Tag 4.4.27

Built from https://develop.svn.wordpress.org/tags/4.4.27@52912 git-svn-id: http://core.svn.wordpress.org/tags/4.4.27@52501 1a063a9b-81f0-0310-95a4-ce76da25c4cd
WordPress 4.4.27.
2022-03-11 00:34:05 +00:00 · 2022-03-10 22:17:02 +00:00 · 2022-03-10 21:39:21 +00:00 · 2022-01-06 18:56:04 +00:00 · 2022-01-06 18:19:21 +00:00 · 2021-05-12 23:22:19 +00:00
397 changed files with 14552 additions and 1614 deletions
--- a/license.txt
+++ b/license.txt
@@ -1,6 +1,6 @@
 WordPress - Web publishing software

-Copyright 2015 by the contributors
+Copyright 2018 by the contributors

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
--- a/readme.html
+++ b/readme.html
@@ -9,7 +9,6 @@
 <body>
 <h1 id="logo">
 	<a href="https://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
-	<br /> Version 4.4
 </h1>
 <p style="text-align: center">Semantic Personal Publishing Platform</p>

--- a/wp-activate.php
+++ b/wp-activate.php
@@ -18,6 +18,50 @@ if ( !is_multisite() ) {
 	die();
 }

+$valid_error_codes = array( 'already_active', 'blog_taken' );
+
+list( $activate_path ) = explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) );
+$activate_cookie = 'wp-activate-' . COOKIEHASH;
+
+$key    = '';
+$result = null;
+
+if ( isset( $_GET['key'] ) && isset( $_POST['key'] ) && $_GET['key'] !== $_POST['key'] ) {
+	wp_die( __( 'A key value mismatch has been detected. Please follow the link provided in your activation email.' ), __( 'An error occurred during the activation' ), 400 );
+} elseif ( ! empty( $_GET['key'] ) ) {
+	$key = $_GET['key'];
+} elseif ( ! empty( $_POST['key'] ) ) {
+	$key = $_POST['key'];
+}
+
+if ( $key ) {
+	$redirect_url = remove_query_arg( 'key' );
+
+	if ( $redirect_url !== remove_query_arg( false ) ) {
+		setcookie( $activate_cookie, $key, 0, $activate_path, COOKIE_DOMAIN, is_ssl(), true );
+		wp_safe_redirect( $redirect_url );
+		exit;
+	} else {
+		$result = wpmu_activate_signup( $key );
+	}
+}
+
+if ( $result === null && isset( $_COOKIE[ $activate_cookie ] ) ) {
+	$key    = $_COOKIE[ $activate_cookie ];
+	$result = wpmu_activate_signup( $key );
+	setcookie( $activate_cookie, ' ', time() - YEAR_IN_SECONDS, $activate_path, COOKIE_DOMAIN, is_ssl(), true );
+}
+
+if ( $result === null || ( is_wp_error( $result ) && 'invalid_key' === $result->get_error_code() ) ) {
+	status_header( 404 );
+} elseif ( is_wp_error( $result ) ) {
+	$error_code = $result->get_error_code();
+
+	if ( ! in_array( $error_code, $valid_error_codes ) ) {
+		status_header( 400 );
+	}
+}
+
 if ( is_object( $wp_object_cache ) )
 	$wp_object_cache->cache_enabled = false;

@@ -63,13 +107,14 @@ function wpmu_activate_stylesheet() {
 	<?php
 }
 add_action( 'wp_head', 'wpmu_activate_stylesheet' );
+add_action( 'wp_head', 'wp_sensitive_page_meta' );

 get_header( 'wp-activate' );
 ?>

 <div id="signup-content" class="widecolumn">
 	<div class="wp-activate-container">
-	<?php if ( empty($_GET['key']) && empty($_POST['key']) ) { ?>
+	<?php if ( ! $key ) { ?>

 		<h2><?php _e('Activation Key Required') ?></h2>
 		<form name="activateform" id="activateform" method="post" action="<?php echo network_site_url('wp-activate.php'); ?>">
@@ -83,28 +128,25 @@ get_header( 'wp-activate' );
 		</form>

