Tag 4.5.20

Built from https://develop.svn.wordpress.org/tags/4.5.20@46945 git-svn-id: http://core.svn.wordpress.org/tags/4.5.20@46745 1a063a9b-81f0-0310-95a4-ce76da25c4cd
WordPress 4.5.20
2019-12-12 21:13:07 +00:00 · 2019-12-12 20:30:20 +00:00 · 2019-12-12 18:45:22 +00:00 · 2019-10-14 20:11:21 +00:00 · 2019-10-14 19:07:24 +00:00 · 2019-09-04 22:04:22 +00:00
32 changed files with 561 additions and 153 deletions
--- a/license.txt
+++ b/license.txt
@@ -1,6 +1,6 @@
 WordPress - Web publishing software

-Copyright 2011-2017 by the contributors
+Copyright 2011-2018 by the contributors

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
--- a/readme.html
+++ b/readme.html
@@ -9,7 +9,6 @@
 <body>
 <h1 id="logo">
 	<a href="https://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
-	<br /> Version 4.5.10
 </h1>
 <p style="text-align: center">Semantic Personal Publishing Platform</p>

--- a/wp-activate.php
+++ b/wp-activate.php
@@ -18,6 +18,50 @@ if ( !is_multisite() ) {
 	die();
 }

+$valid_error_codes = array( 'already_active', 'blog_taken' );
+
+list( $activate_path ) = explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) );
+$activate_cookie = 'wp-activate-' . COOKIEHASH;
+
+$key    = '';
+$result = null;
+
+if ( isset( $_GET['key'] ) && isset( $_POST['key'] ) && $_GET['key'] !== $_POST['key'] ) {
+	wp_die( __( 'A key value mismatch has been detected. Please follow the link provided in your activation email.' ), __( 'An error occurred during the activation' ), 400 );
+} elseif ( ! empty( $_GET['key'] ) ) {
+	$key = $_GET['key'];
+} elseif ( ! empty( $_POST['key'] ) ) {
+	$key = $_POST['key'];
+}
+
+if ( $key ) {
+	$redirect_url = remove_query_arg( 'key' );
+
+	if ( $redirect_url !== remove_query_arg( false ) ) {
+		setcookie( $activate_cookie, $key, 0, $activate_path, COOKIE_DOMAIN, is_ssl(), true );
+		wp_safe_redirect( $redirect_url );
+		exit;
+	} else {
+		$result = wpmu_activate_signup( $key );
+	}
+}
+
+if ( $result === null && isset( $_COOKIE[ $activate_cookie ] ) ) {
+	$key    = $_COOKIE[ $activate_cookie ];
+	$result = wpmu_activate_signup( $key );
+	setcookie( $activate_cookie, ' ', time() - YEAR_IN_SECONDS, $activate_path, COOKIE_DOMAIN, is_ssl(), true );
+}
+
+if ( $result === null || ( is_wp_error( $result ) && 'invalid_key' === $result->get_error_code() ) ) {
+	status_header( 404 );
+} elseif ( is_wp_error( $result ) ) {
+	$error_code = $result->get_error_code();
+
+	if ( ! in_array( $error_code, $valid_error_codes ) ) {
+		status_header( 400 );
+	}
+}
+
 if ( is_object( $wp_object_cache ) )
 	$wp_object_cache->cache_enabled = false;

@@ -63,13 +107,14 @@ function wpmu_activate_stylesheet() {
 	<?php
 }
 add_action( 'wp_head', 'wpmu_activate_stylesheet' );
+add_action( 'wp_head', 'wp_sensitive_page_meta' );

 get_header( 'wp-activate' );
 ?>

 <div id="signup-content" class="widecolumn">
 	<div class="wp-activate-container">
-	<?php if ( empty($_GET['key']) && empty($_POST['key']) ) { ?>
+	<?php if ( ! $key ) { ?>

 		<h2><?php _e('Activation Key Required') ?></h2>
 		<form name="activateform" id="activateform" method="post" action="<?php echo network_site_url('wp-activate.php'); ?>">
@@ -83,28 +128,25 @@ get_header( 'wp-activate' );
 		</form>

 	<?php } else {
-
-		$key = !empty($_GET['key']) ? $_GET['key'] : $_POST['key'];
-		$result = wpmu_activate_signup( $key );
-		if ( is_wp_error($result) ) {
-			if ( 'already_active' == $result->get_error_code() || 'blog_taken' == $result->get_error_code() ) {
-			    $signup = $result->get_error_data();
-				?>
-				<h2><?php _e('Your account is now active!'); ?></h2>
-				<?php
-				echo '<p class="lead-in">';
-				if ( $signup->domain . $signup->path == '' ) {
-					printf( __('Your account has been activated. You may now <a href="%1$s">log in</a> to the site using your chosen username of &#8220;%2$s&#8221;. Please check your email inbox at %3$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%4$s">reset your password</a>.'), network_site_url( 'wp-login.php', 'login' ), $signup->user_login, $signup->user_email, wp_lostpassword_url() );
-				} else {
-					printf( __('Your site at <a href="%1$s">%2$s</a> is active. You may now log in to your site using your chosen username of &#8220;%3$s&#8221;. Please check your email inbox at %4$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%5$s">reset your password</a>.'), 'http://' . $signup->domain, $signup->domain, $signup->user_login, $signup->user_email, wp_lostpassword_url() );
-				}
-				echo '</p>';
+		if ( is_wp_error( $result ) && in_array( $result->get_error_code(), $valid_error_codes ) ) {
+			$signup = $result->get_error_data();
+			?>
+			<h2><?php _e('Your account is now active!'); ?></h2>
+			<?php
+			echo '<p class="lead-in">';
+			if ( $signup->domain . $signup->path == '' ) {
+				printf( __('Your account has been activated. You may now <a href="%1$s">log in</a> to the site using your chosen username of &#8220;%2$s&#8221;. Please check your email inbox at %3$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%4$s">reset your password</a>.'), network_site_url( 'wp-login.php', 'login' ), $signup->user_login, $signup->user_email, wp_lostpassword_url() );
 			} else {
-				?>
-				<h2><?php _e('An error occurred during the activation'); ?></h2>
-				<?php
-			    echo '<p>'.$result->get_error_message().'</p>';
+				printf( __('Your site at <a href="%1$s">%2$s</a> is active. You may now log in to your site using your chosen username of &#8220;%3$s&#8221;. Please check your email inbox at %4$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%5$s">reset your password</a>.'), 'http://' . $signup->domain, $signup->domain, $signup->user_login, $signup->user_email, wp_lostpassword_url() );
 			}
+			echo '</p>';
+		} elseif ( $result === null || is_wp_error( $result ) ) {
+			?>
+			<h2><?php _e('An error occurred during the activation'); ?></h2>
+			<?php if ( is_wp_error( $result ) ) {
+				echo '<p>' . $result->get_error_message() . '</p>';
+			} ?>
+			<?php
 		} else {
 			$url = isset( $result['blog_id'] ) ? get_blogaddress_by_id( (int) $result['blog_id'] ) : '';
 			$user = get_userdata( (int) $result['user_id'] );
--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -40,6 +40,108 @@ include( ABSPATH . 'wp-admin/admin-header.php' );

 		<div class="changelog point-releases">
 			<h3><?php _e( 'Maintenance and Security Releases' ); ?></h3>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed one security issue.' ),
+					'4.5.20'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.5.20' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed some security issues.' ),
+					'4.5.19'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.5.19' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				printf(
+				/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed some security issues.' ),
+					'4.5.18'
+				);
+				?>
+				<?php
+				printf(
+				/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+					/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.5.18' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed some security issues.' ),
+					'4.5.17'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.5.17' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				/* translators: %s: WordPress version number */
+				printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.5.16' );
+				?>
+				<?php
+				/* translators: %s: Codex URL */
+				printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.5.16' );
+				?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed one security issue.' ), '4.5.15' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.5.15' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.5.14' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.5.14' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed one security issue.' ), '4.5.13' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.5.13' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.5.12' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.5.12' ); ?>
+			</p>
 			<p><?php printf( __( '<strong>Version %s</strong> addressed one security issue.' ), '4.5.11' ); ?>
 				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.5.11' ); ?>
 			</p>
--- a/wp-admin/async-upload.php
+++ b/wp-admin/async-upload.php
@@ -32,7 +32,7 @@ if ( ! ( isset( $_REQUEST['action'] ) && 'upload-attachment' == $_REQUEST['actio

 require_once( ABSPATH . 'wp-admin/admin.php' );

