest' === $default_comments_page ) {
+				$r['cpage'] = $cpage;
+
+			// When first page shows oldest comments, post permalink is the same as the comment permalink.
+			} elseif ( $cpage == 1 ) {
+				$r['cpage'] = '';
 			} else {
-				$_comments = $wp_query->comments;
+				$r['cpage'] = $cpage;
 			}

-			if ( $wp_query->max_num_comment_pages ) {
-				$default_comments_page = get_option( 'default_comments_page' );
-				$cpage = get_query_var( 'cpage' );
-				if ( 'newest' === $default_comments_page ) {
-					$r['cpage'] = $cpage;
-
-				/*
-				 * When first page shows oldest comments, post permalink is the same as
-				 * the comment permalink.
-				 */
-				} elseif ( $cpage == 1 ) {
-					$r['cpage'] = '';
-				} else {
-					$r['cpage'] = $cpage;
-				}
-
-				$r['page'] = 0;
-				$r['per_page'] = 0;
-			}
+			$r['page'] = 0;
+			$r['per_page'] = 0;
 		}
 	}

--- a/wp-includes/default-filters.php
+++ b/wp-includes/default-filters.php
@@ -473,6 +473,5 @@ add_filter( 'the_excerpt_embed',      'wp_embed_excerpt_attachment'           );

 add_filter( 'oembed_dataparse',       'wp_filter_oembed_result',        10, 3 );
 add_filter( 'oembed_response_data',   'get_oembed_response_data_rich',  10, 4 );
-add_filter( 'pre_oembed_result',      'wp_filter_pre_oembed_result',    10, 3 );

 unset( $filter, $action );
--- a/wp-includes/embed.php
+++ b/wp-includes/embed.php
@@ -478,7 +478,7 @@ function get_post_embed_html( $width, $height, $post = null ) {
 		 * and edit wp-embed.js directly.
 		 */
 		$output .=<<<JS
-		!function(a,b){"use strict";function c(){if(!e){e=!0;var a,c,d,f,g=-1!==navigator.appVersion.indexOf("MSIE 10"),h=!!navigator.userAgent.match(/Trident.*rv:11\./),i=b.querySelectorAll("iframe.wp-embedded-content");for(c=0;c<i.length;c++)if(d=i[c],!d.getAttribute("data-secret")){if(f=Math.random().toString(36).substr(2,10),d.src+="#?secret="+f,d.setAttribute("data-secret",f),g||h)a=d.cloneNode(!0),a.removeAttribute("security"),d.parentNode.replaceChild(a,d)}else;}}var d=!1,e=!1;if(b.querySelector)if(a.addEventListener)d=!0;if(a.wp=a.wp||{},!a.wp.receiveEmbedMessage)if(a.wp.receiveEmbedMessage=function(c){var d=c.data;if(d.secret||d.message||d.value)if(!/[^a-zA-Z0-9]/.test(d.secret)){var e,f,g,h,i,j=b.querySelectorAll('iframe[data-secret="'+d.secret+'"]'),k=b.querySelectorAll('blockquote[data-secret="'+d.secret+'"]');for(e=0;e<k.length;e++)k[e].style.display="none";for(e=0;e<j.length;e++)if(f=j[e],c.source===f.contentWindow){if(f.removeAttribute("style"),"height"===d.message){if(g=parseInt(d.value,10),g>1e3)g=1e3;else if(200>~~g)g=200;f.height=g}if("link"===d.message)if(h=b.createElement("a"),i=b.createElement("a"),h.href=f.getAttribute("src"),i.href=d.value,i.host===h.host)if(b.activeElement===f)a.top.location.href=d.value}else;}},d)a.addEventListener("message",a.wp.receiveEmbedMessage,!1),b.addEventListener("DOMContentLoaded",c,!1),a.addEventListener("load",c,!1)}(window,document);
+		!function(a,b){"use strict";function c(){if(!e){e=!0;var a,c,d,f,g=-1!==navigator.appVersion.indexOf("MSIE 10"),h=!!navigator.userAgent.match(/Trident.*rv:11\./),i=b.querySelectorAll("iframe.wp-embedded-content"),j=b.querySelectorAll("blockquote.wp-embedded-content");for(c=0;c<j.length;c++)j[c].style.display="none";for(c=0;c<i.length;c++)if(d=i[c],d.style.display="",!d.getAttribute("data-secret")){if(f=Math.random().toString(36).substr(2,10),d.src+="#?secret="+f,d.setAttribute("data-secret",f),g||h)a=d.cloneNode(!0),a.removeAttribute("security"),d.parentNode.replaceChild(a,d)}else;}}var d=!1,e=!1;if(b.querySelector)if(a.addEventListener)d=!0;if(a.wp=a.wp||{},!a.wp.receiveEmbedMessage)if(a.wp.receiveEmbedMessage=function(c){var d=c.data;if(d.secret||d.message||d.value)if(!/[^a-zA-Z0-9]/.test(d.secret)){var e,f,g,h,i,j=b.querySelectorAll('iframe[data-secret="'+d.secret+'"]'),k=b.querySelectorAll('blockquote[data-secret="'+d.secret+'"]');for(e=0;e<k.length;e++)k[e].style.display="none";for(e=0;e<j.length;e++)if(f=j[e],c.source===f.contentWindow){if(f.style.display="","height"===d.message){if(g=parseInt(d.value,10),g>1e3)g=1e3;else if(200>~~g)g=200;f.height=g}if("link"===d.message)if(h=b.createElement("a"),i=b.createElement("a"),h.href=f.getAttribute("src"),i.href=d.value,i.host===h.host)if(b.activeElement===f)a.top.location.href=d.value}else;}},d)a.addEventListener("message",a.wp.receiveEmbedMessage,!1),b.addEventListener("DOMContentLoaded",c,!1),a.addEventListener("load",c,!1)}(window,document);
 JS;
 	}
 	$output .= "\n//--><!]]>";
@@ -776,7 +776,7 @@ function wp_filter_oembed_result( $result, $data, $url ) {

 	if ( ! empty( $content[1] ) ) {
 		// We have a blockquote to fall back on. Hide the iframe by default.
-		$html = str_replace( '<iframe', '<iframe style="position: absolute; clip: rect(1px, 1px, 1px, 1px);"', $html );
+		$html = str_replace( '<iframe', '<iframe style="display:none;"', $html );
 		$html = str_replace( '<blockquote', '<blockquote class="wp-embedded-content"', $html );
 	}

