Tag 4.6

Built from https://develop.svn.wordpress.org/tags/4.6@38270 git-svn-id: http://core.svn.wordpress.org/tags/4.6@38211 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-08-16 20:36:10 +00:00
40 changed files with 229 additions and 690 deletions
--- a/license.txt
+++ b/license.txt
@@ -1,6 +1,6 @@
 WordPress - Web publishing software

-Copyright 2011-2017 by the contributors
+Copyright 2011-2016 by the contributors

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
--- a/readme.html
+++ b/readme.html
@@ -9,7 +9,7 @@
 <body>
 <h1 id="logo">
 	<a href="https://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
-	<br /> Version 4.6.3
+	<br /> Version 4.6
 </h1>
 <p style="text-align: center">Semantic Personal Publishing Platform</p>

--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -58,20 +58,6 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 			<a href="freedoms.php" class="nav-tab"><?php _e( 'Freedoms' ); ?></a>
 		</h2>

-		<div class="changelog point-releases">
-			<h3><?php _e( 'Maintenance and Security Releases' ); ?></h3>
-			<p><?php printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.6.3' ); ?>
-				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.6.3' ); ?>
-			</p>
-			<p><?php printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.6.2' ); ?>
-				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.6.2' ); ?>
-			</p>
-			<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
-				'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 15 ), '4.6.1', number_format_i18n( 15 ) ); ?>
-				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.6.1' ); ?>
-			</p>
-		</div>
-
 		<div class="headline-feature feature-video">
 			<iframe width="1050" height="591" src="<?php echo esc_url( $video_url ); ?>" frameborder="0" allowfullscreen></iframe>
 			<script src="https://videopress.com/videopress-iframe.js"></script>
--- a/wp-admin/includes/class-file-upload-upgrader.php
+++ b/wp-admin/includes/class-file-upload-upgrader.php
@@ -100,12 +100,8 @@ class File_Upload_Upgrader {
 			if ( ! ( ( $uploads = wp_upload_dir() ) && false === $uploads['error'] ) )
 				wp_die( $uploads['error'] );

-			$this->filename = sanitize_file_name( $_GET[ $urlholder ] );
+			$this->filename = $_GET[$urlholder];
 			$this->package = $uploads['basedir'] . '/' . $this->filename;
-
-			if ( 0 !== strpos( realpath( $this->package ), realpath( $uploads['basedir'] ) ) ) {
-				wp_die( __( 'Please select a file' ) );
-			}
 		}
 	}

--- a/wp-admin/includes/class-language-pack-upgrader.php
+++ b/wp-admin/includes/class-language-pack-upgrader.php
@@ -282,9 +282,9 @@ class Language_Pack_Upgrader extends WP_Upgrader {

 		// Re-add upgrade hooks.
 		add_action( 'upgrader_process_complete', array( 'Language_Pack_Upgrader', 'async_upgrade' ), 20 );
-		add_action( 'upgrader_process_complete', 'wp_version_check', 10, 0 );
-		add_action( 'upgrader_process_complete', 'wp_update_plugins', 10, 0 );
-		add_action( 'upgrader_process_complete', 'wp_update_themes', 10, 0 );
+		add_action( 'upgrader_process_complete', 'wp_version_check' );
+		add_action( 'upgrader_process_complete', 'wp_update_plugins' );
+		add_action( 'upgrader_process_complete', 'wp_update_themes' );

 		$this->skin->bulk_footer();

--- a/wp-admin/includes/class-wp-posts-list-table.php
+++ b/wp-admin/includes/class-wp-posts-list-table.php
@@ -939,7 +939,7 @@ class WP_Posts_List_Table extends WP_List_Table {
 		}

 		if ( ! is_post_type_hierarchical( $this->screen->post_type ) && 'excerpt' === $mode && current_user_can( 'read_post', $post->ID ) ) {
-			echo esc_html( get_the_excerpt() );
+			the_excerpt();
 		}

 		get_inline_data( $post );
--- a/wp-admin/includes/class-wp-press-this.php
+++ b/wp-admin/includes/class-wp-press-this.php
@@ -119,28 +119,10 @@ class WP_Press_This {
 			'post_type'     => 'post',
 			'post_status'   => 'draft',
 			'post_format'   => ( ! empty( $_POST['post_format'] ) ) ? sanitize_text_field( $_POST['post_format'] ) : '',
+			'tax_input'     => ( ! empty( $_POST['tax_input'] ) ) ? $_POST['tax_input'] : array(),
+			'post_category' => ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array(),
 		);

-		// Only accept categories if the user actually can assign
-		$category_tax = get_taxonomy( 'category' );
-		if ( current_user_can( $category_tax->cap->assign_terms ) ) {
-			$post_data['post_category'] = ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array();
-		}
-
-		// Only accept taxonomies if the user can actually assign
-		if ( ! empty( $_POST['tax_input'] ) ) {
-			$tax_input = $_POST['tax_input'];
-			foreach ( $tax_input as $tax => $_ti ) {
-				$tax_object = get_taxonomy( $tax );
-				if ( ! $tax_object || ! current_user_can( $tax_object->cap->assign_terms ) ) {
-					unset( $tax_input[ $tax ] );
-				}
-			}
-
-			$post_data['tax_input'] = $tax_input;
-		}
-
-		// Toggle status to pending if user cannot actually publish
 		if ( ! empty( $_POST['post_status'] ) && 'publish' === $_POST['post_status'] ) {
 			if ( current_user_can( 'publish_posts' ) ) {
 				$post_data['post_status'] = 'publish';
@@ -473,7 +455,7 @@ class WP_Press_This {
 	 * @since 4.2.0
 	 *
 	 * @param string $src Embed source URL.
-	 * @return string If not from a supported provider, an empty string. Otherwise, a reformatted embed URL.
+	 * @return string If not from a supported provider, an empty string. Otherwise, a reformattd embed URL.
 	 */
 	private function _limit_embed( $src ) {
 		$src = $this->_limit_url( $src );
@@ -874,12 +856,6 @@ class WP_Press_This {
 	public function categories_html( $post ) {
 		$taxonomy = get_taxonomy( 'category' );

-		// Bail if user cannot assign terms
-		if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) {
-			return;
-		}
-
-		// Only show "add" if user can edit terms
 		if ( current_user_can( $taxonomy->cap->edit_terms ) ) {
 			?>
 			<button type="button" class="add-cat-toggle button-link" aria-expanded="false">
@@ -1298,12 +1274,6 @@ class WP_Press_This {
 		wp_enqueue_script( 'json2' );
 		wp_enqueue_script( 'editor' );

-		$categories_tax   = get_taxonomy( 'category' );
-		$show_categories  = current_user_can( $categories_tax->cap->assign_terms ) || current_user_can( $categories_tax->cap->edit_terms );
-
-		$tag_tax          = get_taxonomy( 'post_tag' );
-		$show_tags        = current_user_can( $tag_tax->cap->assign_terms );
-
 		$supports_formats = false;
 		$post_format      = 0;

@@ -1455,21 +1425,17 @@ class WP_Press_This {
 					</button>
 				<?php endif; ?>

-				<?php if ( $show_categories ) : ?>
-					<button type="button" class="button-link post-option">
-						<span class="dashicons dashicons-category"></span>
-						<span class="post-option-title"><?php _e( 'Categories' ); ?></span>
-						<span class="dashicons post-option-forward"></span>
-					</button>
-				<?php endif; ?>
+				<button type="button" class="button-link post-option">
+					<span class="dashicons dashicons-category"></span>
+					<span class="post-option-title"><?php _e( 'Categories' ); ?></span>
+					<span class="dashicons post-option-forward"></span>
+				</button>

-				<?php if ( $show_tags ) : ?>
-					<button type="button" class="button-link post-option">
-						<span class="dashicons dashicons-tag"></span>
-						<span class="post-option-title"><?php _e( 'Tags' ); ?></span>
-						<span class="dashicons post-option-forward"></span>
-					</button>
-				<?php endif; ?>
+				<button type="button" class="button-link post-option">
+					<span class="dashicons dashicons-tag"></span>
+					<span class="post-option-title"><?php _e( 'Tags' ); ?></span>
+					<span class="dashicons post-option-forward"></span>
+				</button>
 			</div>

 			<?php if ( $supports_formats ) : ?>
@@ -1483,27 +1449,23 @@ class WP_Press_This {
 				</div>
 			<?php endif; ?>

-			<?php if ( $show_categories ) : ?>
-				<div class="setting-modal is-off-screen is-hidden">
-					<button type="button" class="button-link modal-close">
-						<span class="dashicons post-option-back"></span>
-						<span class="setting-title" aria-hidden="true"><?php _e( 'Categories' ); ?></span>
-						<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
-					</button>
-					<?php $this->categories_html( $post ); ?>
-				</div>
-			<?php endif; ?>
+			<div class="setting-modal is-off-screen is-hidden">
+				<button type="button" class="button-link modal-close">
+					<span class="dashicons post-option-back"></span>
+					<span class="setting-title" aria-hidden="true"><?php _e( 'Categories' ); ?></span>
+					<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
+				</button>
+				<?php $this->categories_html( $post ); ?>
+			</div>

-			<?php if ( $show_tags ) : ?>
-				<div class="setting-modal tags is-off-screen is-hidden">
-					<button type="button" class="button-link modal-close">
-						<span class="dashicons post-option-back"></span>
-						<span class="setting-title" aria-hidden="true"><?php _e( 'Tags' ); ?></span>
-						<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
-					</button>
-					<?php $this->tags_html( $post ); ?>
-				</div>
-			<?php endif; ?>
+			<div class="setting-modal tags is-off-screen is-hidden">
+				<button type="button" class="button-link modal-close">
+					<span class="dashicons post-option-back"></span>
+					<span class="setting-title" aria-hidden="true"><?php _e( 'Tags' ); ?></span>
+					<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
+				</button>
+				<?php $this->tags_html( $post ); ?>
+			</div>
 		</div><!-- .options-panel -->
 	</div><!-- .wrapper -->

--- a/wp-admin/includes/class-wp-screen.php
+++ b/wp-admin/includes/class-wp-screen.php
@@ -915,8 +915,7 @@ final class WP_Screen {

 		switch ( $this->base ) {
 			case 'widgets':
-				$nonce = wp_create_nonce( 'widgets-access' );
-				$this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on&_wpnonce=' . urlencode( $nonce ) . '">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off&_wpnonce=' . urlencode( $nonce ) . '">' . __('Disable accessibility mode') . "</a></p>\n";
+				$this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off">' . __('Disable accessibility mode') . "</a></p>\n";
 				break;
 			case 'post' :
 				$expand = '<fieldset class="editor-expand hidden"><legend>' . __( 'Additional settings' ) . '</legend><label for="editor-expand-toggle">';
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -290,7 +290,7 @@ function media_handle_upload($file_id, $post_id, $post_data = array(), $override
 	$url = $file['url'];
 	$type = $file['type'];
 	$file = $file['file'];
-	$title = sanitize_text_field( $name );
+	$title = $name;
 	$content = '';
 	$excerpt = '';

