Compare commits

..

1 Commits

Author SHA1 Message Date
Sergey Biryukov
5d187173d0 Tag 4.6.23
Built from https://develop.svn.wordpress.org/tags/4.6.23@52910


git-svn-id: http://core.svn.wordpress.org/tags/4.6.23@52499 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2022-03-11 00:33:06 +00:00
20 changed files with 21 additions and 151 deletions

View File

@@ -60,66 +60,6 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
<div class="changelog point-releases">
<h3><?php _e( 'Maintenance and Security Releases' ); ?></h3>
<p>
<?php
printf(
/* translators: %s: WordPress version number */
__( '<strong>Version %s</strong> addressed some security issues.' ),
'4.6.26'
);
?>
<?php
printf(
/* translators: %s: HelpHub URL */
__( 'For more information, see <a href="%s">the release notes</a>.' ),
sprintf(
/* translators: %s: WordPress version */
esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
sanitize_title( '4.6.26' )
)
);
?>
</p>
<p>
<?php
printf(
/* translators: %s: WordPress version number */
__( '<strong>Version %s</strong> addressed some security issues.' ),
'4.6.25'
);
?>
<?php
printf(
/* translators: %s: HelpHub URL */
__( 'For more information, see <a href="%s">the release notes</a>.' ),
sprintf(
/* translators: %s: WordPress version */
esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
sanitize_title( '4.6.25' )
)
);
?>
</p>
<p>
<?php
printf(
/* translators: %s: WordPress version number */
__( '<strong>Version %s</strong> addressed some security issues.' ),
'4.6.24'
);
?>
<?php
printf(
/* translators: %s: HelpHub URL */
__( 'For more information, see <a href="%s">the release notes</a>.' ),
sprintf(
/* translators: %s: WordPress version */
esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
sanitize_title( '4.6.24' )
)
);
?>
</p>
<p>
<?php
printf(
@@ -553,15 +493,3 @@ _n_noop( '<strong>Version %1$s</strong> addressed some security issues and fixed
/* translators: %s: Codex URL */
__( 'For more information, see <a href="%s">the release notes</a>.' );
/* translators: 1: WordPress version number, 2: Link to update WordPress */
__( 'Important! Your version of WordPress (%1$s) is no longer supported, you will not receive any security updates for your website. To keep your site secure, please <a href="%2$s">update to the latest version of WordPress</a>.' );
/* translators: 1: WordPress version number, 2: Link to update WordPress */
__( 'Important! Your version of WordPress (%1$s) will stop receiving security updates in the near future. To keep your site secure, please <a href="%2$s">update to the latest version of WordPress</a>.' );
/* translators: %s: The major version of WordPress for this branch. */
__( 'This is the final release of WordPress %s' );
/* translators: The localized WordPress download URL. */
__( 'https://wordpress.org/download/' );

View File

@@ -2211,10 +2211,6 @@ function wp_ajax_set_attachment_thumbnail() {
wp_send_json_error();
}
if ( false === check_ajax_referer( 'set-attachment-thumbnail', '_ajax_nonce', false ) ) {
wp_send_json_error();
}
$post_ids = array();
// For each URL, try to find its corresponding post ID.
foreach ( $_POST['urls'] as $url ) {

View File

@@ -423,7 +423,7 @@ if ( ! empty( $invalid ) ) {
/* translators: 1: plugin file 2: error message */
__( 'The plugin %1$s has been <strong>deactivated</strong> due to an error: %2$s' ),
'<code>' . esc_html( $plugin_file ) . '</code>',
esc_html( $error->get_error_message() ) );
$error->get_error_message() );
echo '</p></div>';
}
}
@@ -458,7 +458,7 @@ if ( ! empty( $invalid ) ) {
delete_transient( 'plugins_delete_result_' . $user_ID );
if ( is_wp_error($delete_result) ) : ?>
<div id="message" class="error notice is-dismissible"><p><?php printf( __('Plugin could not be deleted due to an error: %s'), esc_html( $delete_result->get_error_message() ) ); ?></p></div>
<div id="message" class="error notice is-dismissible"><p><?php printf( __('Plugin could not be deleted due to an error: %s'), $delete_result->get_error_message() ); ?></p></div>
<?php else : ?>
<div id="message" class="updated notice is-dismissible">
<p>