@@ -952,7 +952,7 @@ function print_embed_scripts() {
 * @return string The filtered content.
 */
 function _oembed_filter_feed_content( $content ) {
-	return str_replace( '<iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);"', '<iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted"', $content );
+	return str_replace( '<iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="display:none;"', '<iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted"', $content );
 }

 /**
@@ -1045,39 +1045,3 @@ function print_embed_sharing_dialog() {
 	</div>
 	<?php
 }
-
-/**
- * Filters the oEmbed result before any HTTP requests are made.
- *
- * If the URL belongs to the current site, the result is fetched directly instead of
- * going through the oEmbed discovery process.
- *
- * @since 4.5.3
- *
- * @param null|string $result The UNSANITIZED (and potentially unsafe) HTML that should be used to embed. Default null.
- * @param string      $url    The URL that should be inspected for discovery `<link>` tags.
- * @param array       $args   oEmbed remote get arguments.
- * @return null|string The UNSANITIZED (and potentially unsafe) HTML that should be used to embed.
- *                     Null if the URL does not belong to the current site.
- */
-function wp_filter_pre_oembed_result( $result, $url, $args ) {
-	$post_id = url_to_postid( $url );
-
-	/** This filter is documented in wp-includes/class-wp-oembed-controller.php */
-	$post_id = apply_filters( 'oembed_request_post_id', $post_id, $url );
-
-	if ( ! $post_id ) {
-		return $result;
-	}
-
-	$width = isset( $args['width'] ) ? $args['width'] : 0;
-
-	$data = get_oembed_response_data( $post_id, $width );
-	$data = _wp_oembed_get_object()->data2html( (object) $data, $url );
-
-	if ( ! $data ) {
-		return $result;
-	}
-
-	return $data;
-}
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -1364,8 +1364,7 @@ function remove_accents( $string ) {
 * operating systems and special characters requiring special escaping
 * to manipulate at the command line. Replaces spaces and consecutive
 * dashes with a single dash. Trims period, dash and underscore from beginning
- * and end of filename. It is not guaranteed that this function will return a
- * filename that is allowed to be uploaded.
+ * and end of filename.
 *
 * @since 2.1.0
 *
@@ -1390,14 +1389,6 @@ function sanitize_file_name( $filename ) {
 	$filename = preg_replace( '/[\r\n\t -]+/', '-', $filename );
 	$filename = trim( $filename, '.-_' );

-	if ( false === strpos( $filename, '.' ) ) {
-		$mime_types = wp_get_mime_types();
-		$filetype = wp_check_filetype( 'test.' . $filename, $mime_types );
-		if ( $filetype['ext'] === $filename ) {
-			$filename = 'unnamed-file.' . $filetype['ext'];
-		}
-	}
-
 	// Split the filename into a base and extension[s]
 	$parts = explode('.', $filename);

@@ -4543,7 +4534,7 @@ function print_emoji_detection_script() {
 		 *
 		 * @param string The emoji base URL.
 		 */
-		'baseUrl' => apply_filters( 'emoji_url', 'https://s.w.org/images/core/emoji/72x72/' ),
+		'baseUrl' => apply_filters( 'emoji_url', set_url_scheme( '//s.w.org/images/core/emoji/72x72/' ) ),

 		/**
 		 * Filter the extension of the emoji files.
@@ -4590,7 +4581,7 @@ function print_emoji_detection_script() {
 		?>
 		<script type="text/javascript">
 			window._wpemojiSettings = <?php echo wp_json_encode( $settings ); ?>;
-			!function(a,b,c){function d(a){var c,d,e,f=b.createElement("canvas"),g=f.getContext&&f.getContext("2d"),h=String.fromCharCode;return g&&g.fillText?(g.textBaseline="top",g.font="600 32px Arial","flag"===a?(g.fillText(h(55356,56806,55356,56826),0,0),f.toDataURL().length>3e3):"diversity"===a?(g.fillText(h(55356,57221),0,0),c=g.getImageData(16,16,1,1).data,g.fillText(h(55356,57221,55356,57343),0,0),c=g.getImageData(16,16,1,1).data,e=c[0]+","+c[1]+","+c[2]+","+c[3],d!==e):("simple"===a?g.fillText(h(55357,56835),0,0):g.fillText(h(55356,57135),0,0),0!==g.getImageData(16,16,1,1).data[0])):!1}function e(a){var c=b.createElement("script");c.src=a,c.type="text/javascript",b.getElementsByTagName("head")[0].appendChild(c)}var f,g;c.supports={simple:d("simple"),flag:d("flag"),unicode8:d("unicode8"),diversity:d("diversity")},c.DOMReady=!1,c.readyCallback=function(){c.DOMReady=!0},c.supports.simple&&c.supports.flag&&c.supports.unicode8&&c.supports.diversity||(g=function(){c.readyCallback()},b.addEventListener?(b.addEventListener("DOMContentLoaded",g,!1),a.addEventListener("load",g,!1)):(a.attachEvent("onload",g),b.attachEvent("onreadystatechange",function(){"complete"===b.readyState&&c.readyCallback()})),f=c.source||{},f.concatemoji?e(f.concatemoji):f.wpemoji&&f.twemoji&&(e(f.twemoji),e(f.wpemoji)))}(window,document,window._wpemojiSettings);
+			!function(a,b,c){function d(a){var c,d=b.createElement("canvas"),e=d.getContext&&d.getContext("2d");return e&&e.fillText?(e.textBaseline="top",e.font="600 32px Arial","flag"===a?(e.fillText(String.fromCharCode(55356,56806,55356,56826),0,0),d.toDataURL().length>3e3):"diversity"===a?(e.fillText(String.fromCharCode(55356,57221),0,0),c=e.getImageData(16,16,1,1).data.toString(),e.fillText(String.fromCharCode(55356,57221,55356,57343),0,0),c!==e.getImageData(16,16,1,1).data.toString()):("simple"===a?e.fillText(String.fromCharCode(55357,56835),0,0):e.fillText(String.fromCharCode(55356,57135),0,0),0!==e.getImageData(16,16,1,1).data[0])):!1}function e(a){var c=b.createElement("script");c.src=a,c.type="text/javascript",b.getElementsByTagName("head")[0].appendChild(c)}var f,g;c.supports={simple:d("simple"),flag:d("flag"),unicode8:d("unicode8"),diversity:d("diversity")},c.DOMReady=!1,c.readyCallback=function(){c.DOMReady=!0},c.supports.simple&&c.supports.flag&&c.supports.unicode8&&c.supports.diversity||(g=function(){c.readyCallback()},b.addEventListener?(b.addEventListener("DOMContentLoaded",g,!1),a.addEventListener("load",g,!1)):(a.attachEvent("onload",g),b.attachEvent("onreadystatechange",function(){"complete"===b.readyState&&c.readyCallback()})),f=c.source||{},f.concatemoji?e(f.concatemoji):f.wpemoji&&f.twemoji&&(e(f.twemoji),e(f.wpemoji)))}(window,document,window._wpemojiSettings);
 		</script>
 		<?php
 	}
@@ -4655,7 +4646,7 @@ function wp_staticize_emoji( $text ) {
 	$text = wp_encode_emoji( $text );