--- a/wp-admin/js/editor-expand.js
+++ b/wp-admin/js/editor-expand.js
@@ -53,47 +53,6 @@
 				sideSortablesHeight: 0
 			};

-		var shrinkTextarea = window._.throttle( function() {
-			var x = window.scrollX || document.documentElement.scrollLeft;
-			var y = window.scrollY || document.documentElement.scrollTop;
-			var height = parseInt( textEditor.style.height, 10 );
-
-			textEditor.style.height = autoresizeMinHeight + 'px';
-
-			if ( textEditor.scrollHeight > autoresizeMinHeight ) {
-				textEditor.style.height = textEditor.scrollHeight + 'px';
-			}
-
-			if ( typeof x !== 'undefined' ) {
-				window.scrollTo( x, y );
-			}
-
-			if ( textEditor.scrollHeight < height ) {
-				adjust();
-			}
-		}, 300 );
-
-		function textEditorResize() {
-			var length = textEditor.value.length;
-
-			if ( mceEditor && ! mceEditor.isHidden() ) {
-				return;
-			}
-
-			if ( ! mceEditor && initialMode === 'tinymce' ) {
-				return;
-			}
-
-			if ( length < oldTextLength ) {
-				shrinkTextarea();
-			} else if ( parseInt( textEditor.style.height, 10 ) < textEditor.scrollHeight ) {
-				textEditor.style.height = Math.ceil( textEditor.scrollHeight ) + 'px';
-				adjust();
-			}
-
-			oldTextLength = length;
-		}
-
 		function getHeights() {
 			var windowWidth = $window.width();

@@ -116,6 +75,43 @@
 			}
 		}

+		function textEditorResize() {
+			if ( mceEditor && ! mceEditor.isHidden() ) {
+				return;
+			}
+
+			if ( ! mceEditor && initialMode === 'tinymce' ) {
+				return;
+			}
+
+			var length = textEditor.value.length;
+			var height = parseInt( textEditor.style.height, 10 );
+			var top = window.scrollTop;
+
+			if ( length < oldTextLength ) {
+				// textEditor.scrollHeight is not adjusted until the next line.
+				textEditor.style.height = 'auto';
+
+				if ( textEditor.scrollHeight > autoresizeMinHeight ) {
+					textEditor.style.height = textEditor.scrollHeight + 'px';
+				} else {
+					textEditor.style.height = autoresizeMinHeight + 'px';
+				}
+
+				// Prevent scroll-jumping in Firefox and IE.
+				window.scrollTop = top;
+
+				if ( textEditor.scrollHeight < height ) {
+					adjust();
+				}
+			} else if ( height < textEditor.scrollHeight ) {
+				textEditor.style.height = textEditor.scrollHeight + 'px';
+				adjust();
+			}
+
+			oldTextLength = length;
+		}
+
 		// We need to wait for TinyMCE to initialize.
 		$document.on( 'tinymce-editor-init.editor-expand', function( event, editor ) {
 			var VK = window.tinymce.util.VK,
--- a/wp-admin/js/editor-expand.min.js
+++ b/wp-admin/js/editor-expand.min.js
--- a/wp-admin/update-core.php
+++ b/wp-admin/update-core.php
@@ -253,8 +253,6 @@ function list_plugin_updates() {
 	<tbody class="plugins">
 <?php
 	foreach ( (array) $plugins as $plugin_file => $plugin_data ) {
-		$plugin_data = (object) _get_plugin_data_markup_translate( $plugin_file, (array) $plugin_data, false, true );
-
 		// Get plugin compat for running version of WordPress.
 		if ( isset($plugin_data->update->tested) && version_compare($plugin_data->update->tested, $cur_wp_version, '>=') ) {
 			$compat = '<br />' . sprintf(__('Compatibility with WordPress %1$s: 100%% (according to its author)'), $cur_wp_version);
--- a/wp-admin/widgets.php
+++ b/wp-admin/widgets.php
@@ -22,8 +22,6 @@ if ( ! current_user_can( 'edit_theme_options' ) ) {

 $widgets_access = get_user_setting( 'widgets_access' );
 if ( isset($_GET['widgets-access']) ) {
-	check_admin_referer( 'widgets-access' );
-
 	$widgets_access = 'on' == $_GET['widgets-access'] ? 'on' : 'off';
 	set_user_setting( 'widgets_access', $widgets_access );
 }
--- a/wp-includes/Requests/IRI.php
+++ b/wp-includes/Requests/IRI.php
@@ -688,7 +688,10 @@ class Requests_IRI {
 		$isauthority = $this->iuserinfo !== null || $this->ihost !== null || $this->port !== null;
 		if ($this->ipath !== '' &&
 			(
-				$isauthority && $this->ipath[0] !== '/' ||
+				$isauthority && (
+					$this->ipath[0] !== '/' ||
+					substr($this->ipath, 0, 2) === '//'
+				) ||
 				(
 					$this->scheme === null &&
 					!$isauthority &&
--- a/wp-includes/Requests/Transport/cURL.php
+++ b/wp-includes/Requests/Transport/cURL.php
@@ -347,7 +347,7 @@ class Requests_Transport_cURL implements Requests_Transport {
 			default:
 				curl_setopt($this->handle, CURLOPT_CUSTOMREQUEST, $options['type']);
 				if (!empty($data)) {
-					curl_setopt($this->handle, CURLOPT_POSTFIELDS, $data);
+					curl_setopt( $this->handle, CURLOPT_POSTFIELDS, $data );
 				}
 		}

@@ -375,9 +375,8 @@ class Requests_Transport_cURL implements Requests_Transport {
 		curl_setopt($this->handle, CURLOPT_URL, $url);
 		curl_setopt($this->handle, CURLOPT_REFERER, $url);
 		curl_setopt($this->handle, CURLOPT_USERAGENT, $options['useragent']);
-		if (!empty($headers)) {
-			curl_setopt($this->handle, CURLOPT_HTTPHEADER, $headers);
-		}
+		curl_setopt($this->handle, CURLOPT_HTTPHEADER, $headers);
+
 		if ($options['protocol_version'] === 1.1) {
 			curl_setopt($this->handle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
 		}
@@ -459,7 +458,7 @@ class Requests_Transport_cURL implements Requests_Transport {
 	 * @param string $data Body data
 	 * @return integer Length of provided data
 	 */
-	public function stream_body($handle, $data) {
+	protected function stream_body($handle, $data) {
 		$this->hooks->dispatch('request.progress', array($data, $this->response_bytes, $this->response_byte_limit));
 		$data_length = strlen($data);

@@ -525,7 +524,7 @@ class Requests_Transport_cURL implements Requests_Transport {
 	 * @return boolean True if the transport is valid, false otherwise.
 	 */
 	public static function test($capabilities = array()) {
-		if (!function_exists('curl_init') || !function_exists('curl_exec')) {
+		if (!function_exists('curl_init') && !function_exists('curl_exec')) {
 			return false;
 		}

--- a/wp-includes/Requests/Transport/fsockopen.php
+++ b/wp-includes/Requests/Transport/fsockopen.php
@@ -70,9 +70,7 @@ class Requests_Transport_fsockopen implements Requests_Transport {
 		// HTTPS support
 		if (isset($url_parts['scheme']) && strtolower($url_parts['scheme']) === 'https') {
 			$remote_socket = 'ssl://' . $host;
-			if (!isset($url_parts['port'])) {
-				$url_parts['port'] = 443;
-			}
+			$url_parts['port'] = 443;

 			$context_options = array(
 				'verify_peer' => true,
@@ -99,7 +97,6 @@ class Requests_Transport_fsockopen implements Requests_Transport {
 			}

 			if (isset($options['verifyname']) && $options['verifyname'] === false) {
-				$context_options['verify_peer_name'] = false;
 				$verifyname = false;
 			}

@@ -174,7 +171,7 @@ class Requests_Transport_fsockopen implements Requests_Transport {
 		if (!isset($case_insensitive_headers['Host'])) {
 			$out .= sprintf('Host: %s', $url_parts['host']);

-			if (( 'http' === strtolower($url_parts['scheme']) && $url_parts['port'] !== 80 ) || ( 'https' === strtolower($url_parts['scheme']) && $url_parts['port'] !== 443 )) {
+			if ($url_parts['port'] !== 80) {
 				$out .= ':' . $url_parts['port'];
 			}
 			$out .= "\r\n";
--- a/wp-includes/class-http.php
+++ b/wp-includes/class-http.php
@@ -332,7 +332,6 @@ class WP_Http {
 		// SSL certificate handling
 		if ( ! $r['sslverify'] ) {
 			$options['verify'] = false;
-			$options['verifyname'] = false;
 		} else {
 			$options['verify'] = $r['sslcertificates'];
 		}
@@ -363,9 +362,6 @@ class WP_Http {
 			}
 		}

-		// Avoid issues where mbstring.func_overload is enabled
-		mbstring_binary_safe_encoding();
-
 		try {
 			$requests_response = Requests::request( $url, $headers, $data, $type, $options );

@@ -380,8 +376,6 @@ class WP_Http {
 			$response = new WP_Error( 'http_request_failed', $e->getMessage() );
 		}

-		reset_mbstring_encoding();
-
 		/**
 		 * Fires after an HTTP API response is received and before the response is returned.
 		 *
@@ -439,7 +433,7 @@ class WP_Http {
 		foreach ( $cookies as $name => $value ) {
 			if ( $value instanceof WP_Http_Cookie ) {
 				$cookie_jar[ $value->name ] = new Requests_Cookie( $value->name, $value->value, $value->get_attributes() );
-			} elseif ( is_scalar( $value ) ) {
+			} elseif ( is_string( $value ) ) {
 				$cookie_jar[ $name ] = new Requests_Cookie( $name, $value );
 			}
 		}
--- a/wp-includes/class-phpmailer.php
+++ b/wp-includes/class-phpmailer.php
@@ -31,7 +31,7 @@ class PHPMailer
     * The PHPMailer Version number.
     * @var string
     */
-    public $Version = '5.2.22';
+    public $Version = '5.2.14';