 	<?php } else {
-
-		$key = !empty($_GET['key']) ? $_GET['key'] : $_POST['key'];
-		$result = wpmu_activate_signup( $key );
-		if ( is_wp_error($result) ) {
-			if ( 'already_active' == $result->get_error_code() || 'blog_taken' == $result->get_error_code() ) {
-			    $signup = $result->get_error_data();
-				?>
-				<h2><?php _e('Your account is now active!'); ?></h2>
-				<?php
-				echo '<p class="lead-in">';
-				if ( $signup->domain . $signup->path == '' ) {
-					printf( __('Your account has been activated. You may now <a href="%1$s">log in</a> to the site using your chosen username of &#8220;%2$s&#8221;. Please check your email inbox at %3$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%4$s">reset your password</a>.'), network_site_url( 'wp-login.php', 'login' ), $signup->user_login, $signup->user_email, wp_lostpassword_url() );
-				} else {
-					printf( __('Your site at <a href="%1$s">%2$s</a> is active. You may now log in to your site using your chosen username of &#8220;%3$s&#8221;. Please check your email inbox at %4$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%5$s">reset your password</a>.'), 'http://' . $signup->domain, $signup->domain, $signup->user_login, $signup->user_email, wp_lostpassword_url() );
-				}
-				echo '</p>';
+		if ( is_wp_error( $result ) && in_array( $result->get_error_code(), $valid_error_codes ) ) {
+			$signup = $result->get_error_data();
+			?>
+			<h2><?php _e('Your account is now active!'); ?></h2>
+			<?php
+			echo '<p class="lead-in">';
+			if ( $signup->domain . $signup->path == '' ) {
+				printf( __('Your account has been activated. You may now <a href="%1$s">log in</a> to the site using your chosen username of &#8220;%2$s&#8221;. Please check your email inbox at %3$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%4$s">reset your password</a>.'), network_site_url( 'wp-login.php', 'login' ), $signup->user_login, $signup->user_email, wp_lostpassword_url() );
 			} else {
-				?>
-				<h2><?php _e('An error occurred during the activation'); ?></h2>
-				<?php
-			    echo '<p>'.$result->get_error_message().'</p>';
+				printf( __('Your site at <a href="%1$s">%2$s</a> is active. You may now log in to your site using your chosen username of &#8220;%3$s&#8221;. Please check your email inbox at %4$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%5$s">reset your password</a>.'), 'http://' . $signup->domain, $signup->domain, $signup->user_login, $signup->user_email, wp_lostpassword_url() );
 			}
+			echo '</p>';
+		} elseif ( $result === null || is_wp_error( $result ) ) {
+			?>
+			<h2><?php _e('An error occurred during the activation'); ?></h2>
+			<?php if ( is_wp_error( $result ) ) {
+				echo '<p>' . $result->get_error_message() . '</p>';
+			} ?>
+			<?php
 		} else {
 			$url = isset( $result['blog_id'] ) ? get_blogaddress_by_id( (int) $result['blog_id'] ) : '';
 			$user = get_userdata( (int) $result['user_id'] );
--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -21,6 +21,12 @@ if ( current_user_can( 'install_plugins' ) ) {
 	wp_enqueue_script( 'plugin-install' );
 }

+$video_url = 'https://videopress.com/embed/J44FHXvg?hd=true';
+$locale    = str_replace( '_', '-', get_locale() );
+list( $locale ) = explode( '-', $locale );
+if ( 'en' !== $locale ) {
+	$video_url = add_query_arg( 'defaultLangCode', $locale, $video_url );
+}

 wp_oembed_add_host_js();

@@ -33,7 +39,7 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 	<div class="wrap about-wrap">
 		<h1><?php printf( __( 'Welcome to WordPress&nbsp;%s' ), $display_version ); ?></h1>