 	/** This filter is documented in wp-includes/formatting.php */
-	$cdn_url = apply_filters( 'emoji_url', 'https://s.w.org/images/core/emoji/72x72/' );
+	$cdn_url = apply_filters( 'emoji_url', set_url_scheme( '//s.w.org/images/core/emoji/72x72/' ) );

 	/** This filter is documented in wp-includes/formatting.php */
 	$ext = apply_filters( 'emoji_ext', '.png' );
--- a/wp-includes/http.php
+++ b/wp-includes/http.php
@@ -527,7 +527,7 @@ function wp_http_validate_url( $url ) {

 	if ( ! $same_host ) {
 		$host = trim( $parsed_url['host'], '.' );
-		if ( preg_match( '#^(([1-9]?\d|1\d\d|25[0-5]|2[0-4]\d)\.){3}([1-9]?\d|1\d\d|25[0-5]|2[0-4]\d)$#', $host ) ) {
+		if ( preg_match( '#^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$#', $host ) ) {
 			$ip = $host;
 		} else {
 			$ip = gethostbyname( $host );
@@ -536,7 +536,7 @@ function wp_http_validate_url( $url ) {
 		}
 		if ( $ip ) {
 			$parts = array_map( 'intval', explode( '.', $ip ) );
-			if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]
+			if ( 127 === $parts[0] || 10 === $parts[0]
 				|| ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
 				|| ( 192 === $parts[0] && 168 === $parts[1] )
 			) {
--- a/wp-includes/js/mediaelement/flashmediaelement.swf
+++ b/wp-includes/js/mediaelement/flashmediaelement.swf
--- a/wp-includes/js/mediaelement/mediaelement-and-player.min.js
+++ b/wp-includes/js/mediaelement/mediaelement-and-player.min.js
--- a/wp-includes/js/plupload/plupload.flash.swf
+++ b/wp-includes/js/plupload/plupload.flash.swf
--- a/wp-includes/js/wp-embed.js
+++ b/wp-includes/js/wp-embed.js
@@ -50,7 +50,7 @@
 				continue;
 			}

-			source.removeAttribute( 'style' );
+			source.style.display = '';

 			/* Resize the iframe on request. */
 			if ( 'height' === data.message ) {
@@ -86,16 +86,21 @@
 		if ( loaded ) {
 			return;
 		}
-
 		loaded = true;

 		var isIE10 = -1 !== navigator.appVersion.indexOf( 'MSIE 10' ),
 			isIE11 = !!navigator.userAgent.match( /Trident.*rv:11\./ ),
 			iframes = document.querySelectorAll( 'iframe.wp-embedded-content' ),
+			blockquotes = document.querySelectorAll( 'blockquote.wp-embedded-content' ),
 			iframeClone, i, source, secret;

+		for ( i = 0; i < blockquotes.length; i++ ) {
+			blockquotes[ i ].style.display = 'none';
+		}
+
 		for ( i = 0; i < iframes.length; i++ ) {
 			source = iframes[ i ];
+			source.style.display = '';

 			if ( source.getAttribute( 'data-secret' ) ) {
 				continue;
--- a/wp-includes/js/wp-embed.min.js
+++ b/wp-includes/js/wp-embed.min.js
@@ -1 +1 @@
-!function(a,b){"use strict";function c(){if(!e){e=!0;var a,c,d,f,g=-1!==navigator.appVersion.indexOf("MSIE 10"),h=!!navigator.userAgent.match(/Trident.*rv:11\./),i=b.querySelectorAll("iframe.wp-embedded-content");for(c=0;c<i.length;c++)if(d=i[c],!d.getAttribute("data-secret")){if(f=Math.random().toString(36).substr(2,10),d.src+="#?secret="+f,d.setAttribute("data-secret",f),g||h)a=d.cloneNode(!0),a.removeAttribute("security"),d.parentNode.replaceChild(a,d)}else;}}var d=!1,e=!1;if(b.querySelector)if(a.addEventListener)d=!0;if(a.wp=a.wp||{},!a.wp.receiveEmbedMessage)if(a.wp.receiveEmbedMessage=function(c){var d=c.data;if(d.secret||d.message||d.value)if(!/[^a-zA-Z0-9]/.test(d.secret)){var e,f,g,h,i,j=b.querySelectorAll('iframe[data-secret="'+d.secret+'"]'),k=b.querySelectorAll('blockquote[data-secret="'+d.secret+'"]');for(e=0;e<k.length;e++)k[e].style.display="none";for(e=0;e<j.length;e++)if(f=j[e],c.source===f.contentWindow){if(f.removeAttribute("style"),"height"===d.message){if(g=parseInt(d.value,10),g>1e3)g=1e3;else if(200>~~g)g=200;f.height=g}if("link"===d.message)if(h=b.createElement("a"),i=b.createElement("a"),h.href=f.getAttribute("src"),i.href=d.value,i.host===h.host)if(b.activeElement===f)a.top.location.href=d.value}else;}},d)a.addEventListener("message",a.wp.receiveEmbedMessage,!1),b.addEventListener("DOMContentLoaded",c,!1),a.addEventListener("load",c,!1)}(window,document);
+!function(a,b){"use strict";function c(){if(!e){e=!0;var a,c,d,f,g=-1!==navigator.appVersion.indexOf("MSIE 10"),h=!!navigator.userAgent.match(/Trident.*rv:11\./),i=b.querySelectorAll("iframe.wp-embedded-content"),j=b.querySelectorAll("blockquote.wp-embedded-content");for(c=0;c<j.length;c++)j[c].style.display="none";for(c=0;c<i.length;c++)if(d=i[c],d.style.display="",!d.getAttribute("data-secret")){if(f=Math.random().toString(36).substr(2,10),d.src+="#?secret="+f,d.setAttribute("data-secret",f),g||h)a=d.cloneNode(!0),a.removeAttribute("security"),d.parentNode.replaceChild(a,d)}else;}}var d=!1,e=!1;if(b.querySelector)if(a.addEventListener)d=!0;if(a.wp=a.wp||{},!a.wp.receiveEmbedMessage)if(a.wp.receiveEmbedMessage=function(c){var d=c.data;if(d.secret||d.message||d.value)if(!/[^a-zA-Z0-9]/.test(d.secret)){var e,f,g,h,i,j=b.querySelectorAll('iframe[data-secret="'+d.secret+'"]'),k=b.querySelectorAll('blockquote[data-secret="'+d.secret+'"]');for(e=0;e<k.length;e++)k[e].style.display="none";for(e=0;e<j.length;e++)if(f=j[e],c.source===f.contentWindow){if(f.style.display="","height"===d.message){if(g=parseInt(d.value,10),g>1e3)g=1e3;else if(200>~~g)g=200;f.height=g}if("link"===d.message)if(h=b.createElement("a"),i=b.createElement("a"),h.href=f.getAttribute("src"),i.href=d.value,i.host===h.host)if(b.activeElement===f)a.top.location.href=d.value}else;}},d)a.addEventListener("message",a.wp.receiveEmbedMessage,!1),b.addEventListener("DOMContentLoaded",c,!1),a.addEventListener("load",c,!1)}(window,document);
--- a/wp-includes/js/wp-emoji-loader.js
+++ b/wp-includes/js/wp-emoji-loader.js
@@ -13,8 +13,7 @@
 	function browserSupportsEmoji( type ) {
 		var canvas = document.createElement( 'canvas' ),
 			context = canvas.getContext && canvas.getContext( '2d' ),
-			stringFromCharCode = String.fromCharCode,
-			tonedata, tone, tone2;
+			tone;