    /**
     * Email priority.
@@ -201,9 +201,6 @@ class PHPMailer
    /**
     * An ID to be used in the Message-ID header.
     * If empty, a unique id will be generated.
-     * You can set your own, but it must be in the format "<id@domain>",
-     * as defined in RFC5322 section 3.6.4 or it will be ignored.
-     * @see https://tools.ietf.org/html/rfc5322#section-3.6.4
     * @var string
     */
    public $MessageID = '';
@@ -288,7 +285,7 @@ class PHPMailer

    /**
     * SMTP auth type.
-     * Options are CRAM-MD5, LOGIN, PLAIN, attempted in that order if not specified
+     * Options are LOGIN (default), PLAIN, NTLM, CRAM-MD5
     * @var string
     */
    public $AuthType = '';
@@ -355,7 +352,6 @@ class PHPMailer
    /**
     * Whether to split multiple to addresses into multiple messages
     * or send them all in one message.
-     * Only supported in `mail` and `sendmail` transports, not in SMTP.
     * @var boolean
     */
    public $SingleTo = false;
@@ -398,7 +394,7 @@ class PHPMailer

    /**
     * DKIM Identity.
-     * Usually the email address used as the source of the email.
+     * Usually the email address used as the source of the email
     * @var string
     */
    public $DKIM_identity = '';
@@ -423,13 +419,6 @@ class PHPMailer
     */
    public $DKIM_private = '';

-    /**
-     * DKIM private key string.
-     * If set, takes precedence over `$DKIM_private`.
-     * @var string
-     */
-    public $DKIM_private_string = '';
-
    /**
     * Callback Action function name.
     *
@@ -457,15 +446,6 @@ class PHPMailer
     */
    public $XMailer = '';

-    /**
-     * Which validator to use by default when validating email addresses.
-     * May be a callable to inject your own validator, but there are several built-in validators.
-     * @see PHPMailer::validateAddress()
-     * @var string|callable
-     * @static
-     */
-    public static $validator = 'auto';
-
    /**
     * An instance of the SMTP sender class.
     * @var SMTP
@@ -654,11 +634,9 @@ class PHPMailer
     * Constructor.
     * @param boolean $exceptions Should we throw external exceptions?
     */
-    public function __construct($exceptions = null)
+    public function __construct($exceptions = false)
    {
-        if ($exceptions !== null) {
-            $this->exceptions = (boolean)$exceptions;
-        }
+        $this->exceptions = (boolean)$exceptions;
    }

    /**
@@ -667,7 +645,9 @@ class PHPMailer
    public function __destruct()
    {
        //Close any open SMTP connection nicely
-        $this->smtpClose();
+        if ($this->Mailer == 'smtp') {
+            $this->smtpClose();
+        }
    }

    /**
@@ -691,16 +671,14 @@ class PHPMailer
        } else {
            $subject = $this->encodeHeader($this->secureHeader($subject));
        }
-
-        //Can't use additional_parameters in safe_mode, calling mail() with null params breaks
-        //@link http://php.net/manual/en/function.mail.php
-        if (ini_get('safe_mode') or !$this->UseSendmailOptions or is_null($params)) {
+        if (ini_get('safe_mode') || !($this->UseSendmailOptions)) {
            $result = @mail($to, $subject, $body, $header);
        } else {
            $result = @mail($to, $subject, $body, $header, $params);
        }
        return $result;
    }
+
    /**
     * Output debugging info via user-defined method.
     * Only generates output if SMTP debug output is enabled (@see SMTP::$do_debug).
@@ -735,7 +713,7 @@ class PHPMailer
            case 'echo':
            default:
                //Normalize line breaks
-                $str = preg_replace('/\r\n?/ms', "\n", $str);
+                $str = preg_replace('/(\r\n|\r|\n)/ms', "\n", $str);
                echo gmdate('Y-m-d H:i:s') . "\t" . str_replace(
                    "\n",
                    "\n                   \t                  ",
@@ -872,7 +850,7 @@ class PHPMailer
        $name = trim(preg_replace('/[\r\n]+/', '', $name)); //Strip breaks and trim
        if (($pos = strrpos($address, '@')) === false) {
            // At-sign is misssing.
-            $error_message = $this->lang('invalid_address') . " (addAnAddress $kind): $address";
+            $error_message = $this->lang('invalid_address') . $address;
            $this->setError($error_message);
            $this->edebug($error_message);
            if ($this->exceptions) {
@@ -922,7 +900,7 @@ class PHPMailer
            return false;
        }
        if (!$this->validateAddress($address)) {
-            $error_message = $this->lang('invalid_address') . " (addAnAddress $kind): $address";
+            $error_message = $this->lang('invalid_address') . $address;
            $this->setError($error_message);
            $this->edebug($error_message);
            if ($this->exceptions) {
@@ -945,61 +923,6 @@ class PHPMailer
        return false;
    }

-    /**
-     * Parse and validate a string containing one or more RFC822-style comma-separated email addresses
-     * of the form "display name <address>" into an array of name/address pairs.
-     * Uses the imap_rfc822_parse_adrlist function if the IMAP extension is available.
-     * Note that quotes in the name part are removed.
-     * @param string $addrstr The address list string
-     * @param bool $useimap Whether to use the IMAP extension to parse the list
-     * @return array
-     * @link http://www.andrew.cmu.edu/user/agreen1/testing/mrbs/web/Mail/RFC822.php A more careful implementation
-     */
-    public function parseAddresses($addrstr, $useimap = true)
-    {
-        $addresses = array();
-        if ($useimap and function_exists('imap_rfc822_parse_adrlist')) {
-            //Use this built-in parser if it's available
-            $list = imap_rfc822_parse_adrlist($addrstr, '');
-            foreach ($list as $address) {
-                if ($address->host != '.SYNTAX-ERROR.') {
-                    if ($this->validateAddress($address->mailbox . '@' . $address->host)) {
-                        $addresses[] = array(
-                            'name' => (property_exists($address, 'personal') ? $address->personal : ''),
-                            'address' => $address->mailbox . '@' . $address->host
-                        );
-                    }
-                }
-            }
-        } else {
-            //Use this simpler parser
-            $list = explode(',', $addrstr);
-            foreach ($list as $address) {
-                $address = trim($address);
-                //Is there a separate name part?
-                if (strpos($address, '<') === false) {
-                    //No separate name, just use the whole thing
-                    if ($this->validateAddress($address)) {
-                        $addresses[] = array(
-                            'name' => '',
-                            'address' => $address
-                        );
-                    }
-                } else {
-                    list($name, $email) = explode('<', $address);
-                    $email = trim(str_replace('>', '', $email));
-                    if ($this->validateAddress($email)) {
-                        $addresses[] = array(
-                            'name' => trim(str_replace(array('"', "'"), '', $name)),
-                            'address' => $email
-                        );
-                    }
-                }
-            }
-        }
-        return $addresses;
-    }
-
    /**
     * Set the From and FromName properties.
     * @param string $address
@@ -1016,7 +939,7 @@ class PHPMailer
        if (($pos = strrpos($address, '@')) === false or
            (!$this->has8bitChars(substr($address, ++$pos)) or !$this->idnSupported()) and
            !$this->validateAddress($address)) {
-            $error_message = $this->lang('invalid_address') . " (setFrom) $address";
+            $error_message = $this->lang('invalid_address') . $address;
            $this->setError($error_message);
            $this->edebug($error_message);
            if ($this->exceptions) {
@@ -1049,30 +972,19 @@ class PHPMailer
    /**
     * Check that a string looks like an email address.
     * @param string $address The email address to check
-     * @param string|callable $patternselect A selector for the validation pattern to use :
+     * @param string $patternselect A selector for the validation pattern to use :
     * * `auto` Pick best pattern automatically;
     * * `pcre8` Use the squiloople.com pattern, requires PCRE > 8.0, PHP >= 5.3.2, 5.2.14;
     * * `pcre` Use old PCRE implementation;
     * * `php` Use PHP built-in FILTER_VALIDATE_EMAIL;
     * * `html5` Use the pattern given by the HTML5 spec for 'email' type form input elements.
     * * `noregex` Don't use a regex: super fast, really dumb.
-     * Alternatively you may pass in a callable to inject your own validator, for example:
-     * PHPMailer::validateAddress('user@example.com', function($address) {
-     *     return (strpos($address, '@') !== false);
-     * });
-     * You can also set the PHPMailer::$validator static to a callable, allowing built-in methods to use your validator.
     * @return boolean
     * @static
     * @access public
     */
-    public static function validateAddress($address, $patternselect = null)
+    public static function validateAddress($address, $patternselect = 'auto')
    {
-        if (is_null($patternselect)) {
-            $patternselect = self::$validator;
-        }
-        if (is_callable($patternselect)) {
-            return call_user_func($patternselect, $address);
-        }
        //Reject line breaks in addresses; it's valid RFC5322, but not RFC5321
        if (strpos($address, "\n") !== false or strpos($address, "\r") !== false) {
            return false;
@@ -1249,7 +1161,7 @@ class PHPMailer
                }
                $this->$address_kind = $this->punyencodeAddress($this->$address_kind);
                if (!$this->validateAddress($this->$address_kind)) {
-                    $error_message = $this->lang('invalid_address') . ' (punyEncode) ' . $this->$address_kind;
+                    $error_message = $this->lang('invalid_address') . $this->$address_kind;
                    $this->setError($error_message);
                    $this->edebug($error_message);
                    if ($this->exceptions) {
@@ -1260,7 +1172,7 @@ class PHPMailer
            }

            // Set whether the message is multipart/alternative
-            if ($this->alternativeExists()) {
+            if (!empty($this->AltBody)) {
                $this->ContentType = 'multipart/alternative';
            }

@@ -1294,11 +1206,9 @@ class PHPMailer

            // Sign with DKIM if enabled
            if (!empty($this->DKIM_domain)
+                && !empty($this->DKIM_private)
                && !empty($this->DKIM_selector)
-                && (!empty($this->DKIM_private_string)
-                   || (!empty($this->DKIM_private) && file_exists($this->DKIM_private))
-                )
-            ) {
+                && file_exists($this->DKIM_private)) {
                $header_dkim = $this->DKIM_Add(
                    $this->MIMEHeader . $this->mailHeader,
                    $this->encodeHeader($this->secureHeader($this->Subject)),
@@ -1364,24 +1274,19 @@ class PHPMailer
     */
    protected function sendmailSend($header, $body)
    {
-        // CVE-2016-10033, CVE-2016-10045: Don't pass -f if characters will be escaped.
-        if (!empty($this->Sender) and self::isShellSafe($this->Sender)) {
+        if ($this->Sender != '') {
            if ($this->Mailer == 'qmail') {
-                $sendmailFmt = '%s -f%s';
+                $sendmail = sprintf('%s -f%s', escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender));
            } else {
-                $sendmailFmt = '%s -oi -f%s -t';
+                $sendmail = sprintf('%s -oi -f%s -t', escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender));
            }
        } else {
            if ($this->Mailer == 'qmail') {
-                $sendmailFmt = '%s';
+                $sendmail = sprintf('%s', escapeshellcmd($this->Sendmail));
            } else {
-                $sendmailFmt = '%s -oi -t';
+                $sendmail = sprintf('%s -oi -t', escapeshellcmd($this->Sendmail));
            }
        }
-
-        // TODO: If possible, this should be changed to escapeshellarg.  Needs thorough testing.
-        $sendmail = sprintf($sendmailFmt, escapeshellcmd($this->Sendmail), $this->Sender);
-
        if ($this->SingleTo) {
            foreach ($this->SingleToArray as $toAddr) {
                if (!@$mail = popen($sendmail, 'w')) {
@@ -1427,40 +1332,6 @@ class PHPMailer
        return true;
    }