-		<div class="about-text"><?php printf( __( 'Thank you for updating! WordPress %s makes it even easier to format your content and customize your site.' ), $display_version ); ?></div>
+		<div class="about-text"><?php printf( __( 'Thank you for updating! WordPress %s makes your site more connected and responsive.' ), $display_version ); ?></div>
 		<div class="wp-badge"><?php printf( __( 'Version %s' ), $display_version ); ?></div>

 		<h2 class="nav-tab-wrapper">
@@ -42,10 +48,284 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 			<a href="freedoms.php" class="nav-tab"><?php _e( 'Freedoms' ); ?></a>
 		</h2>

+		<div class="changelog point-releases">
+			<h3><?php _e( 'Maintenance and Security Releases' ); ?> </h3>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed one security issue.' ),
+					'4.4.27'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.4.27' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed some security issues.' ),
+					'4.4.26'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.4.26' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed one security issue.' ),
+					'4.4.25'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.4.25' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed some security issues.' ),
+					'4.4.24'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.4.24' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed some security issues.' ),
+					'4.4.23'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.4.23' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed some security issues.' ),
+					'4.4.22'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.4.22' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed one security issue.' ),
+					'4.4.21'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.4.21' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed some security issues.' ),
+					'4.4.20'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.4.20' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed some security issues.' ),
+					'4.4.19'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.4.19' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>Version %s</strong> addressed some security issues.' ),
+					'4.4.18'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.4.18' )
+					)
+				);
+				?>
+			</p>
+			<p>
+				<?php
+				/* translators: %s: WordPress version number */
+				printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.4.17' );
+				?>
+				<?php
+				/* translators: %s: Codex URL */
+				printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.17' );
+				?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed one security issue.' ), '4.4.16' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.16' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.4.15' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.15' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed one security issue.' ), '4.4.14' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.14' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.4.13' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.13' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed one security issue.' ), '4.4.12' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.12' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.4.11' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.11' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.4.10' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.10' ); ?>
+			</p>
+			<p><?php printf( _n( '<strong>Version %1$s</strong> addressed %2$s bug.',
+					'<strong>Version %1$s</strong> addressed %2$s bugs.', 1 ), '4.4.9', number_format_i18n( 1 ) ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.9' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.4.8' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.8' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.4.7' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.7' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.4.6' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.6' ); ?>
+			</p>
+			<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
+				'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 1 ), '4.4.5', number_format_i18n( 1 ) ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.5' ); ?>
+			</p>
+			<p><?php printf( __( '<strong>Version %s</strong> addressed some security issues.' ), '4.4.4' ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.4' ); ?>