 		if ( ! context || ! context.fillText ) {
 			return false;
@@ -38,7 +37,7 @@
 			 * The first two will encode to small images (1-2KB data URLs), the third will encode
 			 * to a larger image (4-5KB data URL).
 			 */
-			context.fillText( stringFromCharCode( 55356, 56806, 55356, 56826 ), 0, 0 );
+			context.fillText( String.fromCharCode( 55356, 56806, 55356, 56826 ), 0, 0 );
 			return canvas.toDataURL().length > 3000;
 		} else if ( 'diversity' === type ) {
 			/*
@@ -46,16 +45,11 @@
 			 * emoji with no skin tone specified (in this case, Santa). It then adds a skin tone, and
 			 * compares if the emoji rendering has changed.
 			 */
-			context.fillText( stringFromCharCode( 55356, 57221 ), 0, 0 );
-			tonedata = context.getImageData( 16, 16, 1, 1 ).data;
-
-			context.fillText( stringFromCharCode( 55356, 57221, 55356, 57343 ), 0, 0 );
-			// Chrome has issues comparing arrays, and Safari has issues converting arrays to strings.
-			// So, we create our own string and compare that, instead.
-			tonedata = context.getImageData( 16, 16, 1, 1 ).data;
-			tone2 = tonedata[0] + ',' + tonedata[1] + ',' + tonedata[2] + ',' + tonedata[3];
-
-			return tone !== tone2;
+			context.fillText( String.fromCharCode( 55356, 57221 ), 0, 0 );
+			tone = context.getImageData( 16, 16, 1, 1 ).data.toString();
+			context.fillText( String.fromCharCode( 55356, 57221, 55356, 57343 ), 0, 0 );
+			// Chrome has issues comparing arrays, so we compare it as a  string, instead.
+			return tone !== context.getImageData( 16, 16, 1, 1 ).data.toString();
 		} else {
 			if ( 'simple' === type ) {
 				/*
@@ -63,13 +57,13 @@
 				 * center pixel. In browsers that don't support emoji, the character will be rendered
 				 * as an empty square, so the center pixel will be blank.
 				 */
-				context.fillText( stringFromCharCode( 55357, 56835 ), 0, 0 );
+				context.fillText( String.fromCharCode( 55357, 56835 ), 0, 0 );
 			} else {
 				/*
 				 * To check for Unicode 8 support, let's try rendering the most important advancement
 				 * that the Unicode Consortium have made in years: the burrito.
 				 */
-				context.fillText( stringFromCharCode( 55356, 57135 ), 0, 0 );
+				context.fillText( String.fromCharCode( 55356, 57135 ), 0, 0 );
 			}
 			return context.getImageData( 16, 16, 1, 1 ).data[0] !== 0;
 		}
--- a/wp-includes/js/wp-emoji-loader.min.js
+++ b/wp-includes/js/wp-emoji-loader.min.js
@@ -1 +1 @@
-!function(a,b,c){function d(a){var c,d,e,f=b.createElement("canvas"),g=f.getContext&&f.getContext("2d"),h=String.fromCharCode;return g&&g.fillText?(g.textBaseline="top",g.font="600 32px Arial","flag"===a?(g.fillText(h(55356,56806,55356,56826),0,0),f.toDataURL().length>3e3):"diversity"===a?(g.fillText(h(55356,57221),0,0),c=g.getImageData(16,16,1,1).data,g.fillText(h(55356,57221,55356,57343),0,0),c=g.getImageData(16,16,1,1).data,e=c[0]+","+c[1]+","+c[2]+","+c[3],d!==e):("simple"===a?g.fillText(h(55357,56835),0,0):g.fillText(h(55356,57135),0,0),0!==g.getImageData(16,16,1,1).data[0])):!1}function e(a){var c=b.createElement("script");c.src=a,c.type="text/javascript",b.getElementsByTagName("head")[0].appendChild(c)}var f,g;c.supports={simple:d("simple"),flag:d("flag"),unicode8:d("unicode8"),diversity:d("diversity")},c.DOMReady=!1,c.readyCallback=function(){c.DOMReady=!0},c.supports.simple&&c.supports.flag&&c.supports.unicode8&&c.supports.diversity||(g=function(){c.readyCallback()},b.addEventListener?(b.addEventListener("DOMContentLoaded",g,!1),a.addEventListener("load",g,!1)):(a.attachEvent("onload",g),b.attachEvent("onreadystatechange",function(){"complete"===b.readyState&&c.readyCallback()})),f=c.source||{},f.concatemoji?e(f.concatemoji):f.wpemoji&&f.twemoji&&(e(f.twemoji),e(f.wpemoji)))}(window,document,window._wpemojiSettings);
+!function(a,b,c){function d(a){var c,d=b.createElement("canvas"),e=d.getContext&&d.getContext("2d");return e&&e.fillText?(e.textBaseline="top",e.font="600 32px Arial","flag"===a?(e.fillText(String.fromCharCode(55356,56806,55356,56826),0,0),d.toDataURL().length>3e3):"diversity"===a?(e.fillText(String.fromCharCode(55356,57221),0,0),c=e.getImageData(16,16,1,1).data.toString(),e.fillText(String.fromCharCode(55356,57221,55356,57343),0,0),c!==e.getImageData(16,16,1,1).data.toString()):("simple"===a?e.fillText(String.fromCharCode(55357,56835),0,0):e.fillText(String.fromCharCode(55356,57135),0,0),0!==e.getImageData(16,16,1,1).data[0])):!1}function e(a){var c=b.createElement("script");c.src=a,c.type="text/javascript",b.getElementsByTagName("head")[0].appendChild(c)}var f,g;c.supports={simple:d("simple"),flag:d("flag"),unicode8:d("unicode8"),diversity:d("diversity")},c.DOMReady=!1,c.readyCallback=function(){c.DOMReady=!0},c.supports.simple&&c.supports.flag&&c.supports.unicode8&&c.supports.diversity||(g=function(){c.readyCallback()},b.addEventListener?(b.addEventListener("DOMContentLoaded",g,!1),a.addEventListener("load",g,!1)):(a.attachEvent("onload",g),b.attachEvent("onreadystatechange",function(){"complete"===b.readyState&&c.readyCallback()})),f=c.source||{},f.concatemoji?e(f.concatemoji):f.wpemoji&&f.twemoji&&(e(f.twemoji),e(f.wpemoji)))}(window,document,window._wpemojiSettings);
--- a/wp-includes/js/wp-emoji-release.min.js
+++ b/wp-includes/js/wp-emoji-release.min.js
--- a/wp-includes/js/wp-emoji.js
+++ b/wp-includes/js/wp-emoji.js
@@ -15,8 +15,7 @@
 		// Private
 		twemoji, timer,
 		loaded = false,
-		count = 0,
-		ie11 = window.navigator.userAgent.indexOf( 'Trident/7.0' ) > 0;
+		count = 0;