-    /**
-     * Fix CVE-2016-10033 and CVE-2016-10045 by disallowing potentially unsafe shell characters.
-     *
-     * Note that escapeshellarg and escapeshellcmd are inadequate for our purposes, especially on Windows.
-     * @param string $string The string to be validated
-     * @see https://github.com/PHPMailer/PHPMailer/issues/924 CVE-2016-10045 bug report
-     * @access protected
-     * @return boolean
-     */
-    protected static function isShellSafe($string)
-    {
-        // Future-proof
-        if (escapeshellcmd($string) !== $string
-            or !in_array(escapeshellarg($string), array("'$string'", "\"$string\""))
-        ) {
-            return false;
-        }
-
-        $length = strlen($string);
-
-        for ($i = 0; $i < $length; $i++) {
-            $c = $string[$i];
-
-            // All other characters have a special meaning in at least one common shell, including = and +.
-            // Full stop (.) has a special meaning in cmd.exe, but its impact should be negligible here.
-            // Note that this does permit non-Latin alphanumeric characters based on the current locale.
-            if (!ctype_alnum($c) && strpos('@_-.', $c) === false) {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
    /**
     * Send mail using the PHP mail() function.
     * @param string $header The message headers
@@ -1478,20 +1349,17 @@ class PHPMailer
        }
        $to = implode(', ', $toArr);

-        $params = null;
-        //This sets the SMTP envelope sender which gets turned into a return-path header by the receiver
-        if (!empty($this->Sender) and $this->validateAddress($this->Sender)) {
-            // CVE-2016-10033, CVE-2016-10045: Don't pass -f if characters will be escaped.
-            if (self::isShellSafe($this->Sender)) {
-                $params = sprintf('-f%s', $this->Sender);
-            }
+        if (empty($this->Sender)) {
+            $params = ' ';
+        } else {
+            $params = sprintf('-f%s', $this->Sender);
        }
-        if (!empty($this->Sender) and !ini_get('safe_mode') and $this->validateAddress($this->Sender)) {
+        if ($this->Sender != '' and !ini_get('safe_mode')) {
            $old_from = ini_get('sendmail_from');
            ini_set('sendmail_from', $this->Sender);
        }
        $result = false;
-        if ($this->SingleTo and count($toArr) > 1) {
+        if ($this->SingleTo && count($toArr) > 1) {
            foreach ($toArr as $toAddr) {
                $result = $this->mailPassthru($toAddr, $this->Subject, $body, $header, $params);
                $this->doCallback($result, array($toAddr), $this->cc, $this->bcc, $this->Subject, $body, $this->From);
@@ -1541,10 +1409,10 @@ class PHPMailer
        if (!$this->smtpConnect($this->SMTPOptions)) {
            throw new phpmailerException($this->lang('smtp_connect_failed'), self::STOP_CRITICAL);
        }
-        if (!empty($this->Sender) and $this->validateAddress($this->Sender)) {
-            $smtp_from = $this->Sender;
-        } else {
+        if ('' == $this->Sender) {
            $smtp_from = $this->From;
+        } else {
+            $smtp_from = $this->Sender;
        }
        if (!$this->smtp->mail($smtp_from)) {
            $this->setError($this->lang('from_failed') . $smtp_from . ' : ' . implode(',', $this->smtp->getError()));
@@ -1598,17 +1466,12 @@ class PHPMailer
     * @throws phpmailerException
     * @return boolean
     */
-    public function smtpConnect($options = null)
+    public function smtpConnect($options = array())
    {
        if (is_null($this->smtp)) {
            $this->smtp = $this->getSMTPInstance();
        }

-        //If no options are provided, use whatever is set in the instance
-        if (is_null($options)) {
-            $options = $this->SMTPOptions;
-        }
-
        // Already connected?
        if ($this->smtp->connected()) {
            return true;
@@ -1678,7 +1541,7 @@ class PHPMailer
                        if (!$this->smtp->startTLS()) {
                            throw new phpmailerException($this->lang('connect_host'));
                        }
-                        // We must resend EHLO after TLS negotiation
+                        // We must resend HELO after tls negotiation
                        $this->smtp->hello($hello);
                    }
                    if ($this->SMTPAuth) {
@@ -1717,7 +1580,7 @@ class PHPMailer
     */
    public function smtpClose()
    {
-        if (is_a($this->smtp, 'SMTP')) {
+        if ($this->smtp !== null) {
            if ($this->smtp->connected()) {
                $this->smtp->quit();
                $this->smtp->close();
@@ -1736,19 +1599,6 @@ class PHPMailer
     */
    public function setLanguage($langcode = 'en', $lang_path = '')
    {
-        // Backwards compatibility for renamed language codes
-        $renamed_langcodes = array(
-            'br' => 'pt_br',
-            'cz' => 'cs',
-            'dk' => 'da',
-            'no' => 'nb',
-            'se' => 'sv',
-        );
-
-        if (isset($renamed_langcodes[$langcode])) {
-            $langcode = $renamed_langcodes[$langcode];
-        }
-
        // Define full set of translatable strings in English
        $PHPMAILER_LANG = array(
            'authenticate' => 'SMTP Error: Could not authenticate.',
@@ -1775,10 +1625,6 @@ class PHPMailer
            // Calculate an absolute path so it can work if CWD is not here
            $lang_path = dirname(__FILE__). DIRECTORY_SEPARATOR . 'language'. DIRECTORY_SEPARATOR;
        }
-        //Validate $langcode
-        if (!preg_match('/^[a-z]{2}(?:_[a-zA-Z]{2})?$/', $langcode)) {
-            $langcode = 'en';
-        }
        $foundlang = true;
        $lang_file = $lang_path . 'phpmailer.lang-' . $langcode . '.php';
        // There is no English translation file
@@ -2072,9 +1918,7 @@ class PHPMailer
            $result .= $this->headerLine('Subject', $this->encodeHeader($this->secureHeader($this->Subject)));
        }

-        // Only allow a custom message ID if it conforms to RFC 5322 section 3.6.4
-        // https://tools.ietf.org/html/rfc5322#section-3.6.4
-        if ('' != $this->MessageID and preg_match('/^<.*@.*>$/', $this->MessageID)) {
+        if ($this->MessageID != '') {
            $this->lastMessageID = $this->MessageID;
        } else {
            $this->lastMessageID = sprintf('<%s@%s>', $this->uniqueid, $this->serverHostname());
@@ -2176,15 +2020,7 @@ class PHPMailer
     */
    public function getSentMIMEMessage()
    {
-        return rtrim($this->MIMEHeader . $this->mailHeader, "\n\r") . self::CRLF . self::CRLF . $this->MIMEBody;
-    }
-
-    /**
-     * Create unique ID
-     * @return string
-     */
-    protected function generateId() {
-        return md5(uniqid(time()));
+        return $this->MIMEHeader . $this->mailHeader . self::CRLF . $this->MIMEBody;
    }

    /**
@@ -2198,7 +2034,7 @@ class PHPMailer
    {
        $body = '';
        //Create unique IDs and preset boundaries
-        $this->uniqueid = $this->generateId();
+        $this->uniqueid = md5(uniqid(time()));
        $this->boundary[1] = 'b1_' . $this->uniqueid;
        $this->boundary[2] = 'b2_' . $this->uniqueid;
        $this->boundary[3] = 'b3_' . $this->uniqueid;
@@ -2214,12 +2050,11 @@ class PHPMailer
        //Can we do a 7-bit downgrade?
        if ($bodyEncoding == '8bit' and !$this->has8bitChars($this->Body)) {
            $bodyEncoding = '7bit';
-            //All ISO 8859, Windows codepage and UTF-8 charsets are ascii compatible up to 7-bit
            $bodyCharSet = 'us-ascii';
        }
-        //If lines are too long, and we're not already using an encoding that will shorten them,
-        //change to quoted-printable transfer encoding for the body part only
-        if ('base64' != $this->Encoding and self::hasLineLongerThanMax($this->Body)) {
+        //If lines are too long, change to quoted-printable transfer encoding
+        if (self::hasLineLongerThanMax($this->Body)) {
+            $this->Encoding = 'quoted-printable';
            $bodyEncoding = 'quoted-printable';
        }

@@ -2228,12 +2063,10 @@ class PHPMailer
        //Can we do a 7-bit downgrade?
        if ($altBodyEncoding == '8bit' and !$this->has8bitChars($this->AltBody)) {
            $altBodyEncoding = '7bit';
-            //All ISO 8859, Windows codepage and UTF-8 charsets are ascii compatible up to 7-bit
            $altBodyCharSet = 'us-ascii';
        }
-        //If lines are too long, and we're not already using an encoding that will shorten them,
-        //change to quoted-printable transfer encoding for the alt body part only
-        if ('base64' != $altBodyEncoding and self::hasLineLongerThanMax($this->AltBody)) {
+        //If lines are too long, change to quoted-printable transfer encoding
+        if (self::hasLineLongerThanMax($this->AltBody)) {
            $altBodyEncoding = 'quoted-printable';
        }
        //Use this as a preamble in all multipart message types
@@ -2336,10 +2169,8 @@ class PHPMailer
                $body .= $this->attachAll('attachment', $this->boundary[1]);
                break;
            default:
-                // Catch case 'plain' and case '', applies to simple `text/plain` and `text/html` body content types
-                //Reset the `Encoding` property in case we changed it for line length reasons
-                $this->Encoding = $bodyEncoding;
-                $body .= $this->encodeString($this->Body, $this->Encoding);
+                // catch case 'plain' and case ''
+                $body .= $this->encodeString($this->Body, $bodyEncoding);
                break;
        }