View File

@@ -281,7 +281,7 @@ function get_bookmarks( $args = '' ) {
$query .= " $exclusions $inclusions $search";
$query .= " ORDER BY $orderby $order";
if ( $r['limit'] != -1 ) {
$query .= ' LIMIT ' . absint( $r['limit'] );
$query .= ' LIMIT ' . $r['limit'];
}
$results = $wpdb->get_results( $query );

View File

@@ -1989,15 +1989,6 @@ function wp_update_comment($commentarr) {
return 0;
}
$filter_comment = false;
if ( ! has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) {
$filter_comment = ! user_can( isset( $comment['user_id'] ) ? $comment['user_id'] : 0, 'unfiltered_html' );
}
if ( $filter_comment ) {
add_filter( 'pre_comment_content', 'wp_filter_kses' );
}
// Escape data pulled from DB.
$comment = wp_slash($comment);
@@ -2008,10 +1999,6 @@ function wp_update_comment($commentarr) {
$commentarr = wp_filter_comment( $commentarr );
if ( $filter_comment ) {
remove_filter( 'pre_comment_content', 'wp_filter_kses' );
}
// Now extract the merged array.
$data = wp_unslash( $commentarr );

View File

@@ -107,10 +107,10 @@ class WP_Customize_Header_Image_Control extends WP_Customize_Image_Control {
<# } #>
<button type="button" class="choice thumbnail"
data-customize-image-value="{{data.header.url}}"
data-customize-image-value="{{{data.header.url}}}"
data-customize-header-image-data="{{JSON.stringify(data.header)}}">
<span class="screen-reader-text"><?php _e( 'Set image' ); ?></span>
<img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" />
<img src="{{{data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}">
</button>
<# } #>

View File

@@ -69,7 +69,7 @@ class WP_Customize_Site_Icon_Control extends WP_Customize_Cropped_Image_Control
<div class="favicon">
<img src="{{ data.attachment.sizes.full.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>"/>
</div>
<span class="browser-title" aria-hidden="true"><?php echo esc_js( get_bloginfo( 'name' ) ); ?></span>
<span class="browser-title" aria-hidden="true"><?php bloginfo( 'name' ); ?></span>
</div>
<img class="app-icon-preview" src="{{ data.attachment.sizes.full.url }}" alt="<?php esc_attr_e( 'Preview as an app icon' ); ?>"/>
</div>

View File

@@ -152,8 +152,8 @@ class WP_Date_Query {
*/
public function __construct( $date_query, $default_column = 'post_date' ) {
if ( isset( $date_query['relation'] ) ) {
$this->relation = $this->sanitize_relation( $date_query['relation'] );
if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] ) ) {
$this->relation = 'OR';
} else {
$this->relation = 'AND';
}
@@ -233,9 +233,6 @@ class WP_Date_Query {
$this->validate_date_values( $queries );
}
// Sanitize the relation parameter.
$queries['relation'] = $this->sanitize_relation( $queries['relation'] );
foreach ( $queries as $key => $q ) {
if ( ! is_array( $q ) || in_array( $key, $this->time_keys, true ) ) {
// This is a first-order query. Trust the values and sanitize when building SQL.
@@ -1018,20 +1015,4 @@ class WP_Date_Query {
return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time );
}
/**
* Sanitizes a 'relation' operator.
*
* @since 6.0.3
*
* @param string $relation Raw relation key from the query argument.
* @return string Sanitized relation ('AND' or 'OR').
*/
public function sanitize_relation( $relation ) {
if ( 'OR' === strtoupper( $relation ) ) {
return 'OR';
} else {
return 'AND';
}
}
}