 		/**
 		 * Runs when the document load event is fired, so we can do our first parse of the page.
@@ -69,23 +68,6 @@
 							node = addedNodes[ ii ];

 							if ( node.nodeType === 3 ) {
-								if ( ! node.parentNode ) {
-									continue;
-								}
-
-								if ( ie11 ) {
-									/*
-									 * IE 11's implementation of MutationObserver is buggy.
-									 * It unnecessarily splits text nodes when it encounters a HTML
-									 * template interpolation symbol ( "{{", for example ). So, we
-									 * join the text nodes back together as a work-around.
-									 */
-									while( node.nextSibling && 3 === node.nextSibling.nodeType ) {
-										node.nodeValue = node.nodeValue + node.nextSibling.nodeValue;
-										node.parentNode.removeChild( node.nextSibling );
-									}
-								}
-
 								node = node.parentNode;
 							}

--- a/wp-includes/js/wp-emoji.min.js
+++ b/wp-includes/js/wp-emoji.min.js
@@ -1 +1 @@
-!function(a,b){function c(){function c(){if(!j){if("undefined"==typeof a.twemoji){if(k>600)return;return a.clearTimeout(g),g=a.setTimeout(c,50),void k++}f=a.twemoji,j=!0,h&&new h(function(a){for(var b,c,f,g,h=a.length;h--;){if(b=a[h].addedNodes,c=a[h].removedNodes,f=b.length,1===f&&1===c.length&&3===b[0].nodeType&&"IMG"===c[0].nodeName&&b[0].data===c[0].alt&&"load-failed"===c[0].getAttribute("data-error"))return;for(;f--;){if(g=b[f],3===g.nodeType){if(!g.parentNode)continue;if(l)for(;g.nextSibling&&3===g.nextSibling.nodeType;)g.nodeValue=g.nodeValue+g.nextSibling.nodeValue,g.parentNode.removeChild(g.nextSibling);g=g.parentNode}!g||1!==g.nodeType||g.className&&"string"==typeof g.className&&-1!==g.className.indexOf("wp-exclude-emoji")||d(g.textContent)&&e(g)}}}).observe(document.body,{childList:!0,subtree:!0}),e(document.body)}}function d(a){var b=/[\u203C\u2049\u20E3\u2122\u2139\u2194-\u2199\u21A9\u21AA\u2300\u231A\u231B\u2328\u2388\u23CF\u23E9-\u23F3\u23F8-\u23FA\u24C2\u25AA\u25AB\u25B6\u25C0\u25FB-\u25FE\u2600-\u2604\u260E\u2611\u2614\u2615\u2618\u261D\u2620\u2622\u2623\u2626\u262A\u262E\u262F\u2638\u2639\u263A\u2648-\u2653\u2660\u2663\u2665\u2666\u2668\u267B\u267F\u2692\u2693\u2694\u2696\u2697\u2699\u269B\u269C\u26A0\u26A1\u26AA\u26AB\u26B0\u26B1\u26BD\u26BE\u26C4\u26C5\u26C8\u26CE\u26CF\u26D1\u26D3\u26D4\u26E9\u26EA\u26F0-\u26F5\u26F7-\u26FA\u26FD\u2702\u2705\u2708-\u270D\u270F\u2712\u2714\u2716\u271D\u2721\u2728\u2733\u2734\u2744\u2747\u274C\u274E\u2753\u2754\u2755\u2757\u2763\u2764\u2795\u2796\u2797\u27A1\u27B0\u27BF\u2934\u2935\u2B05\u2B06\u2B07\u2B1B\u2B1C\u2B50\u2B55\u3030\u303D\u3297\u3299]/,c=/[\uDC00-\uDFFF]/;return a?c.test(a)||b.test(a):!1}function e(a,c){var d;return i&&f&&a&&("string"==typeof a||a.childNodes&&a.childNodes.length)?(c=c||{},d={base:b.baseUrl,ext:b.ext,className:c.className||"emoji",callback:function(a,c){switch(a){case"a9":case"ae":case"2122":case"2194":case"2660":case"2663":case"2665":case"2666":return!1}return!b.supports.flag&&b.supports.simple&&b.supports.unicode8&&b.supports.diversity&&!/^1f1(?:e[6-9a-f]|f[0-9a-f])-1f1(?:e[6-9a-f]|f[0-9a-f])$/.test(a)?!1:"".concat(c.base,a,c.ext)},onerror:function(){f.parentNode&&(this.setAttribute("data-error","load-failed"),f.parentNode.replaceChild(document.createTextNode(f.alt),f))}},"object"==typeof c.imgAttr&&(d.attributes=function(){return c.imgAttr}),f.parse(a,d)):a}var f,g,h=a.MutationObserver||a.WebKitMutationObserver||a.MozMutationObserver,i=!1,j=!1,k=0,l=a.navigator.userAgent.indexOf("Trident/7.0")>0;return b&&(i=!(b.supports.simple&&b.supports.flag&&b.supports.unicode8&&b.supports.diversity),b.DOMReady?c():b.readyCallback=c),{replaceEmoji:i,parse:e,test:d}}a.wp=a.wp||{},a.wp.emoji=new c}(window,window._wpemojiSettings);