+			</p>
+			<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
+				'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 6 ), '4.4.3', number_format_i18n( 6 ) ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.3' ); ?>
+			</p>
+			<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
+				'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 17 ), '4.4.2', number_format_i18n( 17 ) ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.2' ); ?>
+			</p>
+			<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
+				'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 52 ), '4.4.1', number_format_i18n( 52 ) ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.4.1' ); ?>
+			</p>
+		</div>
+
+		<div class="headline-feature feature-video">
+			<iframe width="1050" height="591" src="<?php echo esc_url( $video_url ); ?>" frameborder="0" allowfullscreen></iframe>
+			<script src="https://videopress.com/videopress-iframe.js"></script>
+		</div>
+
+		<hr>
+
 		<div class="headline-feature feature-section one-col">
 			<h2><?php _e( 'Twenty Sixteen' ); ?></h2>
 			<div class="media-container">
-				<img src="https://cldup.com/K6k4JfS2nW.png" alt="" />
+				<img src="https://s.w.org/images/core/4.4/twenty-sixteen-white-fullsize-2x.png" alt="" srcset="https://s.w.org/images/core/4.4/twenty-sixteen-white-smartphone-1x.png 268w, https://s.w.org/images/core/4.4/twenty-sixteen-white-smartphone-2x.png 536w, https://s.w.org/images/core/4.4/twenty-sixteen-white-tablet-1x.png 558w, https://s.w.org/images/core/4.4/twenty-sixteen-white-desktop-1x.png 840w, https://s.w.org/images/core/4.4/twenty-sixteen-white-fullsize-1x.png 1086w, https://s.w.org/images/core/4.4/twenty-sixteen-white-tablet-2x.png 1116w, https://s.w.org/images/core/4.4/twenty-sixteen-white-desktop-2x.png 1680w, https://s.w.org/images/core/4.4/twenty-sixteen-white-fullsize-2x.png 2172w" sizes="(max-width: 500px) calc((100vw - 40px) * .8), (max-width: 782px) calc((100vw - 70px) * .8), (max-width: 960px) calc((100vw - 116px) * .8), (max-width: 1290px) calc((100vw - 240px) * .8), 840px" />
 			</div>
 			<div class="two-col">
 				<div class="col">
@@ -54,12 +334,12 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 					<p><?php _e( 'Twenty Sixteen was built to look great on any device. A fluid grid design, flexible header, fun color schemes, and more, will make your content shine.' ); ?></p>
 					<div class="horizontal-image">
 						<div class="content">
-							<img class="feature-image horizontal-screen" src="https://cldup.com/J-zxmMqkXs.png" alt="" />
+							<img class="feature-image horizontal-screen" src="https://s.w.org/images/core/4.4/twenty-sixteen-dark-fullsize-2x.png?2" alt=""  srcset="https://s.w.org/images/core/4.4/twenty-sixteen-dark-smartphone-1x.png?2 268w, https://s.w.org/images/core/4.4/twenty-sixteen-dark-smartphone-2x.png?2 535w, https://s.w.org/images/core/4.4/twenty-sixteen-dark-desktop-1x.png?2 558w, https://s.w.org/images/core/4.4/twenty-sixteen-dark-fullsize-1x.png?2 783w, https://s.w.org/images/core/4.4/twenty-sixteen-dark-desktop-2x.png?2 1116w, https://s.w.org/images/core/4.4/twenty-sixteen-dark-fullsize-2x.png?2 1566w" sizes="(max-width: 500px) calc((100vw - 40px) * .8), (max-width: 782px) calc((100vw - 70px) * .8), (max-width: 960px) calc((100vw - 116px) * .5216), (max-width: 1290px) calc((100vw - 240px) * .5216), 548px" />
 						</div>
 					</div>
 				</div>
 				<div class="col feature-image">
-					<img class="vertical-screen" src="https://cldup.com/M8i_6X5LUL.png" alt="" />
+					<img class="vertical-screen" src="https://s.w.org/images/core/4.4/twenty-sixteen-red-fullsize-2x.png" alt="" srcset="https://s.w.org/images/core/4.4/twenty-sixteen-red-smartphone-1x.png 107w, https://s.w.org/images/core/4.4/twenty-sixteen-red-smartphone-2x.png 214w, https://s.w.org/images/core/4.4/twenty-sixteen-red-desktop-1x.png 252w, https://s.w.org/images/core/4.4/twenty-sixteen-red-fullsize-1x.png 410w, https://s.w.org/images/core/4.4/twenty-sixteen-red-desktop-2x.png 504w, https://s.w.org/images/core/4.4/twenty-sixteen-red-fullsize-2x.png 820w" sizes="(max-width: 500px) calc((100vw - 40px) * .32), (max-width: 782px) calc((100vw - 70px) * .32), (max-width: 960px) calc((100vw - 116px) * .24), (max-width: 1290px) calc((100vw - 240px) * .24), 252px" />
 				</div>
 			</div>
 		</div>