View File

@@ -440,7 +440,7 @@ function get_post_embed_html( $width, $height, $post = null ) {
* and edit wp-embed.js directly.
*/
$output .=<<<JS
!function(d,l){"use strict";var e=!1,n=!1;if(l.querySelector)if(d.addEventListener)e=!0;if(d.wp=d.wp||{},!d.wp.receiveEmbedMessage)if(d.wp.receiveEmbedMessage=function(e){var t=e.data;if(t.secret||t.message||t.value)if(!/[^a-zA-Z0-9]/.test(t.secret)){for(var r,a,i,s=l.querySelectorAll('iframe[data-secret="'+t.secret+'"]'),n=l.querySelectorAll('blockquote[data-secret="'+t.secret+'"]'),o=new RegExp("^https?:$","i"),c=0;c<n.length;c++)n[c].style.display="none";for(c=0;c<s.length;c++)if(r=s[c],e.source===r.contentWindow){if(r.removeAttribute("style"),"height"===t.message){if(1e3<(i=parseInt(t.value,10)))i=1e3;else if(~~i<200)i=200;r.height=i}if("link"===t.message)if(a=l.createElement("a"),i=l.createElement("a"),a.href=r.getAttribute("src"),i.href=t.value,o.test(i.protocol))if(i.host===a.host)if(l.activeElement===r)d.top.location.href=t.value}}},e)d.addEventListener("message",d.wp.receiveEmbedMessage,!1),l.addEventListener("DOMContentLoaded",t,!1),d.addEventListener("load",t,!1);function t(){if(!n){n=!0;for(var e,t,r=-1!==navigator.appVersion.indexOf("MSIE 10"),a=!!navigator.userAgent.match(/Trident.*rv:11\./),i=l.querySelectorAll("iframe.wp-embedded-content"),s=0;s<i.length;s++)if(!(e=i[s]).getAttribute("data-secret"))if(t=Math.random().toString(36).substr(2,10),e.src+="#?secret="+t,e.setAttribute("data-secret",t),r||a)(t=e.cloneNode(!0)).removeAttribute("security"),e.parentNode.replaceChild(t,e)}}}(window,document);
!function(c,d){"use strict";var e=!1,n=!1;if(d.querySelector)if(c.addEventListener)e=!0;if(c.wp=c.wp||{},!c.wp.receiveEmbedMessage)if(c.wp.receiveEmbedMessage=function(e){var t=e.data;if(t.secret||t.message||t.value)if(!/[^a-zA-Z0-9]/.test(t.secret)){for(var r,a,i,s=d.querySelectorAll('iframe[data-secret="'+t.secret+'"]'),n=d.querySelectorAll('blockquote[data-secret="'+t.secret+'"]'),o=0;o<n.length;o++)n[o].style.display="none";for(o=0;o<s.length;o++)if(r=s[o],e.source===r.contentWindow){if(r.removeAttribute("style"),"height"===t.message){if(1e3<(i=parseInt(t.value,10)))i=1e3;else if(~~i<200)i=200;r.height=i}if("link"===t.message)if(a=d.createElement("a"),i=d.createElement("a"),a.href=r.getAttribute("src"),i.href=t.value,i.host===a.host)if(d.activeElement===r)c.top.location.href=t.value}}},e)c.addEventListener("message",c.wp.receiveEmbedMessage,!1),d.addEventListener("DOMContentLoaded",t,!1),c.addEventListener("load",t,!1);function t(){if(!n){n=!0;for(var e,t,r=-1!==navigator.appVersion.indexOf("MSIE 10"),a=!!navigator.userAgent.match(/Trident.*rv:11\./),i=d.querySelectorAll("iframe.wp-embedded-content"),s=0;s<i.length;s++)if(!(e=i[s]).getAttribute("data-secret"))if(t=Math.random().toString(36).substr(2,10),e.src+="#?secret="+t,e.setAttribute("data-secret",t),r||a)(t=e.cloneNode(!0)).removeAttribute("security"),e.parentNode.replaceChild(t,e)}}}(window,document);
JS;
}
$output .= "\n//--><!]]>";

View File

@@ -2627,16 +2627,8 @@ function wp_nonce_ays( $action ) {
$html .= sprintf( __( "Do you really want to <a href='%s'>log out</a>?"), wp_logout_url( $redirect_to ) );
} else {
$html = __( 'Are you sure you want to do this?' );
if ( wp_get_referer() ) {
$wp_http_referer = remove_query_arg( 'updated', wp_get_referer() );
$wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) );
$html .= '</p><p>';
$html .= sprintf(
'<a href="%s">%s</a>',
esc_url( $wp_http_referer ),
__( 'Please try again.' )
);
}
if ( wp_get_referer() )
$html .= "</p><p><a href='" . esc_url( remove_query_arg( 'updated', wp_get_referer() ) ) . "'>" . __( 'Please try again.' ) . "</a>";
}
wp_die( $html, __( 'WordPress Failure Notice' ), 403 );

View File

@@ -37,7 +37,6 @@
var iframes = document.querySelectorAll( 'iframe[data-secret="' + data.secret + '"]' ),
blockquotes = document.querySelectorAll( 'blockquote[data-secret="' + data.secret + '"]' ),
allowedProtocols = new RegExp( '^https?:$', 'i' ),
i, source, height, sourceURL, targetURL;
for ( i = 0; i < blockquotes.length; i++ ) {
@@ -73,11 +72,6 @@
sourceURL.href = source.getAttribute( 'src' );
targetURL.href = data.value;
/* Only follow link if the protocol is in the allow list. */
if ( ! allowedProtocols.test( targetURL.protocol ) ) {
continue;
}
/* Only continue if link hostname matches iframe's hostname. */
if ( targetURL.host === sourceURL.host ) {
if ( document.activeElement === source ) {