+!function(a,b){function c(){function c(){if(!j){if("undefined"==typeof a.twemoji){if(k>600)return;return a.clearTimeout(g),g=a.setTimeout(c,50),void k++}f=a.twemoji,j=!0,h&&new h(function(a){for(var b,c,f,g,h=a.length;h--;){if(b=a[h].addedNodes,c=a[h].removedNodes,f=b.length,1===f&&1===c.length&&3===b[0].nodeType&&"IMG"===c[0].nodeName&&b[0].data===c[0].alt&&"load-failed"===c[0].getAttribute("data-error"))return;for(;f--;)g=b[f],3===g.nodeType&&(g=g.parentNode),!g||1!==g.nodeType||g.className&&"string"==typeof g.className&&-1!==g.className.indexOf("wp-exclude-emoji")||d(g.textContent)&&e(g)}}).observe(document.body,{childList:!0,subtree:!0}),e(document.body)}}function d(a){var b=/[\u203C\u2049\u20E3\u2122\u2139\u2194-\u2199\u21A9\u21AA\u2300\u231A\u231B\u2328\u2388\u23CF\u23E9-\u23F3\u23F8-\u23FA\u24C2\u25AA\u25AB\u25B6\u25C0\u25FB-\u25FE\u2600-\u2604\u260E\u2611\u2614\u2615\u2618\u261D\u2620\u2622\u2623\u2626\u262A\u262E\u262F\u2638\u2639\u263A\u2648-\u2653\u2660\u2663\u2665\u2666\u2668\u267B\u267F\u2692\u2693\u2694\u2696\u2697\u2699\u269B\u269C\u26A0\u26A1\u26AA\u26AB\u26B0\u26B1\u26BD\u26BE\u26C4\u26C5\u26C8\u26CE\u26CF\u26D1\u26D3\u26D4\u26E9\u26EA\u26F0-\u26F5\u26F7-\u26FA\u26FD\u2702\u2705\u2708-\u270D\u270F\u2712\u2714\u2716\u271D\u2721\u2728\u2733\u2734\u2744\u2747\u274C\u274E\u2753\u2754\u2755\u2757\u2763\u2764\u2795\u2796\u2797\u27A1\u27B0\u27BF\u2934\u2935\u2B05\u2B06\u2B07\u2B1B\u2B1C\u2B50\u2B55\u3030\u303D\u3297\u3299]/,c=/[\uDC00-\uDFFF]/;return a?c.test(a)||b.test(a):!1}function e(a,c){var d;return i&&f&&a&&("string"==typeof a||a.childNodes&&a.childNodes.length)?(c=c||{},d={base:b.baseUrl,ext:b.ext,className:c.className||"emoji",callback:function(a,c){switch(a){case"a9":case"ae":case"2122":case"2194":case"2660":case"2663":case"2665":case"2666":return!1}return!b.supports.flag&&b.supports.simple&&b.supports.unicode8&&b.supports.diversity&&!/^1f1(?:e[6-9a-f]|f[0-9a-f])-1f1(?:e[6-9a-f]|f[0-9a-f])$/.test(a)?!1:"".concat(c.base,a,c.ext)},onerror:function(){f.parentNode&&(this.setAttribute("data-error","load-failed"),f.parentNode.replaceChild(document.createTextNode(f.alt),f))}},"object"==typeof c.imgAttr&&(d.attributes=function(){return c.imgAttr}),f.parse(a,d)):a}var f,g,h=a.MutationObserver||a.WebKitMutationObserver||a.MozMutationObserver,i=!1,j=!1,k=0;return b&&(i=!(b.supports.simple&&b.supports.flag&&b.supports.unicode8&&b.supports.diversity),b.DOMReady?c():b.readyCallback=c),{replaceEmoji:i,parse:e,test:d}}a.wp=a.wp||{},a.wp.emoji=new c}(window,window._wpemojiSettings);
--- a/wp-includes/kses.php
+++ b/wp-includes/kses.php
@@ -1580,19 +1580,6 @@ function wp_kses_post( $data ) {
 	return wp_kses( $data, 'post' );
 }

-/**
- * Navigates through an array, object, or scalar, and sanitizes content for
- * allowed HTML tags for post content.
- *
- * @since 4.4.2
- *
- * @param mixed $value The array or string to filter.
- * @return mixed $value The filtered content.
- */
-function wp_kses_post_deep( $data ) {
-	return map_deep( $data, 'wp_kses_post' );
-}
-
 /**
 * Strips all of the HTML in the content.
 *
--- a/wp-includes/load.php
+++ b/wp-includes/load.php
@@ -473,7 +473,7 @@ function wp_start_object_cache() {
 		wp_cache_init();