@@ -2445,7 +2276,8 @@ class PHPMailer

    /**
     * Set the message type.
-     * PHPMailer only supports some preset message types, not arbitrary MIME structures.
+     * PHPMailer only supports some preset message types,
+     * not arbitrary MIME structures.
     * @access protected
     * @return void
     */
@@ -2463,7 +2295,6 @@ class PHPMailer
        }
        $this->message_type = implode('_', $type);
        if ($this->message_type == '') {
-            //The 'plain' message_type refers to the message having a single body element, not that it is plain-text
            $this->message_type = 'plain';
        }
    }
@@ -2493,7 +2324,6 @@ class PHPMailer

    /**
     * Add an attachment from a path on the filesystem.
-     * Never use a user-supplied path to a file!
     * Returns false if the file could not be found or read.
     * @param string $path Path to the attachment.
     * @param string $name Overrides the attachment name.
@@ -3019,7 +2849,6 @@ class PHPMailer
     * displayed inline with the message, not just attached for download.
     * This is used in HTML messages that embed the images
     * the HTML refers to using the $cid value.
-     * Never use a user-supplied path to a file!
     * @param string $path Path to the attachment.
     * @param string $cid Content ID of the attachment; Use this to reference
     *        the content when using an embedded image in HTML.
@@ -3380,29 +3209,21 @@ class PHPMailer
    }

    /**
-     * Create a message body from an HTML string.
-     * Automatically inlines images and creates a plain-text version by converting the HTML,
-     * overwriting any existing values in Body and AltBody.
-     * Do not source $message content from user input!
-     * $basedir is prepended when handling relative URLs, e.g. <img src="/images/a.png"> and must not be empty
-     * will look for an image file in $basedir/images/a.png and convert it to inline.
-     * If you don't provide a $basedir, relative paths will be left untouched (and thus probably break in email)
-     * If you don't want to apply these transformations to your HTML, just set Body and AltBody directly.
+     * Create a message from an HTML string.
+     * Automatically makes modifications for inline images and backgrounds
+     * and creates a plain-text version by converting the HTML.
+     * Overwrites any existing values in $this->Body and $this->AltBody
     * @access public
     * @param string $message HTML message string
-     * @param string $basedir Absolute path to a base directory to prepend to relative paths to images
+     * @param string $basedir baseline directory for path
     * @param boolean|callable $advanced Whether to use the internal HTML to text converter
     *    or your own custom converter @see PHPMailer::html2text()
-     * @return string $message The transformed message Body
+     * @return string $message
     */
    public function msgHTML($message, $basedir = '', $advanced = false)
    {
        preg_match_all('/(src|background)=["\'](.*)["\']/Ui', $message, $images);
        if (array_key_exists(2, $images)) {
-            if (strlen($basedir) > 1 && substr($basedir, -1) != '/') {
-                // Ensure $basedir has a trailing /
-                $basedir .= '/';
-            }
            foreach ($images[2] as $imgindex => $url) {
                // Convert data URIs into embedded images
                if (preg_match('#^data:(image[^;,]*)(;base64)?,#', $url, $match)) {
@@ -3420,24 +3241,18 @@ class PHPMailer
                            $message
                        );
                    }
-                    continue;
-                }
-                if (
-                    // Only process relative URLs if a basedir is provided (i.e. no absolute local paths)
-                    !empty($basedir)
-                    // Ignore URLs containing parent dir traversal (..)
-                    && (strpos($url, '..') === false)
+                } elseif (substr($url, 0, 4) !== 'cid:' && !preg_match('#^[A-z]+://#', $url)) {
+                    // Do not change urls for absolute images (thanks to corvuscorax)
                    // Do not change urls that are already inline images
-                    && substr($url, 0, 4) !== 'cid:'
-                    // Do not change absolute URLs, including anonymous protocol
-                    && !preg_match('#^[a-z][a-z0-9+.-]*:?//#i', $url)
-                ) {
                    $filename = basename($url);
                    $directory = dirname($url);
                    if ($directory == '.') {
                        $directory = '';
                    }
                    $cid = md5($url) . '@phpmailer.0'; // RFC2392 S 2
+                    if (strlen($basedir) > 1 && substr($basedir, -1) != '/') {
+                        $basedir .= '/';
+                    }
                    if (strlen($directory) > 1 && substr($directory, -1) != '/') {
                        $directory .= '/';
                    }
@@ -3462,7 +3277,7 @@ class PHPMailer
        // Convert all message body line breaks to CRLF, makes quoted-printable encoding work much better
        $this->Body = $this->normalizeBreaks($message);
        $this->AltBody = $this->normalizeBreaks($this->html2text($message, $advanced));
-        if (!$this->alternativeExists()) {
+        if (empty($this->AltBody)) {
            $this->AltBody = 'To view this email message, open it in a program that understands HTML!' .
                self::CRLF . self::CRLF;
        }
@@ -3473,7 +3288,7 @@ class PHPMailer
     * Convert an HTML string into plain text.
     * This is used by msgHTML().
     * Note - older versions of this function used a bundled advanced converter
-     * which was been removed for license reasons in #232.
+     * which was been removed for license reasons in #232
     * Example usage:
     * <code>
     * // Use default conversion
@@ -3773,7 +3588,7 @@ class PHPMailer
     * @access public
     * @param string $signHeader
     * @throws phpmailerException
-     * @return string The DKIM signature value
+     * @return string
     */
    public function DKIM_Sign($signHeader)
    {
@@ -3783,35 +3598,15 @@ class PHPMailer
            }
            return '';
        }
-        $privKeyStr = !empty($this->DKIM_private_string) ? $this->DKIM_private_string : file_get_contents($this->DKIM_private);
-        if ('' != $this->DKIM_passphrase) {
+        $privKeyStr = file_get_contents($this->DKIM_private);
+        if ($this->DKIM_passphrase != '') {
            $privKey = openssl_pkey_get_private($privKeyStr, $this->DKIM_passphrase);
        } else {
-            $privKey = openssl_pkey_get_private($privKeyStr);
+            $privKey = $privKeyStr;
        }
-        //Workaround for missing digest algorithms in old PHP & OpenSSL versions
-        //@link http://stackoverflow.com/a/11117338/333340
-        if (version_compare(PHP_VERSION, '5.3.0') >= 0 and
-            in_array('sha256WithRSAEncryption', openssl_get_md_methods(true))) {
-            if (openssl_sign($signHeader, $signature, $privKey, 'sha256WithRSAEncryption')) {
-                openssl_pkey_free($privKey);
-                return base64_encode($signature);
-            }
-        } else {
-            $pinfo = openssl_pkey_get_details($privKey);
-            $hash = hash('sha256', $signHeader);
-            //'Magic' constant for SHA256 from RFC3447
-            //@link https://tools.ietf.org/html/rfc3447#page-43
-            $t = '3031300d060960864801650304020105000420' . $hash;
-            $pslen = $pinfo['bits'] / 8 - (strlen($t) / 2 + 3);
-            $eb = pack('H*', '0001' . str_repeat('FF', $pslen) . '00' . $t);
-
-            if (openssl_private_encrypt($eb, $signature, $privKey, OPENSSL_NO_PADDING)) {
-                openssl_pkey_free($privKey);
-                return base64_encode($signature);
-            }
+        if (openssl_sign($signHeader, $signature, $privKey)) {
+            return base64_encode($signature);
        }
-        openssl_pkey_free($privKey);
        return '';
    }

@@ -3828,7 +3623,7 @@ class PHPMailer
        foreach ($lines as $key => $line) {
            list($heading, $value) = explode(':', $line, 2);
            $heading = strtolower($heading);
-            $value = preg_replace('/\s{2,}/', ' ', $value); // Compress useless spaces
+            $value = preg_replace('/\s+/', ' ', $value); // Compress useless spaces
            $lines[$key] = $heading . ':' . trim($value); // Don't forget to remove WSP around the value
        }
        $signHeader = implode("\r\n", $lines);
@@ -3866,7 +3661,7 @@ class PHPMailer
     */
    public function DKIM_Add($headers_line, $subject, $body)
    {
-        $DKIMsignatureType = 'rsa-sha256'; // Signature & hash algorithms
+        $DKIMsignatureType = 'rsa-sha1'; // Signature & hash algorithms
        $DKIMcanonicalization = 'relaxed/simple'; // Canonicalization of header/body
        $DKIMquery = 'dns/txt'; // Query method
        $DKIMtime = time(); // Signature Timestamp = seconds since 00:00:00 - Jan 1, 1970 (UTC time zone)
@@ -3874,7 +3669,6 @@ class PHPMailer
        $headers = explode($this->LE, $headers_line);
        $from_header = '';
        $to_header = '';
-        $date_header = '';
        $current = '';
        foreach ($headers as $header) {
            if (strpos($header, 'From:') === 0) {
@@ -3883,9 +3677,6 @@ class PHPMailer
            } elseif (strpos($header, 'To:') === 0) {
                $to_header = $header;
                $current = 'to_header';
-            } elseif (strpos($header, 'Date:') === 0) {
-                $date_header = $header;
-                $current = 'date_header';
            } else {
                if (!empty($$current) && strpos($header, ' =?') === 0) {
                    $$current .= $header;
@@ -3896,7 +3687,6 @@ class PHPMailer
        }
        $from = str_replace('|', '=7C', $this->DKIM_QP($from_header));
        $to = str_replace('|', '=7C', $this->DKIM_QP($to_header));
-        $date = str_replace('|', '=7C', $this->DKIM_QP($date_header));
        $subject = str_replace(
            '|',
            '=7C',
@@ -3904,7 +3694,7 @@ class PHPMailer
        ); // Copied header fields (dkim-quoted-printable)
        $body = $this->DKIM_BodyC($body);
        $DKIMlen = strlen($body); // Length of body
-        $DKIMb64 = base64_encode(pack('H*', hash('sha256', $body))); // Base64 of packed binary SHA-256 hash of body
+        $DKIMb64 = base64_encode(pack('H*', sha1($body))); // Base64 of packed binary SHA-1 hash of body
        if ('' == $this->DKIM_identity) {
            $ident = '';
        } else {
@@ -3917,18 +3707,16 @@ class PHPMailer
            $this->DKIM_selector .
            ";\r\n" .
            "\tt=" . $DKIMtime . '; c=' . $DKIMcanonicalization . ";\r\n" .
-            "\th=From:To:Date:Subject;\r\n" .
+            "\th=From:To:Subject;\r\n" .
            "\td=" . $this->DKIM_domain . ';' . $ident . "\r\n" .
            "\tz=$from\r\n" .
            "\t|$to\r\n" .
-            "\t|$date\r\n" .
            "\t|$subject;\r\n" .
            "\tbh=" . $DKIMb64 . ";\r\n" .
            "\tb=";
        $toSign = $this->DKIM_HeaderC(
            $from_header . "\r\n" .
            $to_header . "\r\n" .
-            $date_header . "\r\n" .
            $subject_header . "\r\n" .
            $dkimhdrs
        );
--- a/wp-includes/class-requests.php
+++ b/wp-includes/class-requests.php
@@ -749,17 +749,15 @@ class Requests {
 	 * @return string Decoded body
 	 */
 	protected static function decode_chunked($data) {
-		if (!preg_match('/^([0-9a-f]+)(?:;(?:[\w-]*)(?:=(?:(?:[\w-]*)*|"(?:[^\r\n])*"))?)*\r\n/i', trim($data))) {
+		if (!preg_match('/^([0-9a-f]+)[^\r\n]*\r\n/i', trim($data))) {
 			return $data;
 		}