View File

@@ -1 +1 @@
!function(d,l){"use strict";var e=!1,n=!1;if(l.querySelector)if(d.addEventListener)e=!0;if(d.wp=d.wp||{},!d.wp.receiveEmbedMessage)if(d.wp.receiveEmbedMessage=function(e){var t=e.data;if(t.secret||t.message||t.value)if(!/[^a-zA-Z0-9]/.test(t.secret)){for(var r,a,i,s=l.querySelectorAll('iframe[data-secret="'+t.secret+'"]'),n=l.querySelectorAll('blockquote[data-secret="'+t.secret+'"]'),o=new RegExp("^https?:$","i"),c=0;c<n.length;c++)n[c].style.display="none";for(c=0;c<s.length;c++)if(r=s[c],e.source===r.contentWindow){if(r.removeAttribute("style"),"height"===t.message){if(1e3<(i=parseInt(t.value,10)))i=1e3;else if(~~i<200)i=200;r.height=i}if("link"===t.message)if(a=l.createElement("a"),i=l.createElement("a"),a.href=r.getAttribute("src"),i.href=t.value,o.test(i.protocol))if(i.host===a.host)if(l.activeElement===r)d.top.location.href=t.value}}},e)d.addEventListener("message",d.wp.receiveEmbedMessage,!1),l.addEventListener("DOMContentLoaded",t,!1),d.addEventListener("load",t,!1);function t(){if(!n){n=!0;for(var e,t,r=-1!==navigator.appVersion.indexOf("MSIE 10"),a=!!navigator.userAgent.match(/Trident.*rv:11\./),i=l.querySelectorAll("iframe.wp-embedded-content"),s=0;s<i.length;s++)if(!(e=i[s]).getAttribute("data-secret"))if(t=Math.random().toString(36).substr(2,10),e.src+="#?secret="+t,e.setAttribute("data-secret",t),r||a)(t=e.cloneNode(!0)).removeAttribute("security"),e.parentNode.replaceChild(t,e)}}}(window,document);
!function(c,d){"use strict";var e=!1,n=!1;if(d.querySelector)if(c.addEventListener)e=!0;if(c.wp=c.wp||{},!c.wp.receiveEmbedMessage)if(c.wp.receiveEmbedMessage=function(e){var t=e.data;if(t.secret||t.message||t.value)if(!/[^a-zA-Z0-9]/.test(t.secret)){for(var r,a,i,s=d.querySelectorAll('iframe[data-secret="'+t.secret+'"]'),n=d.querySelectorAll('blockquote[data-secret="'+t.secret+'"]'),o=0;o<n.length;o++)n[o].style.display="none";for(o=0;o<s.length;o++)if(r=s[o],e.source===r.contentWindow){if(r.removeAttribute("style"),"height"===t.message){if(1e3<(i=parseInt(t.value,10)))i=1e3;else if(~~i<200)i=200;r.height=i}if("link"===t.message)if(a=d.createElement("a"),i=d.createElement("a"),a.href=r.getAttribute("src"),i.href=t.value,i.host===a.host)if(d.activeElement===r)c.top.location.href=t.value}}},e)c.addEventListener("message",c.wp.receiveEmbedMessage,!1),d.addEventListener("DOMContentLoaded",t,!1),c.addEventListener("load",t,!1);function t(){if(!n){n=!0;for(var e,t,r=-1!==navigator.appVersion.indexOf("MSIE 10"),a=!!navigator.userAgent.match(/Trident.*rv:11\./),i=d.querySelectorAll("iframe.wp-embedded-content"),s=0;s<i.length;s++)if(!(e=i[s]).getAttribute("data-secret"))if(t=Math.random().toString(36).substr(2,10),e.src+="#?secret="+t,e.setAttribute("data-secret",t),r||a)(t=e.cloneNode(!0)).removeAttribute("security"),e.parentNode.replaceChild(t,e)}}}(window,document);