-header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) );
+header( 'Content-Type: text/plain; charset=' . get_option( 'blog_charset' ) );

 if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) {
 	include( ABSPATH . 'wp-admin/includes/ajax-actions.php' );
--- a/wp-admin/includes/ajax-actions.php
+++ b/wp-admin/includes/ajax-actions.php
@@ -1009,6 +1009,8 @@ function wp_ajax_replyto_comment( $action ) {
 			if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {
 				kses_remove_filters(); // start with a clean slate
 				kses_init_filters(); // set up the filters
+				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+				add_filter( 'pre_comment_content', 'wp_filter_kses' );
 			}
 		}
 	} else {
@@ -2002,7 +2004,7 @@ function wp_ajax_upload_attachment() {
 			'success' => false,
 			'data'    => array(
 				'message'  => __( 'You do not have permission to upload files.' ),
-				'filename' => $_FILES['async-upload']['name'],
+				'filename' => esc_html( $_FILES['async-upload']['name'] ),
 			)
 		) );

@@ -2016,7 +2018,7 @@ function wp_ajax_upload_attachment() {
 				'success' => false,
 				'data'    => array(
 					'message'  => __( "You don't have permission to attach files to this post." ),
-					'filename' => $_FILES['async-upload']['name'],
+					'filename' => esc_html( $_FILES['async-upload']['name'] ),
 				)
 			) );

@@ -2026,7 +2028,11 @@ function wp_ajax_upload_attachment() {
 		$post_id = null;
 	}

-	$post_data = isset( $_REQUEST['post_data'] ) ? $_REQUEST['post_data'] : array();
+	$post_data = ! empty( $_REQUEST['post_data'] ) ? _wp_get_allowed_postdata( _wp_translate_postdata( false, (array) $_REQUEST['post_data'] ) ) : array();
+
+	if ( is_wp_error( $post_data ) ) {
+		wp_die( $post_data->get_error_message() );
+	}

 	// If the context is custom header or background, make sure the uploaded file is an image.
 	if ( isset( $post_data['context'] ) && in_array( $post_data['context'], array( 'custom-header', 'custom-background' ) ) ) {
@@ -2036,7 +2042,7 @@ function wp_ajax_upload_attachment() {
 				'success' => false,
 				'data'    => array(
 					'message'  => __( 'The uploaded file is not a valid image. Please try again.' ),
-					'filename' => $_FILES['async-upload']['name'],
+					'filename' => esc_html( $_FILES['async-upload']['name'] ),
 				)
 			) );

@@ -2051,7 +2057,7 @@ function wp_ajax_upload_attachment() {
 			'success' => false,
 			'data'    => array(
 				'message'  => $attachment_id->get_error_message(),
-				'filename' => $_FILES['async-upload']['name'],
+				'filename' => esc_html( $_FILES['async-upload']['name'] ),
 			)
 		) );

--- a/wp-admin/includes/class-wp-screen.php
+++ b/wp-admin/includes/class-wp-screen.php
@@ -290,7 +290,9 @@ final class WP_Screen {

 			switch ( $base ) {
 				case 'post' :
-					if ( isset( $_GET['post'] ) )
+					if ( isset( $_GET['post'] ) && isset( $_POST['post_ID'] ) && (int) $_GET['post'] !== (int) $_POST['post_ID'] )
+						wp_die( __( 'A post ID mismatch has been detected.' ), __( 'Sorry, you are not allowed to edit this item.' ), 400 );
+					elseif ( isset( $_GET['post'] ) )
 						$post_id = (int) $_GET['post'];
 					elseif ( isset( $_POST['post_ID'] ) )
 						$post_id = (int) $_POST['post_ID'];
--- a/wp-admin/includes/post.php
+++ b/wp-admin/includes/post.php
@@ -175,6 +175,27 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
 	return $post_data;
 }

+/**
+ * Returns only allowed post data fields
+ *
+ * @since 4.9.9
+ *
+ * @param array $post_data Array of post data. Defaults to the contents of $_POST.
+ * @return object|bool WP_Error on failure, true on success.
+ */
+function _wp_get_allowed_postdata( $post_data = null ) {
+	if ( empty( $post_data ) ) {
+		$post_data = $_POST;
+	}
+
+	// Pass through errors
+	if ( is_wp_error( $post_data ) ) {
+		return $post_data;
+	}
+
+	return array_diff_key( $post_data, array_flip( array( 'meta_input', 'file', 'guid' ) ) );
+}
+
 /**
 * Update an existing post with values provided in $_POST.
 *
@@ -243,6 +264,7 @@ function edit_post( $post_data = null ) {
 	$post_data = _wp_translate_postdata( true, $post_data );
 	if ( is_wp_error($post_data) )
 		wp_die( $post_data->get_error_message() );
+	$translated = _wp_get_allowed_postdata( $post_data );

 	// Post Formats
 	if ( isset( $post_data['post_format'] ) )
@@ -320,7 +342,7 @@ function edit_post( $post_data = null ) {
 		$attachment_data = isset( $post_data['attachments'][ $post_ID ] ) ? $post_data['attachments'][ $post_ID ] : array();

 		/** This filter is documented in wp-admin/includes/media.php */
-		$post_data = apply_filters( 'attachment_fields_to_save', $post_data, $attachment_data );
+		$translated = apply_filters( 'attachment_fields_to_save', $translated, $attachment_data );
 	}

 	// Convert taxonomy input to term IDs, to avoid ambiguity.
@@ -365,7 +387,7 @@ function edit_post( $post_data = null ) {
 				}
 			}

-			$post_data['tax_input'][ $taxonomy ] = $clean_terms;
+			$translated['tax_input'][ $taxonomy ] = $clean_terms;
 		}
 	}

@@ -373,18 +395,18 @@ function edit_post( $post_data = null ) {

 	update_post_meta( $post_ID, '_edit_last', get_current_user_id() );

-	$success = wp_update_post( $post_data );
+	$success = wp_update_post( $translated );
 	// If the save failed, see if we can sanity check the main fields and try again
 	if ( ! $success && is_callable( array( $wpdb, 'strip_invalid_text_for_column' ) ) ) {
 		$fields = array( 'post_title', 'post_content', 'post_excerpt' );

 		foreach ( $fields as $field ) {
-			if ( isset( $post_data[ $field ] ) ) {
-				$post_data[ $field ] = $wpdb->strip_invalid_text_for_column( $wpdb->posts, $field, $post_data[ $field ] );
+			if ( isset( $translated[ $field ] ) ) {
+				$translated[ $field ] = $wpdb->strip_invalid_text_for_column( $wpdb->posts, $field, $translated[ $field ] );
 			}
 		}

-		wp_update_post( $post_data );
+		wp_update_post( $translated );
 	}

 	// Now that we have an ID we can fix any attachment anchor hrefs
@@ -544,9 +566,9 @@ function bulk_edit_posts( $post_data = null ) {
 			unset( $post_data['tax_input']['category'] );
 		}

+		$post_data['post_ID']        = $post_ID;
 		$post_data['post_type'] = $post->post_type;
 		$post_data['post_mime_type'] = $post->post_mime_type;
-		$post_data['guid'] = $post->guid;

 		foreach ( array( 'comment_status', 'ping_status', 'post_author' ) as $field ) {
 			if ( ! isset( $post_data[ $field ] ) ) {
@@ -554,14 +576,12 @@ function bulk_edit_posts( $post_data = null ) {
 			}
 		}

-		$post_data['ID'] = $post_ID;
-		$post_data['post_ID'] = $post_ID;
-
 		$post_data = _wp_translate_postdata( true, $post_data );
 		if ( is_wp_error( $post_data ) ) {
 			$skipped[] = $post_ID;
 			continue;
 		}
+		$post_data = _wp_get_allowed_postdata( $post_data );

 		$updated[] = wp_update_post( $post_data );

@@ -572,8 +592,8 @@ function bulk_edit_posts( $post_data = null ) {
 				unstick_post( $post_ID );
 		}

-		if ( isset( $post_data['post_format'] ) )
-			set_post_format( $post_ID, $post_data['post_format'] );
+		if ( isset( $shared_post_data['post_format'] ) )
+			set_post_format( $post_ID, $shared_post_data['post_format'] );
 	}

 	return array( 'updated' => $updated, 'skipped' => $skipped, 'locked' => $locked );
@@ -754,9 +774,10 @@ function wp_write_post() {
 	$translated = _wp_translate_postdata( false );
 	if ( is_wp_error($translated) )
 		return $translated;
+	$translated = _wp_get_allowed_postdata( $translated );

 	// Create the post.
-	$post_ID = wp_insert_post( $_POST );
+	$post_ID = wp_insert_post( $translated );
 	if ( is_wp_error( $post_ID ) )
 		return $post_ID;

@@ -1664,6 +1685,7 @@ function wp_create_post_autosave( $post_data ) {
 	$post_data = _wp_translate_postdata( true, $post_data );
 	if ( is_wp_error( $post_data ) )
 		return $post_data;
+	$post_data = _wp_get_allowed_postdata( $post_data );