-
-
 		$decoded = '';
 		$encoded = $data;

 		while (true) {
-			$is_chunked = (bool) preg_match('/^([0-9a-f]+)(?:;(?:[\w-]*)(?:=(?:(?:[\w-]*)*|"(?:[^\r\n])*"))?)*\r\n/i', $encoded, $matches);
+			$is_chunked = (bool) preg_match('/^([0-9a-f]+)[^\r\n]*\r\n/i', $encoded, $matches);
 			if (!$is_chunked) {
 				// Looks like it's not chunked after all
 				return $data;
--- a/wp-includes/class-smtp.php
+++ b/wp-includes/class-smtp.php
@@ -30,7 +30,7 @@ class SMTP
     * The PHPMailer SMTP version number.
     * @var string
     */
-    const VERSION = '5.2.22';
+    const VERSION = '5.2.14';

    /**
     * SMTP line break constant.
@@ -81,7 +81,7 @@ class SMTP
     * @deprecated Use the `VERSION` constant instead
     * @see SMTP::VERSION
     */
-    public $Version = '5.2.22';
+    public $Version = '5.2.14';

    /**
     * SMTP server port number.
@@ -150,17 +150,6 @@ class SMTP
     */
    public $Timelimit = 300;

-	/**
-	 * @var array patterns to extract smtp transaction id from smtp reply
-	 * Only first capture group will be use, use non-capturing group to deal with it
-	 * Extend this class to override this property to fulfil your needs.
-	 */
-	protected $smtp_transaction_id_patterns = array(
-		'exim' => '/[0-9]{3} OK id=(.*)/',
-		'sendmail' => '/[0-9]{3} 2.0.0 (.*) Message/',
-		'postfix' => '/[0-9]{3} 2.0.0 Ok: queued as (.*)/'
-	);
-
    /**
     * The socket for the server connection.
     * @var resource
@@ -217,7 +206,7 @@ class SMTP
        }
        //Avoid clash with built-in function names
        if (!in_array($this->Debugoutput, array('error_log', 'html', 'echo')) and is_callable($this->Debugoutput)) {
-            call_user_func($this->Debugoutput, $str, $level);
+            call_user_func($this->Debugoutput, $str, $this->do_debug);
            return;
        }
        switch ($this->Debugoutput) {
@@ -283,8 +272,8 @@ class SMTP
        $errstr = '';
        if ($streamok) {
            $socket_context = stream_context_create($options);
-            set_error_handler(array($this, 'errorHandler'));
-            $this->smtp_conn = stream_socket_client(
+            //Suppress errors; connection failures are handled at a higher level
+            $this->smtp_conn = @stream_socket_client(
                $host . ":" . $port,
                $errno,
                $errstr,
@@ -292,14 +281,12 @@ class SMTP
                STREAM_CLIENT_CONNECT,
                $socket_context
            );
-            restore_error_handler();
        } else {
            //Fall back to fsockopen which should work in more places, but is missing some features
            $this->edebug(
                "Connection: stream_socket_client not available, falling back to fsockopen",
                self::DEBUG_CONNECTION
            );
-            set_error_handler(array($this, 'errorHandler'));
            $this->smtp_conn = fsockopen(
                $host,
                $port,
@@ -307,7 +294,6 @@ class SMTP
                $errstr,
                $timeout
            );
-            restore_error_handler();
        }
        // Verify we connected properly
        if (!is_resource($this->smtp_conn)) {
@@ -350,22 +336,11 @@ class SMTP
        if (!$this->sendCommand('STARTTLS', 'STARTTLS', 220)) {
            return false;
        }
-
-        //Allow the best TLS version(s) we can
-        $crypto_method = STREAM_CRYPTO_METHOD_TLS_CLIENT;
-
-        //PHP 5.6.7 dropped inclusion of TLS 1.1 and 1.2 in STREAM_CRYPTO_METHOD_TLS_CLIENT
-        //so add them back in manually if we can
-        if (defined('STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT')) {
-            $crypto_method |= STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT;
-            $crypto_method |= STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT;
-        }
-
        // Begin encrypted connection
        if (!stream_socket_enable_crypto(
            $this->smtp_conn,
            true,
-            $crypto_method
+            STREAM_CRYPTO_METHOD_TLS_CLIENT
        )) {
            return false;
        }
@@ -378,7 +353,7 @@ class SMTP
     * @see hello()
     * @param string $username The user name
     * @param string $password The password
-     * @param string $authtype The auth type (PLAIN, LOGIN, CRAM-MD5)
+     * @param string $authtype The auth type (PLAIN, LOGIN, NTLM, CRAM-MD5, XOAUTH2)
     * @param string $realm The auth realm for NTLM
     * @param string $workstation The auth workstation for NTLM
     * @param null|OAuth $OAuth An optional OAuth instance (@see PHPMailerOAuth)
@@ -414,7 +389,7 @@ class SMTP
            );

            if (empty($authtype)) {
-                foreach (array('CRAM-MD5', 'LOGIN', 'PLAIN') as $method) {
+                foreach (array('LOGIN', 'CRAM-MD5', 'PLAIN') as $method) {
                    if (in_array($method, $this->server_caps['AUTH'])) {
                        $authtype = $method;
                        break;
@@ -698,7 +673,7 @@ class SMTP
    protected function parseHelloFields($type)
    {
        $this->server_caps = array();
-        $lines = explode("\n", $this->helo_rply);
+        $lines = explode("\n", $this->last_reply);

        foreach ($lines as $n => $s) {
            //First 4 chars contain response code followed by - or space
@@ -1140,47 +1115,4 @@ class SMTP
    {
        return $this->Timeout;
    }
-
-    /**
-     * Reports an error number and string.
-     * @param integer $errno The error number returned by PHP.
-     * @param string $errmsg The error message returned by PHP.
-     */
-    protected function errorHandler($errno, $errmsg)
-    {
-        $notice = 'Connection: Failed to connect to server.';
-        $this->setError(
-            $notice,
-            $errno,
-            $errmsg
-        );
-        $this->edebug(
-            $notice . ' Error number ' . $errno . '. "Error notice: ' . $errmsg,
-            self::DEBUG_CONNECTION
-        );
-    }
-
-	/**
-	 * Will return the ID of the last smtp transaction based on a list of patterns provided
-	 * in SMTP::$smtp_transaction_id_patterns.
-	 * If no reply has been received yet, it will return null.
-	 * If no pattern has been matched, it will return false.
-	 * @return bool|null|string
-	 */
-	public function getLastTransactionID()
-	{
-		$reply = $this->getLastReply();
-
-		if (empty($reply)) {
-			return null;
-		}
-
-		foreach($this->smtp_transaction_id_patterns as $smtp_transaction_id_pattern) {
-			if(preg_match($smtp_transaction_id_pattern, $reply, $matches)) {
-				return $matches[1];
-			}
-		}
-
-		return false;
-    }
 }
--- a/wp-includes/class-wp-editor.php
+++ b/wp-includes/class-wp-editor.php
@@ -1259,14 +1259,6 @@ final class _WP_Editors {
 			var init, id, $wrap;

 			if ( typeof tinymce !== 'undefined' ) {
-				// Fix RTL
-				tinymce.on( 'addeditor', function( event ) {
-					event.editor.rtl = event.editor.settings.rtl_ui ||
-						( event.editor.editorManager &&
-						event.editor.editorManager.i18n &&
-						event.editor.editorManager.i18n.rtl );
-				}, true );
-
 				for ( id in tinyMCEPreInit.mceInit ) {
 					init = tinyMCEPreInit.mceInit[id];
 					$wrap = tinymce.$( '#wp-' + id + '-wrap' );
--- a/wp-includes/class-wp-theme.php
+++ b/wp-includes/class-wp-theme.php
@@ -720,9 +720,8 @@ final class WP_Theme implements ArrayAccess {
 	private function markup_header( $header, $value, $translate ) {
 		switch ( $header ) {
 			case 'Name' :
-				if ( empty( $value ) ) {
-					$value = esc_html( $this->get_stylesheet() );
-				}
+				if ( empty( $value ) )
+					$value = $this->get_stylesheet();
 				break;
 			case 'Description' :
 				$value = wptexturize( $value );
--- a/wp-includes/css/editor-rtl.css
+++ b/wp-includes/css/editor-rtl.css
@@ -392,11 +392,6 @@ div.mce-path {
 	cursor: pointer;
 }

-.mce-btn .mce-txt {
-	direction: inherit;
-	text-align: inherit;
-}
-
 .mce-toolbar .mce-btn-group .mce-btn,
 .qt-dfw {
 	border: 1px solid transparent;
--- a/wp-includes/css/editor-rtl.min.css
+++ b/wp-includes/css/editor-rtl.min.css
--- a/wp-includes/css/editor.css
+++ b/wp-includes/css/editor.css
@@ -392,11 +392,6 @@ div.mce-path {
 	cursor: pointer;
 }

-.mce-btn .mce-txt {
-	direction: inherit;
-	text-align: inherit;
-}
-
 .mce-toolbar .mce-btn-group .mce-btn,
 .qt-dfw {
 	border: 1px solid transparent;
--- a/wp-includes/css/editor.min.css
+++ b/wp-includes/css/editor.min.css
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -2234,7 +2234,7 @@ function wp_check_filetype( $filename, $mimes = null ) {
 * If it's determined that the extension does not match the file's real type,
 * then the "proper_filename" value will be set with a proper filename and extension.
 *
- * Currently this function only supports renaming images validated via wp_get_image_mime().
+ * Currently this function only supports validating images known to getimagesize().
 *
 * @since 3.0.0
 *
@@ -2258,15 +2258,14 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {
 		return compact( 'ext', 'type', 'proper_filename' );
 	}