 	if ( function_exists( 'wp_cache_add_global_groups' ) ) {
-		wp_cache_add_global_groups( array( 'users', 'userlogins', 'usermeta', 'user_meta', 'useremail', 'userslugs', 'site-transient', 'site-options', 'site-lookup', 'blog-lookup', 'blog-details', 'rss', 'global-posts', 'blog-id-cache', 'networks' ) );
+		wp_cache_add_global_groups( array( 'users', 'userlogins', 'usermeta', 'user_meta', 'useremail', 'userslugs', 'site-transient', 'site-options', 'site-lookup', 'blog-lookup', 'blog-details', 'rss', 'global-posts', 'blog-id-cache' ) );
 		wp_cache_add_non_persistent_groups( array( 'comment', 'counts', 'plugins' ) );
 	}
 }
--- a/wp-includes/ms-blogs.php
+++ b/wp-includes/ms-blogs.php
@@ -654,7 +654,7 @@ function switch_to_blog( $new_blog, $deprecated = null ) {
 			if ( is_array( $global_groups ) ) {
 				wp_cache_add_global_groups( $global_groups );
 			} else {
-				wp_cache_add_global_groups( array( 'users', 'userlogins', 'usermeta', 'user_meta', 'useremail', 'userslugs', 'site-transient', 'site-options', 'site-lookup', 'blog-lookup', 'blog-details', 'rss', 'global-posts', 'blog-id-cache', 'networks' ) );
+				wp_cache_add_global_groups( array( 'users', 'userlogins', 'usermeta', 'user_meta', 'useremail', 'userslugs', 'site-transient', 'site-options', 'site-lookup', 'blog-lookup', 'blog-details', 'rss', 'global-posts', 'blog-id-cache' ) );
 			}
 			wp_cache_add_non_persistent_groups( array( 'comment', 'counts', 'plugins' ) );
 		}
@@ -725,7 +725,7 @@ function restore_current_blog() {
 			if ( is_array( $global_groups ) ) {
 				wp_cache_add_global_groups( $global_groups );
 			} else {
-				wp_cache_add_global_groups( array( 'users', 'userlogins', 'usermeta', 'user_meta', 'useremail', 'userslugs', 'site-transient', 'site-options', 'site-lookup', 'blog-lookup', 'blog-details', 'rss', 'global-posts', 'blog-id-cache', 'networks' ) );
+				wp_cache_add_global_groups( array( 'users', 'userlogins', 'usermeta', 'user_meta', 'useremail', 'userslugs', 'site-transient', 'site-options', 'site-lookup', 'blog-lookup', 'blog-details', 'rss', 'global-posts', 'blog-id-cache' ) );
 			}
 			wp_cache_add_non_persistent_groups( array( 'comment', 'counts', 'plugins' ) );
 		}
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -541,7 +541,7 @@ function wp_mail( $to, $subject, $message, $headers = '', $attachments = array()
 		return $phpmailer->Send();
 	} catch ( phpmailerException $e ) {

-		$mail_error_data = compact( 'to', 'subject', 'message', 'headers', 'attachments' );
+		$mail_error_data = compact( $to, $subject, $message, $headers, $attachments );

 		/**
 		 * Fires after a phpmailerException is caught.
@@ -1041,14 +1041,18 @@ function auth_redirect() {
 		}
 	}

-	/**
-	 * Filters the authentication redirect scheme.
-	 *
-	 * @since 2.9.0
-	 *
-	 * @param string $scheme Authentication redirect scheme. Default empty.
-	 */
-	$scheme = apply_filters( 'auth_redirect_scheme', '' );
+	if ( is_user_admin() ) {
+		$scheme = 'logged_in';
+	} else {
+		/**
+		 * Filter the authentication redirect scheme.
+		 *
+		 * @since 2.9.0
+		 *
+		 * @param string $scheme Authentication redirect scheme. Default empty.
+		 */
+		$scheme = apply_filters( 'auth_redirect_scheme', '' );
+	}

 	if ( $user_id = wp_validate_auth_cookie( '',  $scheme) ) {
 		/**
@@ -1329,8 +1333,7 @@ function wp_validate_redirect($location, $default = '') {
 	// In php 5 parse_url may fail if the URL query part contains http://, bug #38143
 	$test = ( $cut = strpos($location, '?') ) ? substr( $location, 0, $cut ) : $location;

-	// @-operator is used to prevent possible warnings in PHP < 5.3.3.
-	$lp = @parse_url($test);
+	$lp  = parse_url($test);

 	// Give up if malformed URL
 	if ( false === $lp )
@@ -1340,17 +1343,9 @@ function wp_validate_redirect($location, $default = '') {
 	if ( isset($lp['scheme']) && !('http' == $lp['scheme'] || 'https' == $lp['scheme']) )
 		return $default;

-	// Reject if certain components are set but host is not. This catches urls like https:host.com for which parse_url does not set the host field.
-	if ( ! isset( $lp['host'] ) && ( isset( $lp['scheme'] ) || isset( $lp['user'] ) || isset( $lp['pass'] ) || isset( $lp['port'] ) ) ) {
+	// Reject if scheme is set but host is not. This catches urls like https:host.com for which parse_url does not set the host field.
+	if ( isset($lp['scheme'])  && !isset($lp['host']) )
 		return $default;
-	}
-
-	// Reject malformed components parse_url() can return on odd inputs
-	foreach ( array( 'user', 'pass', 'host' ) as $component ) {
-		if ( isset( $lp[ $component ] ) && strpbrk( $lp[ $component ], ':/?#@' ) ) {
-			return $default;
-		}
-	}

 	$wpp = parse_url(home_url());

--- a/wp-includes/post-template.php
+++ b/wp-includes/post-template.php
@@ -1447,7 +1447,7 @@ function wp_get_attachment_link( $id = 0, $size = 'thumbnail', $permalink = fals
 	 * @param bool         $icon      Whether to include an icon. Default false.
 	 * @param string|bool  $text      If string, will be link text. Default false.
 	 */
-	return apply_filters( 'wp_get_attachment_link', "<a href='" . esc_url( $url ) . "'>$link_text</a>", $id, $size, $permalink, $icon, $text );
+	return apply_filters( 'wp_get_attachment_link', "<a href='$url'>$link_text</a>", $id, $size, $permalink, $icon, $text );
 }

 /**
--- a/wp-includes/query.php
+++ b/wp-includes/query.php
@@ -2231,8 +2231,8 @@ class WP_Query {
 			else
 				$term = trim( $term, "\"' " );

-			// Avoid single A-Z and single dashes.
-			if ( ! $term || ( 1 === strlen( $term ) && preg_match( '/^[a-z\-]$/i', $term ) ) )
+			// Avoid single A-Z.
+			if ( ! $term || ( 1 === strlen( $term ) && preg_match( '/^[a-z]$/i', $term ) ) )
 				continue;

 			if ( in_array( call_user_func( $strtolower, $term ), $stopwords, true ) )
@@ -2300,7 +2300,7 @@ class WP_Query {
 				$like = '%' . $wpdb->esc_like( $q['s'] ) . '%';
 			}

-			$search_orderby = '';
+			$search_orderby = '(CASE ';