 	$post_author = get_current_user_id();

--- a/wp-admin/includes/update-core.php
+++ b/wp-admin/includes/update-core.php
@@ -703,6 +703,9 @@ $_old_files = array(
 'wp-includes/js/tinymce/plugins/wpfullscreen',
 // 4.5
 'wp-includes/theme-compat/comments-popup.php',
+// 4.9.2
+'wp-includes/js/mediaelement/flashmediaelement.swf',
+'wp-includes/js/mediaelement/silverlightmediaelement.xap',
 );

 /**
@@ -1079,7 +1082,11 @@ function update_core($from, $to) {
 		$old_file = $to . $old_file;
 		if ( !$wp_filesystem->exists($old_file) )
 			continue;
-		$wp_filesystem->delete($old_file, true);
+
+		// If the file isn't deleted, try writing an empty string to the file instead.
+		if ( ! $wp_filesystem->delete( $old_file, true ) && $wp_filesystem->is_file( $old_file ) ) {
+			$wp_filesystem->put_contents( $old_file, '' );
+		}
 	}

 	// Remove any Genericons example.html's from the filesystem
--- a/wp-admin/post.php
+++ b/wp-admin/post.php
@@ -16,7 +16,9 @@ $submenu_file = 'edit.php';

 wp_reset_vars( array( 'action' ) );

-if ( isset( $_GET['post'] ) )
+if ( isset( $_GET['post'] ) && isset( $_POST['post_ID'] ) && (int) $_GET['post'] !== (int) $_POST['post_ID'] )
+	wp_die( __( 'A post ID mismatch has been detected.' ), __( 'Sorry, you are not allowed to edit this item.' ), 400 );
+elseif ( isset( $_GET['post'] ) )
 	$post_id = $post_ID = (int) $_GET['post'];
 elseif ( isset( $_POST['post_ID'] ) )
 	$post_id = $post_ID = (int) $_POST['post_ID'];
@@ -38,6 +40,10 @@ if ( $post ) {
 	$post_type_object = get_post_type_object( $post_type );
 }

+if ( isset( $_POST['post_type'] ) && $post && $post_type !== $_POST['post_type'] ) {
+	wp_die( __( 'A post type mismatch has been detected.' ), __( 'Sorry, you are not allowed to edit this item.' ), 400 );
+}
+
 if ( isset( $_POST['deletepost'] ) )
 	$action = 'delete';
 elseif ( isset($_POST['wp-preview']) && 'dopreview' == $_POST['wp-preview'] )
@@ -183,7 +189,7 @@ case 'editattachment':

 	// Update the thumbnail filename
 	$newmeta = wp_get_attachment_metadata( $post_id, true );
-	$newmeta['thumb'] = $_POST['thumb'];
+	$newmeta['thumb'] = wp_basename( $_POST['thumb'] );

 	wp_update_attachment_metadata( $post_id, $newmeta );

--- a/wp-admin/user-new.php
+++ b/wp-admin/user-new.php
@@ -70,7 +70,7 @@ if ( isset($_REQUEST['action']) && 'adduser' == $_REQUEST['action'] ) {
 			add_existing_user_to_blog( array( 'user_id' => $user_id, 'role' => $_REQUEST[ 'role' ] ) );
 			$redirect = add_query_arg( array( 'update' => 'addnoconfirmation' , 'user_id' => $user_id ), 'user-new.php' );
 		} else {
-			$newuser_key = substr( md5( $user_id ), 0, 5 );
+			$newuser_key = wp_generate_password( 20, false );
 			add_option( 'new_user_' . $newuser_key, array( 'user_id' => $user_id, 'email' => $user_details->user_email, 'role' => $_REQUEST[ 'role' ] ) );

 			$roles = get_editable_roles();
--- a/wp-includes/class-wp.php
+++ b/wp-includes/class-wp.php
@@ -15,7 +15,7 @@ class WP {
 	 * @access public
 	 * @var array
 	 */
-	public $public_query_vars = array('m', 'p', 'posts', 'w', 'cat', 'withcomments', 'withoutcomments', 's', 'search', 'exact', 'sentence', 'calendar', 'page', 'paged', 'more', 'tb', 'pb', 'author', 'order', 'orderby', 'year', 'monthnum', 'day', 'hour', 'minute', 'second', 'name', 'category_name', 'tag', 'feed', 'author_name', 'static', 'pagename', 'page_id', 'error', 'attachment', 'attachment_id', 'subpost', 'subpost_id', 'preview', 'robots', 'taxonomy', 'term', 'cpage', 'post_type', 'embed' );
+	public $public_query_vars = array( 'm', 'p', 'posts', 'w', 'cat', 'withcomments', 'withoutcomments', 's', 'search', 'exact', 'sentence', 'calendar', 'page', 'paged', 'more', 'tb', 'pb', 'author', 'order', 'orderby', 'year', 'monthnum', 'day', 'hour', 'minute', 'second', 'name', 'category_name', 'tag', 'feed', 'author_name', 'pagename', 'page_id', 'error', 'attachment', 'attachment_id', 'subpost', 'subpost_id', 'preview', 'robots', 'taxonomy', 'term', 'cpage', 'post_type', 'embed' );

 	/**
 	 * Private query variables.
@@ -301,6 +301,8 @@ class WP {
 		foreach ( $this->public_query_vars as $wpvar ) {
 			if ( isset( $this->extra_query_vars[$wpvar] ) )
 				$this->query_vars[$wpvar] = $this->extra_query_vars[$wpvar];
+			elseif ( isset( $_GET[ $wpvar ] ) && isset( $_POST[ $wpvar ] ) && $_GET[ $wpvar ] !== $_POST[ $wpvar ] )
+				wp_die( __( 'A variable mismatch has been detected.' ), __( 'Sorry, you are not allowed to view this item.' ), 400 );
 			elseif ( isset( $_POST[$wpvar] ) )
 				$this->query_vars[$wpvar] = $_POST[$wpvar];
 			elseif ( isset( $_GET[$wpvar] ) )
--- a/wp-includes/comment.php
+++ b/wp-includes/comment.php
@@ -2867,6 +2867,8 @@ function wp_handle_comment_submission( $comment_data ) {
 			) {
 				kses_remove_filters(); // start with a clean slate
 				kses_init_filters(); // set up the filters
+				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+				add_filter( 'pre_comment_content', 'wp_filter_kses' );
 			}
 		}
 	} else {
--- a/wp-includes/feed.php
+++ b/wp-includes/feed.php
@@ -475,7 +475,7 @@ function rss_enclosure() {
 				 *
 				 * @param string $html_link_tag The HTML link tag with a URI and other attributes.
 				 */
-				echo apply_filters( 'rss_enclosure', '<enclosure url="' . trim( htmlspecialchars( $enclosure[0] ) ) . '" length="' . trim( $enclosure[1] ) . '" type="' . $type . '" />' . "\n" );
+				echo apply_filters( 'rss_enclosure', '<enclosure url="' . esc_url( trim( $enclosure[0] ) ) . '" length="' . absint( trim( $enclosure[1] ) ) . '" type="' . esc_attr( $type ) . '" />' . "\n" );
 			}
 		}
 	}
@@ -509,7 +509,7 @@ function atom_enclosure() {
 				 *
 				 * @param string $html_link_tag The HTML link tag with a URI and other attributes.
 				 */
-				echo apply_filters( 'atom_enclosure', '<link href="' . trim( htmlspecialchars( $enclosure[0] ) ) . '" rel="enclosure" length="' . trim( $enclosure[1] ) . '" type="' . trim( $enclosure[2] ) . '" />' . "\n" );
+				echo apply_filters( 'atom_enclosure', '<link href="' . esc_url( trim( $enclosure[0] ) ) . '" rel="enclosure" length="' . absint( trim( $enclosure[1] ) ) . '" type="' . esc_attr( trim( $enclosure[2] ) ) . '" />' . "\n" );
 			}
 		}
 	}
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -2347,17 +2347,24 @@ function wp_rel_nofollow( $text ) {
 */
 function wp_rel_nofollow_callback( $matches ) {
 	$text = $matches[1];
-	$atts = shortcode_parse_atts( $matches[1] );
+	$atts = wp_kses_hair( $matches[1], wp_allowed_protocols() );
 	$rel  = 'nofollow';