View File

@@ -1245,7 +1245,7 @@ function wp_print_media_templates() {
<div class="favicon">
<img id="preview-favicon" src="{{ data.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>"/>
</div>
<span class="browser-title" aria-hidden="true"><?php echo esc_js( get_bloginfo( 'name' ) ); ?></span>
<span class="browser-title" aria-hidden="true"><?php bloginfo( 'name' ); ?></span>
</div>
<strong aria-hidden="true"><?php _e( 'As an app icon' ); ?></strong>

View File

@@ -3300,8 +3300,7 @@ function wp_enqueue_media( $args = array() ) {
/** This filter is documented in wp-admin/includes/media.php */
'captions' => ! apply_filters( 'disable_captions', '' ),
'nonce' => array(
'sendToEditor' => wp_create_nonce( 'media-send-to-editor' ),
'setAttachmentThumbnail' => wp_create_nonce( 'set-attachment-thumbnail' ),
'sendToEditor' => wp_create_nonce( 'media-send-to-editor' ),
),
'post' => array(
'id' => 0,

View File

@@ -308,8 +308,6 @@ function wp_mail( $to, $subject, $message, $headers = '', $attachments = array()
$phpmailer->ClearAttachments();
$phpmailer->ClearCustomHeaders();
$phpmailer->ClearReplyTos();
$phpmailer->Body = '';
$phpmailer->AltBody = '';
// From email and name
// If we don't have a name from the input headers

View File

@@ -975,10 +975,10 @@ function post_custom( $key = '' ) {
*
* @since 1.2.0
*
* @deprecated 6.0.2 Use get_post_meta() to retrieve post meta and render manually.
* @internal This will probably change at some point...
*
*/
function the_meta() {
_deprecated_function( __FUNCTION__, '6.0.2', 'get_post_meta()' );
if ( $keys = get_post_custom_keys() ) {
echo "<ul class='post-meta'>\n";
foreach ( (array) $keys as $key ) {
@@ -997,7 +997,7 @@ function the_meta() {
* @param string $key Meta key.
* @param string $value Meta value.
*/
echo apply_filters( 'the_meta_key', "<li><span class='post-meta-key'>" . esc_html( $key ) . ":</span>" . esc_html( $value ) . "</li>\n", $key, $value );
echo apply_filters( 'the_meta_key', "<li><span class='post-meta-key'>$key:</span> $value</li>\n", $key, $value );
}
echo "</ul>\n";
}

View File

@@ -4,7 +4,7 @@
*
* @global string $wp_version
*/
$wp_version = '4.6.26';
$wp_version = '4.6.23';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

View File

@@ -1233,7 +1233,7 @@ function wp_widget_rss_output( $rss, $args = array() ) {
if ( is_wp_error($rss) ) {
if ( is_admin() || current_user_can('manage_options') )
echo '<p>' . sprintf( __('<strong>RSS Error</strong>: %s'), esc_html( $rss->get_error_message() ) ) . '</p>';
echo '<p>' . sprintf( __('<strong>RSS Error</strong>: %s'), $rss->get_error_message() ) . '</p>';
return;
}
@@ -1342,7 +1342,7 @@ function wp_widget_rss_form( $args, $inputs = null ) {
$args['show_date'] = isset( $args['show_date'] ) ? (int) $args['show_date'] : (int) $inputs['show_date'];
if ( ! empty( $args['error'] ) ) {
echo '<p class="widget-error"><strong>' . sprintf( __( 'RSS Error: %s' ), esc_html( $args['error'] ) ) . '</strong></p>';
echo '<p class="widget-error"><strong>' . sprintf( __( 'RSS Error: %s' ), $args['error'] ) . '</strong></p>';
}
$esc_number = esc_attr( $args['number'] );

View File

@@ -60,9 +60,6 @@ if( 0 === $count ) {
wp_die( __('There doesn&#8217;t seem to be any new mail.') );
}
// Always run as an unauthenticated user.
wp_set_current_user( 0 );
for ( $i = 1; $i <= $count; $i++ ) {
$message = $pop3->get($i);
@@ -127,6 +124,7 @@ for ( $i = 1; $i <= $count; $i++ ) {
$author = trim($line);
$author = sanitize_email($author);
if ( is_email($author) ) {
echo '<p>' . sprintf(__('Author is %s'), $author) . '</p>';
$userdata = get_user_by('email', $author);
if ( ! empty( $userdata ) ) {
$post_author = $userdata->ID;

View File

@@ -13,9 +13,6 @@ if (empty($wp)) {
wp( array( 'tb' => '1' ) );
}
// Always run as an unauthenticated user.
wp_set_current_user( 0 );
/**
* Response to a trackback.
*