-	// Validate image types.
-	if ( $type && 0 === strpos( $type, 'image/' ) ) {
+	// We're able to validate images using GD
+	if ( $type && 0 === strpos( $type, 'image/' ) && function_exists('getimagesize') ) {

 		// Attempt to figure out what type of image it actually is
-		$real_mime = wp_get_image_mime( $file );
+		$imgstats = @getimagesize( $file );

-		if ( ! $real_mime ) {
-			$type = $ext = false;
-		} elseif ( $real_mime != $type ) {
+		// If getimagesize() knows what kind of image it really is and if the real MIME doesn't match the claimed MIME
+		if ( !empty($imgstats['mime']) && $imgstats['mime'] != $type ) {
 			/**
 			 * Filters the list mapping image mime types to their respective extensions.
 			 *
@@ -2283,10 +2282,10 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {
 			) );

 			// Replace whatever is after the last period in the filename with the correct extension
-			if ( ! empty( $mime_to_ext[ $real_mime ] ) ) {
+			if ( ! empty( $mime_to_ext[ $imgstats['mime'] ] ) ) {
 				$filename_parts = explode( '.', $filename );
 				array_pop( $filename_parts );
-				$filename_parts[] = $mime_to_ext[ $real_mime ];
+				$filename_parts[] = $mime_to_ext[ $imgstats['mime'] ];
 				$new_filename = implode( '.', $filename_parts );

 				if ( $new_filename != $filename ) {
@@ -2296,20 +2295,8 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {
 				$wp_filetype = wp_check_filetype( $new_filename, $mimes );
 				$ext = $wp_filetype['ext'];
 				$type = $wp_filetype['type'];
-			} else {
-				$type = $ext = false;
 			}
 		}
-	} elseif ( function_exists( 'finfo_file' ) ) {
-		// Use finfo_file if available to validate non-image files.
-		$finfo = finfo_open( FILEINFO_MIME_TYPE );
-		$real_mime = finfo_file( $finfo, $file );
-		finfo_close( $finfo );
-
-		// If the extension does not match the file's real type, return false.
-		if ( $real_mime !== $type ) {
-			$type = $ext = false;
-		}
 	}

 	/**
@@ -2327,38 +2314,6 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {
 	return apply_filters( 'wp_check_filetype_and_ext', compact( 'ext', 'type', 'proper_filename' ), $file, $filename, $mimes );
 }

-/**
- * Returns the real mime type of an image file.
- *
- * This depends on exif_imagetype() or getimagesize() to determine real mime types.
- *
- * @since 4.7.1
- *
- * @param string $file Full path to the file.
- * @return string|false The actual mime type or false if the type cannot be determined.
- */
-function wp_get_image_mime( $file ) {
-	/*
-	 * Use exif_imagetype() to check the mimetype if available or fall back to
-	 * getimagesize() if exif isn't avaialbe. If either function throws an Exception
-	 * we assume the file could not be validated.
-	 */
-	try {
-		if ( is_callable( 'exif_imagetype' ) ) {
-			$mime = image_type_to_mime_type( exif_imagetype( $file ) );
-		} elseif ( function_exists( 'getimagesize' ) ) {
-			$imagesize = getimagesize( $file );
-			$mime = ( isset( $imagesize['mime'] ) ) ? $imagesize['mime'] : false;
-		} else {
-			$mime = false;
-		}
-	} catch ( Exception $e ) {
-		$mime = false;
-	}
-
-	return $mime;
-}
-
 /**
 * Retrieve list of mime types and file extensions.
 *
@@ -3235,29 +3190,28 @@ function _config_wp_siteurl( $url = '' ) {
 * Fills in the 'directionality' setting, enables the 'directionality'
 * plugin, and adds the 'ltr' button to 'toolbar1', formerly
 * 'theme_advanced_buttons1' array keys. These keys are then returned
- * in the $mce_init (TinyMCE settings) array.
+ * in the $input (TinyMCE settings) array.
 *
 * @since 2.1.0
 * @access private
 *
- * @param array $mce_init MCE settings array.
+ * @param array $input MCE settings array.
 * @return array Direction set for 'rtl', if needed by locale.
 */
-function _mce_set_direction( $mce_init ) {
+function _mce_set_direction( $input ) {
 	if ( is_rtl() ) {
-		$mce_init['directionality'] = 'rtl';
-		$mce_init['rtl_ui'] = true;
+		$input['directionality'] = 'rtl';

-		if ( ! empty( $mce_init['plugins'] ) && strpos( $mce_init['plugins'], 'directionality' ) === false ) {
-			$mce_init['plugins'] .= ',directionality';
+		if ( ! empty( $input['plugins'] ) && strpos( $input['plugins'], 'directionality' ) === false ) {
+			$input['plugins'] .= ',directionality';
 		}

-		if ( ! empty( $mce_init['toolbar1'] ) && ! preg_match( '/\bltr\b/', $mce_init['toolbar1'] ) ) {
-			$mce_init['toolbar1'] .= ',ltr';
+		if ( ! empty( $input['toolbar1'] ) && ! preg_match( '/\bltr\b/', $input['toolbar1'] ) ) {
+			$input['toolbar1'] .= ',ltr';
 		}
 	}

-	return $mce_init;
+	return $input;
 }


--- a/wp-includes/general-template.php
+++ b/wp-includes/general-template.php
@@ -2853,7 +2853,7 @@ function wp_resource_hints() {
 		$urls = array_unique( $urls );

 		foreach ( $urls as $url ) {
-			printf( "<link rel='%s' href='%s' />\n", $relation_type, $url );
+			printf( "<link rel='%s' href='%s'>\n", $relation_type, $url );
 		}
 	}
 }
--- a/wp-includes/js/jquery/jquery.masonry.min.js
+++ b/wp-includes/js/jquery/jquery.masonry.min.js
@@ -1,11 +1,11 @@
-/*!
- * Masonry v2 shim
- * to maintain backwards compatibility
- * as of Masonry v3.1.2
- *
- * Cascading grid layout library
- * http://masonry.desandro.com
- * MIT License
- * by David DeSandro
- */
-!function(a){"use strict";var b=a.Masonry;b.prototype._remapV2Options=function(){this._remapOption("gutterWidth","gutter"),this._remapOption("isResizable","isResizeBound"),this._remapOption("isRTL","isOriginLeft",function(a){return!a});var a=this.options.isAnimated;if(void 0!==a&&(this.options.transitionDuration=a?this.options.transitionDuration:0),void 0===a||a){var b=this.options.animationOptions,c=b&&b.duration;c&&(this.options.transitionDuration="string"==typeof c?c:c+"ms")}},b.prototype._remapOption=function(a,b,c){var d=this.options[a];void 0!==d&&(this.options[b]=c?c(d):d)};var c=b.prototype._create;b.prototype._create=function(){var a=this;this._remapV2Options(),c.apply(this,arguments),setTimeout(function(){jQuery(a.element).addClass("masonry")},0)};var d=b.prototype.layout;b.prototype.layout=function(){this._remapV2Options(),d.apply(this,arguments)};var e=b.prototype.option;b.prototype.option=function(){e.apply(this,arguments),this._remapV2Options()};var f=b.prototype._itemize;b.prototype._itemize=function(a){var b=f.apply(this,arguments);return jQuery(a).addClass("masonry-brick"),b};var g=b.prototype.measureColumns;b.prototype.measureColumns=function(){var a=this.options.columnWidth;a&&"function"==typeof a&&(this.getContainerWidth(),this.columnWidth=a(this.containerWidth)),g.apply(this,arguments)},b.prototype.reload=function(){this.reloadItems.apply(this,arguments),this.layout.apply(this)};var h=b.prototype.destroy;b.prototype.destroy=function(){var a=this.getItemElements();jQuery(this.element).removeClass("masonry"),jQuery(a).removeClass("masonry-brick"),h.apply(this,arguments)}}(window);
+-/*!
+- * Masonry v2 shim
+- * to maintain backwards compatibility
+- * as of Masonry v3.1.2
+- *
+- * Cascading grid layout library
+- * http://masonry.desandro.com
+- * MIT License
+- * by David DeSandro
+- */
+!function(a){"use strict";var b=a.Masonry;b.prototype._remapV2Options=function(){this._remapOption("gutterWidth","gutter"),this._remapOption("isResizable","isResizeBound"),this._remapOption("isRTL","isOriginLeft",function(a){return!a});var a=this.options.isAnimated;if(void 0!==a&&(this.options.transitionDuration=a?b.prototype.options.transitionDuration:0),void 0===a||a){var c=this.options.animationOptions,d=c&&c.duration;d&&(this.options.transitionDuration="string"==typeof d?d:d+"ms")}},b.prototype._remapOption=function(a,b,c){var d=this.options[a];void 0!==d&&(this.options[b]=c?c(d):d)};var c=b.prototype._create;b.prototype._create=function(){var a=this;this._remapV2Options(),c.apply(this,arguments),setTimeout(function(){jQuery(a.element).addClass("masonry")},0)};var d=b.prototype.layout;b.prototype.layout=function(){this._remapV2Options(),d.apply(this,arguments)};var e=b.prototype.option;b.prototype.option=function(){e.apply(this,arguments),this._remapV2Options()};var f=b.prototype._itemize;b.prototype._itemize=function(a){var b=f.apply(this,arguments);return jQuery(a).addClass("masonry-brick"),b};var g=b.prototype.measureColumns;b.prototype.measureColumns=function(){var a=this.options.columnWidth;a&&"function"==typeof a&&(this.getContainerWidth(),this.columnWidth=a(this.containerWidth)),g.apply(this,arguments)},b.prototype.reload=function(){this.reloadItems.apply(this,arguments),this.layout.apply(this)};var h=b.prototype.destroy;b.prototype.destroy=function(){var a=this.getItemElements();jQuery(this.element).removeClass("masonry"),jQuery(a).removeClass("masonry-brick"),h.apply(this,arguments)}}(window);
--- a/wp-includes/js/tinymce/skins/wordpress/wp-content.css
+++ b/wp-includes/js/tinymce/skins/wordpress/wp-content.css
@@ -20,8 +20,7 @@ body.rtl {
 	font-family: Tahoma, "Times New Roman", "Bitstream Charter", Times, serif;
 }

-body.locale-he-il,
-body.locale-vi {
+body.locale-he-il {
 	font-family: Arial, "Times New Roman", "Bitstream Charter", Times, serif;
 }

--- a/wp-includes/load.php
+++ b/wp-includes/load.php
@@ -1017,22 +1017,13 @@ function wp_is_ini_value_changeable( $setting ) {
 	static $ini_all;

 	if ( ! isset( $ini_all ) ) {
-		$ini_all = false;
-		// Sometimes `ini_get_all()` is disabled via the `disable_functions` option for "security purposes".
-		if ( function_exists( 'ini_get_all' ) ) {
-			$ini_all = ini_get_all();
-		}
- 	}
+		$ini_all = ini_get_all();
+	}