-	if ( preg_match( '%href=["\'](' . preg_quote( set_url_scheme( home_url(), 'http' ) ) . ')%i', $text ) ||
-	     preg_match( '%href=["\'](' . preg_quote( set_url_scheme( home_url(), 'https' ) ) . ')%i', $text )
-	) {
-		return "<a $text>";
+	if ( ! empty( $atts['href'] ) ) {
+		$href_parts  = wp_parse_url( $atts['href']['value'] );
+		$href_scheme = isset( $href_parts['scheme'] ) ? $href_parts['scheme'] : '';
+		$href_host   = isset( $href_parts['host'] ) ? $href_parts['host'] : '';
+		$home_parts  = wp_parse_url( home_url() );
+		$home_host   = isset( $home_parts['host'] ) ? $home_parts['host'] : '';
+		if ( in_array( strtolower( $href_scheme ), array( 'http', 'https' ), true ) ) {
+			if ( strtolower( $href_host ) === strtolower( $home_host ) ) {
+				return "<a $text>";
+			}
+		}
 	}

 	if ( ! empty( $atts['rel'] ) ) {
-		$parts = array_map( 'trim', explode( ' ', $atts['rel'] ) );
+		$parts = array_map( 'trim', explode( ' ', $atts['rel']['value'] ) );
 		if ( false === array_search( 'nofollow', $parts ) ) {
 			$parts[] = 'nofollow';
 		}
@@ -2366,11 +2373,15 @@ function wp_rel_nofollow_callback( $matches ) {

 		$html = '';
 		foreach ( $atts as $name => $value ) {
-			$html .= "{$name}=\"$value\" ";
+			if ( isset( $value['vless'] ) && 'y' === $value['vless'] ) {
+				$html .= $name . ' ';
+			} else {
+				$html .= "{$name}=\"" . esc_attr( $value['value'] ) . '" ';
+			}
 		}
 		$text = trim( $html );
 	}
-	return "<a $text rel=\"$rel\">";
+	return "<a $text rel=\"" . esc_attr( $rel ) . "\">";
 }

 /**
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -1602,6 +1602,11 @@ function wp_mkdir_p( $target ) {
 	if ( file_exists( $target ) )
 		return @is_dir( $target );

+	// Do not allow path traversals.
+	if ( false !== strpos( $target, '../' ) || false !== strpos( $target, '..' . DIRECTORY_SEPARATOR ) ) {
+		return false;
+	}
+
 	// We need to find the permissions of the parent folder that exists and inherit that.
 	$target_parent = dirname( $target );
 	while ( '.' != $target_parent && ! is_dir( $target_parent ) ) {
@@ -1693,17 +1698,30 @@ function path_join( $base, $path ) {
 * @since 3.9.0
 * @since 4.4.0 Ensures upper-case drive letters on Windows systems.
 * @since 4.5.0 Allows for Windows network shares.
+ * @since 4.9.7 Allows for PHP file wrappers.
 *
 * @param string $path Path to normalize.
 * @return string Normalized path.
 */
 function wp_normalize_path( $path ) {
+	$wrapper = '';
+	if ( wp_is_stream( $path ) ) {
+		list( $wrapper, $path ) = explode( '://', $path, 2 );
+		$wrapper .= '://';
+	}
+
+	// Standardise all paths to use /
 	$path = str_replace( '\\', '/', $path );
+
+	// Replace multiple slashes down to a singular, allowing for network shares having two slashes.
 	$path = preg_replace( '|(?<=.)/+|', '/', $path );
+
+	// Windows paths should uppercase the drive letter
 	if ( ':' === substr( $path, 1, 1 ) ) {
 		$path = ucfirst( $path );
 	}
-	return $path;
+
+	return $wrapper . $path;
 }

 /**
@@ -2311,14 +2329,59 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {
 				$type = $ext = false;
 			}
 		}
-	} elseif ( function_exists( 'finfo_file' ) ) {
-		// Use finfo_file if available to validate non-image files.
+	}
+
+	// Validate files that didn't get validated during previous checks.
+	if ( $type && ! $real_mime && extension_loaded( 'fileinfo' ) ) {
 		$finfo = finfo_open( FILEINFO_MIME_TYPE );
 		$real_mime = finfo_file( $finfo, $file );
 		finfo_close( $finfo );

-		// If the extension does not match the file's real type, return false.
-		if ( $real_mime !== $type ) {
+		// fileinfo often misidentifies obscure files as one of these types
+		$nonspecific_types = array(
+			'application/octet-stream',
+			'application/encrypted',
+			'application/CDFV2-encrypted',
+			'application/zip',
+		);
+
+		/*
+		 * If $real_mime doesn't match the content type we're expecting from the file's extension,
+		 * we need to do some additional vetting. Media types and those listed in $nonspecific_types are
+		 * allowed some leeway, but anything else must exactly match the real content type.
+		 */
+		if ( in_array( $real_mime, $nonspecific_types, true ) ) {
+			// File is a non-specific binary type. That's ok if it's a type that generally tends to be binary.
+			if ( !in_array( substr( $type, 0, strcspn( $type, '/' ) ), array( 'application', 'video', 'audio' ) ) ) {
+				$type = $ext = false;
+			}
+		} elseif ( 0 === strpos( $real_mime, 'video/' ) || 0 === strpos( $real_mime, 'audio/' ) ) {
+			/*
+			 * For these types, only the major type must match the real value.
+			 * This means that common mismatches are forgiven: application/vnd.apple.numbers is often misidentified as application/zip,
+			 * and some media files are commonly named with the wrong extension (.mov instead of .mp4)
+			 */
+
+			if ( substr( $real_mime, 0, strcspn( $real_mime, '/' ) ) !== substr( $type, 0, strcspn( $type, '/' ) ) ) {
+				$type = $ext = false;
+			}
+		} else {
+			if ( $type !== $real_mime ) {
+				/*
+				 * Everything else including image/* and application/*: 
+				 * If the real content type doesn't match the file extension, assume it's dangerous.
+				 */
+				$type = $ext = false;
+			}
+
+		}
+	}
+
+	// The mime type must be allowed 
+	if ( $type ) {
+		$allowed = get_allowed_mime_types();
+
+		if ( ! in_array( $type, $allowed ) ) {
 			$type = $ext = false;
 		}
 	}
@@ -2508,8 +2571,9 @@ function get_allowed_mime_types( $user = null ) {
 	if ( function_exists( 'current_user_can' ) )
 		$unfiltered = $user ? user_can( $user, 'unfiltered_html' ) : current_user_can( 'unfiltered_html' );

-	if ( empty( $unfiltered ) )
-		unset( $t['htm|html'] );
+	if ( empty( $unfiltered ) ) {
+		unset( $t['htm|html'], $t['js'] );
+	}

 	/**
 	 * Filter list of allowed mime types and file extensions.
@@ -5270,6 +5334,28 @@ function wp_delete_file( $file ) {
 	}
 }

+/**
+ * Deletes a file if its path is within the given directory.
+ *
+ * @since 4.9.7
+ *
+ * @param string $file      Absolute path to the file to delete.
+ * @param string $directory Absolute path to a directory.
+ * @return bool True on success, false on failure.
+ */
+function wp_delete_file_from_directory( $file, $directory ) {
+	$real_file = realpath( wp_normalize_path( $file ) );
+	$real_directory = realpath( wp_normalize_path( $directory ) );
+
+	if ( false === $real_file || false === $real_directory || strpos( wp_normalize_path( $real_file ), trailingslashit( wp_normalize_path( $real_directory ) ) ) !== 0 ) {
+		return false;
+	}
+
+	wp_delete_file( $file );
+
+	return true;
+}
+
 /**
 * Outputs a small JS snippet on preview tabs/windows to remove `window.name` on unload.
 *
--- a/wp-includes/general-template.php
+++ b/wp-includes/general-template.php
@@ -2720,6 +2720,24 @@ function wp_no_robots() {
 	echo "<meta name='robots' content='noindex,follow' />\n";
 }

+/**
+ * Display a noindex,noarchive meta tag and referrer origin-when-cross-origin meta tag.
+ *
+ * Outputs a noindex,noarchive meta tag that tells web robots not to index or cache the page content.
+ * Outputs a referrer origin-when-cross-origin meta tag that tells the browser not to send the full
+ * url as a referrer to other sites when cross-origin assets are loaded.
+ *
+ * Typical usage is as a wp_head callback. add_action( 'wp_head', 'wp_sensitive_page_meta' );
+ *
+ * @since 5.0.0
+ */
+function wp_sensitive_page_meta() {
+	?>
+	<meta name='robots' content='noindex,noarchive' />
+	<meta name='referrer' content='strict-origin-when-cross-origin' />
+	<?php
+}
+
 /**
 * Display site icon meta tags.
 *
@@ -2911,12 +2929,14 @@ function get_language_attributes( $doctype = 'html' ) {
 	if ( function_exists( 'is_rtl' ) && is_rtl() )
 		$attributes[] = 'dir="rtl"';