 			// sentence match in 'post_title'
 			if ( $like ) {
@@ -2321,10 +2321,7 @@ class WP_Query {
 			if ( $like ) {
 				$search_orderby .= $wpdb->prepare( "WHEN $wpdb->posts.post_content LIKE %s THEN 4 ", $like );
 			}
-
-			if ( $search_orderby ) {
-				$search_orderby = '(CASE ' . $search_orderby . 'ELSE 5 END)';
-			}
+			$search_orderby .= 'ELSE 5 END)';
 		} else {
 			// single word or sentence search
 			$search_orderby = reset( $q['search_orderby_title'] ) . ' DESC';
@@ -4984,11 +4981,16 @@ class WP_Query {
 *
 * @global WP_Query   $wp_query   Global WP_Query instance.
 * @global wpdb       $wpdb       WordPress database abstraction object.
+ * @global WP_Rewrite $wp_rewrite WordPress rewrite component.
 */
 function wp_old_slug_redirect() {
-	global $wp_query;
+	global $wp_query, $wp_rewrite;

-	if ( is_404() && '' !== $wp_query->query_vars['name'] ) :
+	if ( get_queried_object() ) {
+		return;
+	}
+
+	if ( '' !== $wp_query->query_vars['name'] ) :
 		global $wpdb;

 		// Guess the current post_type based on the query vars.
@@ -5030,10 +5032,19 @@ function wp_old_slug_redirect() {

 		$link = get_permalink( $id );

-		if ( isset( $GLOBALS['wp_query']->query_vars['paged'] ) && $GLOBALS['wp_query']->query_vars['paged'] > 1 ) {
+		if ( is_feed() ) {
+			$link = user_trailingslashit( trailingslashit( $link ) . 'feed' );
+		} elseif ( isset( $GLOBALS['wp_query']->query_vars['paged'] ) && $GLOBALS['wp_query']->query_vars['paged'] > 1 ) {
 			$link = user_trailingslashit( trailingslashit( $link ) . 'page/' . $GLOBALS['wp_query']->query_vars['paged'] );
 		} elseif( is_embed() ) {
 			$link = user_trailingslashit( trailingslashit( $link ) . 'embed' );
+		} elseif ( is_404() ) {
+			// Add rewrite endpoints if necessary.
+			foreach ( $wp_rewrite->endpoints as $endpoint ) {
+				if ( $endpoint[2] && false !== get_query_var( $endpoint[2], false ) ) {
+					$link = user_trailingslashit( trailingslashit( $link ) . $endpoint[1] );
+				}
+			}
 		}

 		/**
--- a/wp-includes/random_compat/random.php
+++ b/wp-includes/random_compat/random.php
@@ -56,7 +56,7 @@ if (PHP_VERSION_ID < 70000) {
         * 
         * See ERRATA.md for our reasoning behind this particular order
         */
-        if (PHP_VERSION_ID >= 50300 && extension_loaded('libsodium') && function_exists('\\Sodium\\randombytes_buf')) {
+        if (extension_loaded('libsodium')) {
            // See random_bytes_libsodium.php
            require_once $RandomCompatDIR.'/random_bytes_libsodium.php';
        }
--- a/wp-includes/script-loader.php
+++ b/wp-includes/script-loader.php
@@ -330,7 +330,7 @@ function wp_default_scripts( &$scripts ) {

 	$scripts->add( 'imgareaselect', "/wp-includes/js/imgareaselect/jquery.imgareaselect$suffix.js", array('jquery'), false, 1 );

-	$scripts->add( 'mediaelement', "/wp-includes/js/mediaelement/mediaelement-and-player.min.js", array('jquery'), '2.18.1-a', 1 );
+	$scripts->add( 'mediaelement', "/wp-includes/js/mediaelement/mediaelement-and-player.min.js", array('jquery'), '2.18.1', 1 );
 	did_action( 'init' ) && $scripts->localize( 'mediaelement', 'mejsL10n', array(
 		'language' => get_bloginfo( 'language' ),
 		'strings'  => array(
--- a/wp-includes/taxonomy.php
+++ b/wp-includes/taxonomy.php
@@ -676,7 +676,7 @@ function get_objects_in_term( $term_ids, $taxonomies, $args = array() ) {

 	$term_ids = array_map('intval', $term_ids );

-	$taxonomies = "'" . implode( "', '", array_map( 'esc_sql', $taxonomies ) ) . "'";
+	$taxonomies = "'" . implode( "', '", $taxonomies ) . "'";
 	$term_ids = "'" . implode( "', '", $term_ids ) . "'";

 	$object_ids = $wpdb->get_col("SELECT tr.object_id FROM $wpdb->term_relationships AS tr INNER JOIN $wpdb->term_taxonomy AS tt ON tr.term_taxonomy_id = tt.term_taxonomy_id WHERE tt.taxonomy IN ($taxonomies) AND tt.term_id IN ($term_ids) ORDER BY tr.object_id $order");
@@ -875,7 +875,7 @@ function get_term_by( $field, $value, $taxonomy = '', $output = OBJECT, $filter
 		return $term;
 	}

-	$term = $wpdb->get_row( $wpdb->prepare( "SELECT t.*, tt.* FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy AS tt ON t.term_id = tt.term_id WHERE $_field = %s", $value ) . " $tax_clause LIMIT 1" );
+	$term = $wpdb->get_row( $wpdb->prepare( "SELECT t.*, tt.* FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy AS tt ON t.term_id = tt.term_id WHERE $_field = %s $tax_clause LIMIT 1", $value ) );
 	if ( ! $term )
 		return false;

@@ -1230,7 +1230,7 @@ function get_terms( $taxonomies, $args = '' ) {
 		$order = 'ASC';
 	}

-	$where = "tt.taxonomy IN ('" . implode("', '", array_map( 'esc_sql', $taxonomies ) ) . "')";
+	$where = "tt.taxonomy IN ('" . implode("', '", $taxonomies) . "')";

 	$exclude = $args['exclude'];
 	$exclude_tree = $args['exclude_tree'];
@@ -2359,7 +2359,7 @@ function wp_get_object_terms($object_ids, $taxonomies, $args = array()) {

 	$taxonomy_array = $taxonomies;
 	$object_id_array = $object_ids;
-	$taxonomies = "'" . implode("', '", array_map( 'esc_sql', $taxonomies ) ) . "'";
+	$taxonomies = "'" . implode("', '", $taxonomies) . "'";
 	$object_ids = implode(', ', $object_ids);

 	$select_this = '';
@@ -3646,7 +3646,7 @@ function update_object_term_cache($object_ids, $object_type) {
 function update_term_cache( $terms, $taxonomy = '' ) {
 	foreach ( (array) $terms as $term ) {
 		// Create a copy in case the array was passed by reference.
-		$_term = clone $term;
+		$_term = $term;

 		// Object ID should not be cached.
 		unset( $_term->object_id );
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
 *
 * @global string $wp_version
 */
-$wp_version = '4.4.4';
+$wp_version = '4.4.1';

 /**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.