 	// Bit operator to workaround https://bugs.php.net/bug.php?id=44936 which changes access level to 63 in PHP 5.2.6 - 5.2.17.
 	if ( isset( $ini_all[ $setting ]['access'] ) && ( INI_ALL === ( $ini_all[ $setting ]['access'] & 7 ) || INI_USER === ( $ini_all[ $setting ]['access'] & 7 ) ) ) {
 		return true;
 	}

-	// If we were unable to retrieve the details, fail gracefully to assume it's changeable.
-	if ( ! is_array( $ini_all ) ) {
-		return true;
-	}
-
 	return false;
 }
--- a/wp-includes/ms-functions.php
+++ b/wp-includes/ms-functions.php
@@ -669,7 +669,7 @@ function wpmu_validate_blog_signup( $blogname, $blog_title, $user = '' ) {
 function wpmu_signup_blog( $domain, $path, $title, $user, $user_email, $meta = array() )  {
 	global $wpdb;

-	$key = substr( md5( time() . wp_rand() . $domain ), 0, 16 );
+	$key = substr( md5( time() . rand() . $domain ), 0, 16 );
 	$meta = serialize($meta);

 	$wpdb->insert( $wpdb->signups, array(
@@ -719,7 +719,7 @@ function wpmu_signup_user( $user, $user_email, $meta = array() ) {
 	// Format data
 	$user = preg_replace( '/\s+/', '', sanitize_user( $user, true ) );
 	$user_email = sanitize_email( $user_email );
-	$key = substr( md5( time() . wp_rand() . $user_email ), 0, 16 );
+	$key = substr( md5( time() . rand() . $user_email ), 0, 16 );
 	$meta = serialize($meta);

 	$wpdb->insert( $wpdb->signups, array(
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -349,7 +349,7 @@ function wp_mail( $to, $subject, $message, $headers = '', $attachments = array()
 	 */
 	$from_name = apply_filters( 'wp_mail_from_name', $from_name );

-	$phpmailer->setFrom( $from_email, $from_name, false );
+	$phpmailer->setFrom( $from_email, $from_name );

 	// Set destination addresses
 	if ( !is_array( $to ) )
--- a/wp-includes/query.php
+++ b/wp-includes/query.php
@@ -3069,15 +3069,14 @@ class WP_Query {

 		if ( 'any' == $post_type ) {
 			$in_search_post_types = get_post_types( array('exclude_from_search' => false) );
-			if ( empty( $in_search_post_types ) ) {
+			if ( empty( $in_search_post_types ) )
 				$where .= ' AND 1=0 ';
-			} else {
-				$where .= " AND {$wpdb->posts}.post_type IN ('" . join( "', '", array_map( 'esc_sql', $in_search_post_types ) ) . "')";
-			}
+			else
+				$where .= " AND $wpdb->posts.post_type IN ('" . join("', '", $in_search_post_types ) . "')";
 		} elseif ( !empty( $post_type ) && is_array( $post_type ) ) {
-			$where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", esc_sql( $post_type ) ) . "')";
+			$where .= " AND $wpdb->posts.post_type IN ('" . join("', '", $post_type) . "')";
 		} elseif ( ! empty( $post_type ) ) {
-			$where .= $wpdb->prepare( " AND {$wpdb->posts}.post_type = %s", $post_type );
+			$where .= " AND $wpdb->posts.post_type = '$post_type'";
 			$post_type_object = get_post_type_object ( $post_type );
 		} elseif ( $this->is_attachment ) {
 			$where .= " AND $wpdb->posts.post_type = 'attachment'";
--- a/wp-includes/revision.php
+++ b/wp-includes/revision.php
@@ -594,13 +594,7 @@ function _wp_preview_post_thumbnail_filter( $value, $post_id, $meta_key ) {
 		return $value;
 	}

-	if ( empty( $_REQUEST['_thumbnail_id'] ) ||
-	     empty( $_REQUEST['preview_id'] ) ||
-	     $post->ID != $post_id ||
-	     '_thumbnail_id' != $meta_key ||
-	     'revision' == $post->post_type ||
-	     $post_id != $_REQUEST['preview_id']
-	) {
+	if ( empty( $_REQUEST['_thumbnail_id'] ) || $post->ID != $post_id || '_thumbnail_id' != $meta_key || 'revision' == $post->post_type ) {
 		return $value;
 	}

--- a/wp-includes/script-loader.php
+++ b/wp-includes/script-loader.php
@@ -250,7 +250,7 @@ function wp_default_scripts( &$scripts ) {
 	// It sets jQuery as a dependency, as the theme may have been implicitly loading it this way.
 	$scripts->add( 'imagesloaded', "/wp-includes/js/imagesloaded.min.js", array(), '3.2.0', 1 );
 	$scripts->add( 'masonry', "/wp-includes/js/masonry.min.js", array( 'imagesloaded' ), '3.3.2', 1 );
-	$scripts->add( 'jquery-masonry', "/wp-includes/js/jquery/jquery.masonry$dev_suffix.js", array( 'jquery', 'masonry' ), '3.1.2b', 1 );
+	$scripts->add( 'jquery-masonry', "/wp-includes/js/jquery/jquery.masonry$dev_suffix.js", array( 'jquery', 'masonry' ), '3.1.2a', 1 );

 	$scripts->add( 'thickbox', "/wp-includes/js/thickbox/thickbox.js", array('jquery'), '3.1-20121105', 1 );
 	did_action( 'init' ) && $scripts->localize( 'thickbox', 'thickboxL10n', array(
@@ -563,7 +563,7 @@ function wp_default_scripts( &$scripts ) {
 			'suggestedImgAlt' => __( 'Suggested image #%d' ),
 		) );

-		$scripts->add( 'editor-expand', "/wp-admin/js/editor-expand$suffix.js", array( 'jquery', 'underscore' ), false, 1 );
+		$scripts->add( 'editor-expand', "/wp-admin/js/editor-expand$suffix.js", array( 'jquery' ), false, 1 );

 		$scripts->add( 'link', "/wp-admin/js/link$suffix.js", array( 'wp-lists', 'postbox' ), false, 1 );

--- a/wp-includes/taxonomy.php
+++ b/wp-includes/taxonomy.php
@@ -4274,10 +4274,6 @@ function is_object_in_term( $object_id, $taxonomy, $terms = null ) {
 	$object_terms = get_object_term_cache( $object_id, $taxonomy );
 	if ( false === $object_terms ) {
 		$object_terms = wp_get_object_terms( $object_id, $taxonomy, array( 'update_term_meta_cache' => false ) );
-		if ( is_wp_error( $object_terms ) ) {
-			return $object_terms;
-		}
-
 		wp_cache_set( $object_id, wp_list_pluck( $object_terms, 'term_id' ), "{$taxonomy}_relationships" );
 	}

--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
 *
 * @global string $wp_version
 */
-$wp_version = '4.6.3';
+$wp_version = '4.6';

 /**
 * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
--- a/wp-includes/wp-db.php
+++ b/wp-includes/wp-db.php
@@ -734,9 +734,6 @@ class wpdb {
 	 * @since 3.1.0
 	 */
 	public function init_charset() {
-		$charset = '';
-		$collate = '';
-
 		if ( function_exists('is_multisite') && is_multisite() ) {
 			$charset = 'utf8';
 			if ( defined( 'DB_COLLATE' ) && DB_COLLATE ) {
@@ -779,11 +776,6 @@ class wpdb {
 			$charset = 'utf8mb4';
 		}

-		if ( 'utf8mb4' === $charset && ! $this->has_cap( 'utf8mb4' ) ) {
-			$charset = 'utf8';
-			$collate = str_replace( 'utf8mb4_', 'utf8_', $collate );
-		}
-
 		if ( 'utf8mb4' === $charset ) {
 			// _general_ is outdated, so we can upgrade it to _unicode_, instead.
 			if ( ! $collate || 'utf8_general_ci' === $collate ) {
@@ -816,29 +808,22 @@ class wpdb {
 		if ( ! isset( $collate ) )
 			$collate = $this->collate;
 		if ( $this->has_cap( 'collation' ) && ! empty( $charset ) ) {
-			$set_charset_succeeded = true;
-
 			if ( $this->use_mysqli ) {
 				if ( function_exists( 'mysqli_set_charset' ) && $this->has_cap( 'set_charset' ) ) {
-					$set_charset_succeeded = mysqli_set_charset( $dbh, $charset );
-				}
-
-				if ( $set_charset_succeeded ) {
-					$query = $this->prepare( 'SET NAMES %s', $charset );
-					if ( ! empty( $collate ) )
-						$query .= $this->prepare( ' COLLATE %s', $collate );
-					mysqli_query( $dbh, $query );
+					mysqli_set_charset( $dbh, $charset );
 				}
+				$query = $this->prepare( 'SET NAMES %s', $charset );
+				if ( ! empty( $collate ) )
+					$query .= $this->prepare( ' COLLATE %s', $collate );
+				mysqli_query( $dbh, $query );
 			} else {
 				if ( function_exists( 'mysql_set_charset' ) && $this->has_cap( 'set_charset' ) ) {
-					$set_charset_succeeded = mysql_set_charset( $charset, $dbh );
-				}
-				if ( $set_charset_succeeded ) {
-					$query = $this->prepare( 'SET NAMES %s', $charset );
-					if ( ! empty( $collate ) )
-						$query .= $this->prepare( ' COLLATE %s', $collate );
-					mysql_query( $query, $dbh );
+					mysql_set_charset( $charset, $dbh );
 				}
+				$query = $this->prepare( 'SET NAMES %s', $charset );
+				if ( ! empty( $collate ) )
+					$query .= $this->prepare( ' COLLATE %s', $collate );
+				mysql_query( $query, $dbh );
 			}
 		}
 	}
--- a/wp-mail.php
+++ b/wp-mail.php
@@ -14,12 +14,6 @@ require(dirname(__FILE__) . '/wp-load.php');
 if ( ! apply_filters( 'enable_post_by_email_configuration', true ) )
 	wp_die( __( 'This action has been disabled by the administrator.' ) );

-$mailserver_url = get_option( 'mailserver_url' );
-
-if ( 'mail.example.com' === $mailserver_url || empty( $mailserver_url ) ) {
-	wp_die( __( 'This action has been disabled by the administrator.' ), 403 );
-}
-
 /**
 * Fires to allow a plugin to do a complete takeover of Post by Email.
 *