-	if ( $lang = get_bloginfo('language') ) {
-		if ( get_option('html_type') == 'text/html' || $doctype == 'html' )
-			$attributes[] = "lang=\"$lang\"";
+	if ( $lang = get_bloginfo( 'language' ) ) {
+		if ( get_option( 'html_type' ) == 'text/html' || $doctype == 'html' ) {
+			$attributes[] = 'lang="' . esc_attr( $lang ) . '"';
+		}

-		if ( get_option('html_type') != 'text/html' || $doctype == 'xhtml' )
-			$attributes[] = "xml:lang=\"$lang\"";
+		if ( get_option( 'html_type' ) != 'text/html' || $doctype == 'xhtml' ) {
+			$attributes[] = 'xml:lang="' . esc_attr( $lang ) . '"';
+		}
 	}

 	$output = implode(' ', $attributes);
@@ -3448,25 +3468,25 @@ function get_the_generator( $type = '' ) {

 	switch ( $type ) {
 		case 'html':
-			$gen = '<meta name="generator" content="WordPress ' . get_bloginfo( 'version' ) . '">';
+			$gen = '<meta name="generator" content="WordPress ' . esc_attr( get_bloginfo( 'version' ) ) . '">';
 			break;
 		case 'xhtml':
-			$gen = '<meta name="generator" content="WordPress ' . get_bloginfo( 'version' ) . '" />';
+			$gen = '<meta name="generator" content="WordPress ' . esc_attr( get_bloginfo( 'version' ) ) . '" />';
 			break;
 		case 'atom':
-			$gen = '<generator uri="https://wordpress.org/" version="' . get_bloginfo_rss( 'version' ) . '">WordPress</generator>';
+			$gen = '<generator uri="https://wordpress.org/" version="' . esc_attr( get_bloginfo_rss( 'version' ) ) . '">WordPress</generator>';
 			break;
 		case 'rss2':
-			$gen = '<generator>https://wordpress.org/?v=' . get_bloginfo_rss( 'version' ) . '</generator>';
+			$gen = '<generator>' . esc_url_raw( 'https://wordpress.org/?v=' . get_bloginfo_rss( 'version' ) ) . '</generator>';
 			break;
 		case 'rdf':
-			$gen = '<admin:generatorAgent rdf:resource="https://wordpress.org/?v=' . get_bloginfo_rss( 'version' ) . '" />';
+			$gen = '<admin:generatorAgent rdf:resource="' . esc_url_raw( 'https://wordpress.org/?v=' . get_bloginfo_rss( 'version' ) ) . '" />';
 			break;
 		case 'comment':
-			$gen = '<!-- generator="WordPress/' . get_bloginfo( 'version' ) . '" -->';
+			$gen = '<!-- generator="WordPress/' . esc_attr( get_bloginfo( 'version' ) ) . '" -->';
 			break;
 		case 'export':
-			$gen = '<!-- generator="WordPress/' . get_bloginfo_rss('version') . '" created="'. date('Y-m-d H:i') . '" -->';
+			$gen = '<!-- generator="WordPress/' . esc_attr( get_bloginfo_rss( 'version' ) ) . '" created="' . date( 'Y-m-d H:i' ) . '" -->';
 			break;
 	}

--- a/wp-includes/http.php
+++ b/wp-includes/http.php
@@ -524,7 +524,7 @@ function wp_http_validate_url( $url ) {
 	$parsed_home = @parse_url( get_option( 'home' ) );

 	if ( isset( $parsed_home['host'] ) ) {
-		$same_host = ( strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] ) || 'localhost' === strtolower( $parsed_url['host'] ) );
+		$same_host = strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );
 	} else {
 		$same_host = false;
 	}
@@ -535,8 +535,9 @@ function wp_http_validate_url( $url ) {
 			$ip = $host;
 		} else {
 			$ip = gethostbyname( $host );
-			if ( $ip === $host ) // Error condition for gethostbyname()
-				$ip = false;
+			if ( $ip === $host ) { // Error condition for gethostbyname()
+				return false;
+			}
 		}
 		if ( $ip ) {
 			$parts = array_map( 'intval', explode( '.', $ip ) );
--- a/wp-includes/js/jquery/jquery.js
+++ b/wp-includes/js/jquery/jquery.js
--- a/wp-includes/js/mediaelement/flashmediaelement.swf
+++ b/wp-includes/js/mediaelement/flashmediaelement.swf
--- a/wp-includes/js/mediaelement/silverlightmediaelement.xap
+++ b/wp-includes/js/mediaelement/silverlightmediaelement.xap
--- a/wp-includes/kses.php
+++ b/wp-includes/kses.php
@@ -183,15 +183,6 @@ if ( ! CUSTOM_TAGS ) {
 			'lang' => true,
 			'xml:lang' => true,
 		),
-		'form' => array(
-			'action' => true,
-			'accept' => true,
-			'accept-charset' => true,
-			'enctype' => true,
-			'method' => true,
-			'name' => true,
-			'target' => true,
-		),
 		'h1' => array(
 			'align' => true,
 		),
@@ -545,7 +536,7 @@ function wp_kses( $string, $allowed_html, $allowed_protocols = array() ) {
 * @return string Filtered attribute.
 */
 function wp_kses_one_attr( $string, $element ) {
-	$uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
+	$uris = wp_kses_uri_attributes();
 	$allowed_html = wp_kses_allowed_html( 'post' );
 	$allowed_protocols = wp_allowed_protocols();
 	$string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
@@ -611,6 +602,7 @@ function wp_kses_one_attr( $string, $element ) {
 * Return a list of allowed tags and attributes for a given context.
 *
 * @since 3.5.0
+ * @since 5.0.1 `form` removed as allowable HTML tag.
 *
 * @global array $allowedposttags
 * @global array $allowedtags
@@ -640,7 +632,27 @@ function wp_kses_allowed_html( $context = '' ) {
 	switch ( $context ) {
 		case 'post':
 			/** This filter is documented in wp-includes/kses.php */
-			return apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
+			$tags = apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
+
+			// 5.0.1 removed the `<form>` tag, allow it if a filter is allowing it's sub-elements `<input>` or `<select>`.
+			if ( ! CUSTOM_TAGS && ! isset( $tags['form'] ) && ( isset( $tags['input'] ) || isset( $tags['select'] ) ) ) {
+				$tags = $allowedposttags;
+
+				$tags['form'] = array(
+					'action' => true,
+					'accept' => true,
+					'accept-charset' => true,
+					'enctype' => true,
+					'method' => true,
+					'name' => true,
+					'target' => true,
+				);
+
+				/** This filter is documented in wp-includes/kses.php */
+				$tags = apply_filters( 'wp_kses_allowed_html', $tags, $context );
+			}
+
+			return $tags;

 		case 'user_description':
 		case 'pre_user_description':
@@ -723,6 +735,56 @@ function wp_kses_split( $string, $allowed_html, $allowed_protocols ) {
 	return preg_replace_callback( '%(<!--.*?(-->|$))|(<[^>]*(>|$)|>)%', '_wp_kses_split_callback', $string );
 }

+/**
+ * Helper function listing HTML attributes containing a URL.
+ *
+ * This function returns a list of all HTML attributes that must contain
+ * a URL according to the HTML specification.
+ *
+ * This list includes URI attributes both allowed and disallowed by KSES.
+ *
+ * @link https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes
+ *
+ * @since 5.0.1
+ *
+ * @return array HTML attributes that must include a URL.
+ */
+function wp_kses_uri_attributes() {
+	$uri_attributes = array(
+		'action',
+		'archive',
+		'background',
+		'cite',
+		'classid',
+		'codebase',
+		'data',
+		'formaction',
+		'href',
+		'icon',
+		'longdesc',
+		'manifest',
+		'poster',
+		'profile',
+		'src',
+		'usemap',
+		'xmlns',
+	);
+
+	/**
+	 * Filters the list of attributes that are required to contain a URL.
+	 *
+	 * Use this filter to add any `data-` attributes that are required to be
+	 * validated as a URL.
+	 *
+	 * @since 5.0.1
+	 *
+	 * @param array $uri_attributes HTML attributes requiring validation as a URL.
+	 */
+	$uri_attributes = apply_filters( 'wp_kses_uri_attributes', $uri_attributes );
+
+	return $uri_attributes;
+}
+
 /**
 * Callback for wp_kses_split.
 *
@@ -918,7 +980,7 @@ function wp_kses_hair($attr, $allowed_protocols) {
 	$attrarr = array();
 	$mode = 0;
 	$attrname = '';
-	$uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
+	$uris = wp_kses_uri_attributes();

 	// Loop through the whole attribute list

@@ -1334,7 +1396,8 @@ function wp_kses_html_error($string) {
 * @return string Sanitized content
 */
 function wp_kses_bad_protocol_once($string, $allowed_protocols, $count = 1 ) {
-	$string2 = preg_split( '/:|&#0*58;|&#x0*3a;/i', $string, 2 );
+	$string  = preg_replace( '/(&#0*58(?![;0-9])|&#x0*3a(?![;a-f0-9]))/i', '$1;', $string );
+	$string2 = preg_split( '/:|&#0*58;|&#x0*3a;|&colon;/i', $string, 2 );
 	if ( isset($string2[1]) && ! preg_match('%/\?%', $string2[0]) ) {
 		$string = trim( $string2[1] );
 		$protocol = wp_kses_bad_protocol_once2( $string2[0], $allowed_protocols );
--- a/wp-includes/meta.php
+++ b/wp-includes/meta.php
@@ -364,12 +364,11 @@ function delete_metadata($meta_type, $object_id, $meta_key, $meta_value = '', $d
 		return false;

 	if ( $delete_all ) {
-		$value_clause = '';
 		if ( '' !== $meta_value && null !== $meta_value && false !== $meta_value ) {
-			$value_clause = $wpdb->prepare( " AND meta_value = %s", $meta_value );
+			$object_ids = $wpdb->get_col( $wpdb->prepare( "SELECT $type_column FROM $table WHERE meta_key = %s AND meta_value = %s", $meta_key, $meta_value ) );
+		} else {
+			$object_ids = $wpdb->get_col( $wpdb->prepare( "SELECT $type_column FROM $table WHERE meta_key = %s", $meta_key ) );
 		}
-
-		$object_ids = $wpdb->get_col( $wpdb->prepare( "SELECT $type_column FROM $table WHERE meta_key = %s $value_clause", $meta_key ) );
 	}

 	/**
--- a/wp-includes/ms-deprecated.php
+++ b/wp-includes/ms-deprecated.php
@@ -270,10 +270,13 @@ function wpmu_admin_do_redirect( $url = '' ) {
 	_deprecated_function( __FUNCTION__, '3.3' );

 	$ref = '';
-	if ( isset( $_GET['ref'] ) )
-		$ref = $_GET['ref'];
-	if ( isset( $_POST['ref'] ) )
-		$ref = $_POST['ref'];
+	if ( isset( $_GET['ref'] ) && isset( $_POST['ref'] ) && $_GET['ref'] !== $_POST['ref'] ) {
+		wp_die( __( 'A variable mismatch has been detected.' ), __( 'Sorry, you are not allowed to view this item.' ), 400 );
+	} elseif ( isset( $_POST['ref'] ) ) {
+		$ref = $_POST[ 'ref' ];
+	} elseif ( isset( $_GET['ref'] ) ) {
+		$ref = $_GET[ 'ref' ];
+	}

 	if ( $ref ) {
 		$ref = wpmu_admin_redirect_add_updated_param( $ref );
@@ -286,7 +289,9 @@ function wpmu_admin_do_redirect( $url = '' ) {
 	}

 	$url = wpmu_admin_redirect_add_updated_param( $url );
-	if ( isset( $_GET['redirect'] ) ) {
+	if ( isset( $_GET['redirect'] ) && isset( $_POST['redirect'] ) && $_GET['redirect'] !== $_POST['redirect'] ) {
+		wp_die( __( 'A variable mismatch has been detected.' ), __( 'Sorry, you are not allowed to view this item.' ), 400 );
+	} elseif ( isset( $_GET['redirect'] ) ) {
 		if ( substr( $_GET['redirect'], 0, 2 ) == 's_' )
 			$url .= '&action=blogs&s='. esc_html( substr( $_GET['redirect'], 2 ) );
 	} elseif ( isset( $_POST['redirect'] ) ) {
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -1044,8 +1044,8 @@ if ( !function_exists('check_admin_referer') ) :
 *                   0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago.
 */
 function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) {
-	if ( -1 == $action )
-		_doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2' );
+	if ( -1 === $action )
+		_doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2.0' );

 	$adminurl = strtolower(admin_url());
 	$referer = strtolower(wp_get_referer());
@@ -1062,7 +1062,7 @@ function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) {
 	 */
 	do_action( 'check_admin_referer', $action, $result );

-	if ( ! $result && ! ( -1 == $action && strpos( $referer, $adminurl ) === 0 ) ) {
+	if ( ! $result && ! ( -1 === $action && strpos( $referer, $adminurl ) === 0 ) ) {
 		wp_nonce_ays( $action );
 		die();
 	}
@@ -1087,6 +1087,9 @@ if ( !function_exists('check_ajax_referer') ) :
 *                   0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago.
 */
 function check_ajax_referer( $action = -1, $query_arg = false, $die = true ) {
+	if ( -1 === $action )
+		_doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2.0' );
+
 	$nonce = '';

 	if ( $query_arg && isset( $_REQUEST[ $query_arg ] ) )
@@ -1290,6 +1293,14 @@ function wp_validate_redirect($location, $default = '') {
 	if ( isset($lp['scheme']) && !('http' == $lp['scheme'] || 'https' == $lp['scheme']) )
 		return $default;

+	if ( ! isset( $lp['host'] ) && ! empty( $lp['path'] ) && '/' !== $lp['path'][0] ) {
+		$path = '';
+		if ( ! empty( $_SERVER['REQUEST_URI'] ) ) {
+			$path = dirname( parse_url( 'http://placeholder' . $_SERVER['REQUEST_URI'], PHP_URL_PATH ) . '?' );
+		}
+		$location = '/' . ltrim( $path . '/', '/' ) . $location;
+	}
+
 	// Reject if certain components are set but host is not. This catches urls like https:host.com for which parse_url does not set the host field.
 	if ( ! isset( $lp['host'] ) && ( isset( $lp['scheme'] ) || isset( $lp['user'] ) || isset( $lp['pass'] ) || isset( $lp['port'] ) ) ) {
 		return $default;
@@ -2439,4 +2450,3 @@ function wp_text_diff( $left_string, $right_string, $args = null ) {
 	return $r;
 }
 endif;
-
--- a/wp-includes/post-template.php
+++ b/wp-includes/post-template.php
@@ -315,25 +315,9 @@ function get_the_content( $more_link_text = null, $strip_teaser = false ) {
 		}
 	}

-	if ( $preview ) // Preview fix for JavaScript bug with foreign languages.
-		$output =	preg_replace_callback( '/\%u([0-9A-F]{4})/', '_convert_urlencoded_to_entities', $output );
-
 	return $output;
 }

-/**
- * Preview fix for JavaScript bug with foreign languages.
- *
- * @since 3.1.0
- * @access private
- *
- * @param array $match Match array from preg_replace_callback.
- * @return string
- */
-function _convert_urlencoded_to_entities( $match ) {
-	return '&#' . base_convert( $match[1], 16, 10 ) . ';';
-}
-
 /**
 * Display the post excerpt.
 *
--- a/wp-includes/post.php
+++ b/wp-includes/post.php
@@ -4895,42 +4895,79 @@ function wp_delete_attachment( $post_id, $force_delete = false ) {
 	/** This action is documented in wp-includes/post.php */
 	do_action( 'deleted_post', $post_id );

-	$uploadpath = wp_get_upload_dir();
+	wp_delete_attachment_files( $post_id, $meta, $backup_sizes, $file );

-	if ( ! empty($meta['thumb']) ) {
+	clean_post_cache( $post );
+
+	return $post;
+}
+
+/**
+ * Deletes all files that belong to the given attachment.
+ *
+ * @since 4.9.7
+ *
+ * @param int    $post_id      Attachment ID.
+ * @param array  $meta         The attachment's meta data.
+ * @param array  $backup_sizes The meta data for the attachment's backup images.
+ * @param string $file         Absolute path to the attachment's file.
+ * @return bool True on success, false on failure.
+ */
+function wp_delete_attachment_files( $post_id, $meta, $backup_sizes, $file ) {
+	global $wpdb;
+
+	$uploadpath = wp_get_upload_dir();
+	$deleted    = true;
+
+	if ( ! empty( $meta['thumb'] ) ) {
 		// Don't delete the thumb if another attachment uses it.
-		if (! $wpdb->get_row( $wpdb->prepare( "SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE %s AND post_id <> %d", '%' . $wpdb->esc_like( $meta['thumb'] ) . '%', $post_id)) ) {
-			$thumbfile = str_replace(basename($file), $meta['thumb'], $file);
-			/** This filter is documented in wp-includes/functions.php */
-			$thumbfile = apply_filters( 'wp_delete_file', $thumbfile );
-			@ unlink( path_join($uploadpath['basedir'], $thumbfile) );
+		if ( ! $wpdb->get_row( $wpdb->prepare( "SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE %s AND post_id <> %d", '%' . $wpdb->esc_like( $meta['thumb'] ) . '%', $post_id ) ) ) {
+			$thumbfile = str_replace( basename( $file ), $meta['thumb'], $file );
+			if ( ! empty( $thumbfile ) ) {
+				$thumbfile = path_join( $uploadpath['basedir'], $thumbfile );
+				$thumbdir  = path_join( $uploadpath['basedir'], dirname( $file ) );
+
+				if ( ! wp_delete_file_from_directory( $thumbfile, $thumbdir ) ) {
+					$deleted = false;
+				}
+			}
 		}
 	}

 	// Remove intermediate and backup images if there are any.
 	if ( isset( $meta['sizes'] ) && is_array( $meta['sizes'] ) ) {
+		$intermediate_dir = path_join( $uploadpath['basedir'], dirname( $file ) );
 		foreach ( $meta['sizes'] as $size => $sizeinfo ) {
 			$intermediate_file = str_replace( basename( $file ), $sizeinfo['file'], $file );
-			/** This filter is documented in wp-includes/functions.php */
-			$intermediate_file = apply_filters( 'wp_delete_file', $intermediate_file );
-			@ unlink( path_join( $uploadpath['basedir'], $intermediate_file ) );
+			if ( ! empty( $intermediate_file ) ) {
+				$intermediate_file = path_join( $uploadpath['basedir'], $intermediate_file );
+
+				if ( ! wp_delete_file_from_directory( $intermediate_file, $intermediate_dir ) ) {
+					$deleted = false;
+				}
+			}
 		}
 	}

-	if ( is_array($backup_sizes) ) {
+	if ( is_array( $backup_sizes ) ) {
+		$del_dir = path_join( $uploadpath['basedir'], dirname( $meta['file'] ) );
 		foreach ( $backup_sizes as $size ) {
-			$del_file = path_join( dirname($meta['file']), $size['file'] );
-			/** This filter is documented in wp-includes/functions.php */
-			$del_file = apply_filters( 'wp_delete_file', $del_file );
-			@ unlink( path_join($uploadpath['basedir'], $del_file) );
+			$del_file = path_join( dirname( $meta['file'] ), $size['file'] );
+			if ( ! empty( $del_file ) ) {
+				$del_file = path_join( $uploadpath['basedir'], $del_file );
+
+				if ( ! wp_delete_file_from_directory( $del_file, $del_dir ) ) {
+					$deleted = false;
+				}
+			}
 		}
 	}

-	wp_delete_file( $file );
+	if ( ! wp_delete_file_from_directory( $file, $uploadpath['basedir'] ) ) {
+		$deleted = false;
+	}

-	clean_post_cache( $post );
-
-	return $post;
+	return $deleted;
 }

 /**
--- a/wp-includes/query.php
+++ b/wp-includes/query.php
@@ -1411,7 +1411,6 @@ class WP_Query {
 			, 'attachment'
 			, 'attachment_id'
 			, 'name'
-			, 'static'
 			, 'pagename'
 			, 'page_id'
 			, 'second'
@@ -1627,7 +1626,7 @@ class WP_Query {
 			// If year, month, day, hour, minute, and second are set, a single
 			// post is being queried.
 			$this->is_single = true;
-		} elseif ( '' != $qv['static'] || '' != $qv['pagename'] || !empty($qv['page_id']) ) {
+		} elseif ( '' != $qv['pagename'] || !empty($qv['page_id']) ) {
 			$this->is_page = true;
 			$this->is_single = false;
 		} else {
--- a/wp-includes/rest-api.php
+++ b/wp-includes/rest-api.php
@@ -395,6 +395,9 @@ function rest_send_cors_headers( $value ) {
 		header( 'Access-Control-Allow-Origin: ' . esc_url_raw( $origin ) );
 		header( 'Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE' );
 		header( 'Access-Control-Allow-Credentials: true' );
+		header( 'Vary: Origin', false );
+	} elseif ( ! headers_sent() && 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
+		header( 'Vary: Origin', false );
 	}

 	return $value;
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
 *
 * @global string $wp_version
 */
-$wp_version = '4.5.11';
+$wp_version = '4.5.20';

 /**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
--- a/wp-includes/wp-db.php
+++ b/wp-includes/wp-db.php
@@ -1898,7 +1898,7 @@ class wpdb {
 			// If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
 			$algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
 			// Old WP installs may not have AUTH_SALT defined.
-			$salt = defined( 'AUTH_SALT' ) ? AUTH_SALT : rand();
+			$salt = defined( 'AUTH_SALT' ) && AUTH_SALT ? AUTH_SALT : (string) rand();

 			$placeholder = '{' . hash_hmac( $algo, uniqid( $salt, true ), $salt ) . '}';
 		}
--- a/wp-login.php
+++ b/wp-login.php
@@ -14,10 +14,10 @@ require( dirname(__FILE__) . '/wp-load.php' );
 // Redirect to https login if forced to use SSL
 if ( force_ssl_admin() && ! is_ssl() ) {
 	if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) {
-		wp_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );
+		wp_safe_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );
 		exit();
 	} else {
-		wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
+		wp_safe_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
 		exit();
 	}
 }
@@ -34,7 +34,7 @@ function login_header( $title = 'Log In', $message = '', $wp_error = '' ) {
 	global $error, $interim_login, $action;

 	// Don't index any of these forms
-	add_action( 'login_head', 'wp_no_robots' );
+	add_action( 'login_head', 'wp_sensitive_page_meta' );

 	if ( wp_is_mobile() )
 		add_action( 'login_head', 'wp_login_viewport_meta' );
Author	SHA1	Message	Date
Sergey Biryukov	4b460f691f	Tag 4.5.20 Built from https://develop.svn.wordpress.org/tags/4.5.20@46945 git-svn-id: http://core.svn.wordpress.org/tags/4.5.20@46745 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-12-12 21:13:07 +00:00
Sergey Biryukov	6f2686ba36	WordPress 4.5.20 Built from https://develop.svn.wordpress.org/branches/4.5@46928 git-svn-id: http://core.svn.wordpress.org/branches/4.5@46728 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-12-12 20:30:20 +00:00
Sergey Biryukov	22450a0f8b	Update `wp_kses_bad_protocol()` to recognize `&colon;` on uri attributes, `wp_kses_bad_protocol()` makes sure to validate that uri attributes don’t contain invalid/or not allowed protocols. While this works fine in most cases, there’s a risk that by using the colon html5 named entity, one is able to bypass this function. Brings r46895 to the 4.5 branch. Props: xknown, nickdaugherty, peterwilsoncc. Built from https://develop.svn.wordpress.org/branches/4.5@46913 git-svn-id: http://core.svn.wordpress.org/branches/4.5@46713 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-12-12 18:45:22 +00:00
desrosj	102f8be630	WordPress 4.5.19. Built from https://develop.svn.wordpress.org/branches/4.5@46515 git-svn-id: http://core.svn.wordpress.org/branches/4.5@46312 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-10-14 20:11:21 +00:00
whyisjake	c50dcb41b6	Backporting several bug fixes. - Query: Remove the static query property. - HTTP API: Protect against hex interpretation. - Filesystem API: Prevent directory travelersals when creating new folders. - Administration: Ensure that admin referer nonce is valid. - REST API: Send a Vary: Origin header on GET requests. - Customizer: Properly sanitize background images. Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@46497 git-svn-id: http://core.svn.wordpress.org/branches/4.5@46294 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-10-14 19:07:24 +00:00
desrosj	5c04f19922	WordPress 4.5.18. Built from https://develop.svn.wordpress.org/branches/4.5@46039 git-svn-id: http://core.svn.wordpress.org/branches/4.5@45851 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-09-04 22:04:22 +00:00
Andrew Ozz	89edee341f	jQuery: Backport the patch from jQuery 3.4.0. Merges [45342] to the 4.5 branch. Props MikeNGarrett, peterwilsoncc, azaozz. Fixes #47020. Built from https://develop.svn.wordpress.org/branches/4.5@46027 git-svn-id: http://core.svn.wordpress.org/branches/4.5@45837 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-09-04 21:48:52 +00:00
desrosj	b44c70212c	Fix for URL sanitization in `wp_kses_bad_protocol_once()`. Merges [45997] to the 4.5 branch. Props irsdl, sstoqnov, whyisjake. Built from https://develop.svn.wordpress.org/branches/4.5@46009 git-svn-id: http://core.svn.wordpress.org/branches/4.5@45820 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-09-04 21:40:35 +00:00
Sergey Biryukov	d91ad3f2a1	Improve handling the existing `rel` attribute in `wp_rel_nofollow_callback()`. Merges [45990] to the 4.5 branch. Props xknown, sstoqnov. Built from https://develop.svn.wordpress.org/branches/4.5@45999 git-svn-id: http://core.svn.wordpress.org/branches/4.5@45810 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-09-04 17:54:21 +00:00
Sergey Biryukov	8558d3976f	Improve URL validation in `wp_validate_redirect()`. Merges [45971] to the 4.5 branch. Props vortfu, whyisjake, peterwilsoncc. Built from https://develop.svn.wordpress.org/branches/4.5@45980 git-svn-id: http://core.svn.wordpress.org/branches/4.5@45791 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-09-04 17:13:42 +00:00
whyisjake	2d31982eaf	Remove _convert_urlencoded_to_entities() from the get_the_content() callback. Merges [45937] to the 4.5 branch. Props vortfu, whyisjake, peterwilsoncc Built from https://develop.svn.wordpress.org/branches/4.5@45957 git-svn-id: http://core.svn.wordpress.org/branches/4.5@45768 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-09-04 16:41:21 +00:00
Sergey Biryukov	65d87ce862	Escape the output in `wp_ajax_upload_attachment()`. Merges [45936] to the 4.5 branch. Props whyisjake, sstoqnov. Built from https://develop.svn.wordpress.org/branches/4.5@45950 git-svn-id: http://core.svn.wordpress.org/branches/4.5@45761 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-09-04 16:37:09 +00:00
Gary Pendergast	a55abbe18f	WordPress 4.5.17 Built from https://develop.svn.wordpress.org/branches/4.5@44876 git-svn-id: http://core.svn.wordpress.org/branches/4.5@44707 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-03-13 01:25:20 +00:00
Sergey Biryukov	f056a36272	Formatting: Fix a PHP warning in introduced in [44840]. Merges [44864] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@44865 git-svn-id: http://core.svn.wordpress.org/branches/4.5@44696 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-03-13 00:38:20 +00:00
Sergey Biryukov	fb7f4bf7b6	Comments: Improve comment content filtering. Merges [44842] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@44849 git-svn-id: http://core.svn.wordpress.org/branches/4.5@44681 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-03-12 22:38:19 +00:00
Sergey Biryukov	4db371262e	Formatting: Improve `rel="nofollow"` handling in comments. Merges [44833] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@44840 git-svn-id: http://core.svn.wordpress.org/branches/4.5@44672 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2019-03-12 22:25:20 +00:00
Jeremy Felt	ab5c2ba564	Bump 4.5 branch to version 4.5.16. Built from https://develop.svn.wordpress.org/branches/4.5@44082 git-svn-id: http://core.svn.wordpress.org/branches/4.5@43912 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-12-13 02:14:25 +00:00
Gary Pendergast	ab40c9608a	Editor: Remove unwanted fields before saving posts. The `meta_input`, `file`, and `guid` fields are not intended to be updated through user input. Merges [44047] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@44060 git-svn-id: http://core.svn.wordpress.org/branches/4.5@43890 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-12-13 01:45:20 +00:00
Peter Wilson	baa754b110	Multisite: Validate activation links. Merges [44048] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@44059 git-svn-id: http://core.svn.wordpress.org/branches/4.5@43889 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-12-13 01:44:20 +00:00
iandunn	a79ebd98e8	KSES: Make the URI attributes DRY. This commit introduces the `wp_kses_uri_attributes` function and filter. The function centralizes the list of attributes, in order to prevent inconsistency, and the filter provides a way for plugins to customize the attributes. Merges [44014] and [44017] to the `4.6` branch. Built from https://develop.svn.wordpress.org/branches/4.5@44032 git-svn-id: http://core.svn.wordpress.org/branches/4.5@43862 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-12-13 00:54:20 +00:00
Peter Wilson	42e2569843	Multisite: Improve messaging for previously activated users. Ensure activation of a site is not attempted multiple times and users are shown the correct message if they follow the link a second time. Merges [44021] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@44029 git-svn-id: http://core.svn.wordpress.org/branches/4.5@43859 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-12-13 00:47:20 +00:00
Gary Pendergast	368895642d	KSES: Conditionally remove the `<form>` element from `$allowedposttags`. To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`. Merges [43994] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@44002 git-svn-id: http://core.svn.wordpress.org/branches/4.5@43834 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-12-12 23:29:21 +00:00
Jeremy Felt	822cb35130	Media: Improve verification of MIME file types. Merges [43988] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@43993 git-svn-id: http://core.svn.wordpress.org/branches/4.5@43825 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-12-12 23:11:21 +00:00
Aaron Campbell	dce2bd647f	Bump 4.5 branch to version 4.5.15 Built from https://develop.svn.wordpress.org/branches/4.5@43411 git-svn-id: http://core.svn.wordpress.org/branches/4.5@43239 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-07-05 16:12:28 +00:00
John Blackbourn	cde3e1022a	Media: Limit thumbnail file deletions to the same directory as the original file. Merges [43393] into the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@43397 git-svn-id: http://core.svn.wordpress.org/branches/4.5@43225 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-07-05 14:55:23 +00:00
Aaron Campbell	fff3ef94b7	Bump 4.5 branch to version 4.5.14 Built from https://develop.svn.wordpress.org/branches/4.5@42937 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42767 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-04-03 20:29:32 +00:00
Dominik Schilling	3465fda2e7	Template: Make sure the version string is correctly escaped for use in attributes. Merge of [42893] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@42921 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42751 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-04-03 16:08:10 +00:00
Dominik Schilling	52e15eb4d6	Meta: Simplify the delete all meta query in `delete_metadata()`. Merge of [42913] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@42916 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42746 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-04-03 15:43:03 +00:00
Dominik Schilling	764b72595b	HTTP: Don't treat `localhost` as same host by default. Merge of [42894] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@42912 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42742 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-04-03 15:37:53 +00:00
Dominik Schilling	f59a558d1f	Login: Use `wp_safe_redirect()` when redirecting the login page if forced to use HTTPS. Merge of [42892] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@42899 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42729 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-04-03 15:31:11 +00:00
Sergey Biryukov	f3e648fc4b	General: Update copyright year to 2018 in license.txt. Props rachelbaker. Merges [42424] to the 4.5 branch. Fixes #43007. Built from https://develop.svn.wordpress.org/branches/4.5@42556 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42385 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-01-23 11:27:46 +00:00
Dion Hulse	466e565a32	Bump the 4.5 branch to 4.5.13. Built from https://develop.svn.wordpress.org/branches/4.5@42498 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42327 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-01-16 21:42:07 +00:00
Dion Hulse	c5126cd06a	External Libraries: Remove unnecessary / obsoleted MediaElement.js files. Merges [42478] to the 4.5 branch. Fixes #42720 for 4.5. Built from https://develop.svn.wordpress.org/branches/4.5@42481 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42310 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-01-16 08:08:33 +00:00
Dion Hulse	fce8018006	Upgrade: When deleting old files, if deletion fails attempt to empty the file instead. Props joemcgill, dd32. Merges [42434] to the 4.5 branch. Fixes #42963 for 4.5. Built from https://develop.svn.wordpress.org/branches/4.5@42469 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42298 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2018-01-16 06:56:04 +00:00
John Blackbourn	c33337c395	Bump 4.5 branch to 4.5.12. Built from https://develop.svn.wordpress.org/branches/4.5@42320 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42149 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-11-29 19:00:32 +00:00
John Blackbourn	db1e3afed0	Hardening: Remove the ability to upload JavaScript files for users who do not have the `unfiltered_html` capability. Merges [42261] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@42283 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42112 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-11-29 16:27:34 +00:00
John Blackbourn	8511c84d2c	Hardening: Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds. Merges [42260] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@42282 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42111 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-11-29 16:27:01 +00:00
John Blackbourn	cc28f09509	Hardening: Add escaping to the language attributes used on `html` elements. Merges [42259] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@42281 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42110 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-11-29 16:26:31 +00:00
John Blackbourn	f19b2b4635	Hardening: Use a properly generated hash for the `newbloguser` key instead of a determinate substring. Merges [42258] to the 4.5 branch. Built from https://develop.svn.wordpress.org/branches/4.5@42280 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42109 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-11-29 16:25:07 +00:00
Dion Hulse	4d65d6de5b	WPDB: Check that `AUTH_SALT` is not empty, Fix a PHP notice when `AUTH_SALT` is undefined. Props jsonfry, mkomar, pento. Merges [42119] and [42120] to the 4.5 branch. Fixes #42431 and #42401 for 4.5. Built from https://develop.svn.wordpress.org/branches/4.5@42233 git-svn-id: http://core.svn.wordpress.org/branches/4.5@42062 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-11-27 01:10:32 +00:00
John Blackbourn	53e10c441b	General: Remove the version number from the readme file in the 4.5 branch. See #42386 Built from https://develop.svn.wordpress.org/branches/4.5@42102 git-svn-id: http://core.svn.wordpress.org/branches/4.5@41931 1a063a9b-81f0-0310-95a4-ce76da25c4cd	2017-10-31 18:08:07 +00:00