@@ -69,7 +349,7 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 		<div class="feature-section two-col">
 			<div class="col">
 				<div class="media-container">
-					<img src="https://cldup.com/av6MH44-Au.png" alt="" />
+					<img src="https://s.w.org/images/core/4.4/responsive-devices-fullsize-2x.png" alt="" srcset="https://s.w.org/images/core/4.4/responsive-devices-smartphone-1x.png 335w, https://s.w.org/images/core/4.4/responsive-devices-desktop-1x.png 500w, https://s.w.org/images/core/4.4/responsive-devices-smartphone-2x.png 670w, https://s.w.org/images/core/4.4/responsive-devices-tablet-1x.png 698w, https://s.w.org/images/core/4.4/responsive-devices-desktop-2x.png 1000w, https://s.w.org/images/core/4.4/responsive-devices-fullsize-1x.png 1200w, https://s.w.org/images/core/4.4/responsive-devices-tablet-2x.png 1396w, https://s.w.org/images/core/4.4/responsive-devices-fullsize-2x.png 2400w" sizes="(max-width: 500px) calc(100vw - 40px), (max-width: 782px) calc(100vw - 70px), (max-width: 960px) calc((100vw - 116px) * .476), (max-width: 1290px) calc((100vw - 240px) * .476), 500px" />
 				</div>
 			</div>
 			<div class="col">
@@ -83,15 +363,24 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
 		<div class="feature-section two-col">
 			<div class="col">
 				<div class="embed-container">
-					<?php echo wp_oembed_get( 'https://make.wordpress.org/core/2015/10/28/new-embeds-feature-in-wordpress-4-4/' ); ?>
+					<blockquote data-secret="OcUe7B6Edh" class="wp-embedded-content"><a href="https://wordpress.org/news/2015/12/clifford/">WordPress 4.4 &ldquo;Clifford&rdquo;</a></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="display:none;" src="https://wordpress.org/news/2015/12/clifford/embed/#?secret=OcUe7B6Edh" data-secret="OcUe7B6Edh" width="600" height="338" title="<?php esc_attr_e( 'Embedded WordPress Post' ); ?>" frameborder="0" marginwidth="0" marginheight="0" scrolling="no"></iframe>
 				</div>
+			</div>
+			<div class="col">
 				<h3><?php _e( 'Embed your WordPress content' ); ?></h3>
 				<p><?php _e( 'Now you can embed your posts on other sites, even other WordPress sites. Simply drop a post URL into the editor and see an instant embed preview, complete with the title, excerpt, and featured image if you&#8217;ve set one. We&#8217;ll even include your site icon and links for comments and sharing.' ); ?></p>
 			</div>
+		</div>
+
+		<hr />
+
+		<div class="feature-section two-col">
 			<div class="col">
-				<div class="embed-container">
-					<?php echo wp_oembed_get( '' ); ?>
+				<div class="embed-container embed-reverbnation">
+					<iframe width="640" height="150" scrolling="no" frameborder="no" src="https://www.reverbnation.com/widget_code/html_widget/artist_607?widget_id=55&amp;pwc[song_ids]=3731874&amp;pwc[size]=small"></iframe>
 				</div>
+			</div>
+			<div class="col">
 				<h3><?php _e( 'Even more embed providers' ); ?></h3>
 				<p><?php _e( 'In addition to post embeds, WordPress 4.4 also adds support for five new oEmbed providers: Cloudup, Reddit&nbsp;Comments, ReverbNation, Speaker&nbsp;Deck, and VideoPress.' ); ?></p>
 			</div>
--- a/wp-admin/admin-header.php
+++ b/wp-admin/admin-header.php
@@ -70,13 +70,13 @@ wp_enqueue_script( 'svg-painter' );
 $admin_body_class = preg_replace('/[^a-z0-9_-]+/i', '-', $hook_suffix);
 ?>
 <script type="text/javascript">
-addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
-	pagenow = '<?php echo $current_screen->id; ?>',
-	typenow = '<?php echo $current_screen->post_type; ?>',
-	adminpage = '<?php echo $admin_body_class; ?>',
-	thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
-	decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
+addLoadEvent = function(func){if(typeof jQuery!=='undefined')jQuery(document).ready(func);else if(typeof wpOnload!=='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
+	pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
+	typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
+	adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
+	thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
+	decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
 	isRtl = <?php echo (int) is_rtl(); ?>;
 </script>
 <meta name="viewport" content="width=device-width,initial-scale=1.0">
--- a/wp-admin/async-upload.php
+++ b/wp-admin/async-upload.php
@@ -32,7 +32,7 @@ if ( ! ( isset( $_REQUEST['action'] ) && 'upload-attachment' == $_REQUEST['actio

 require_once( ABSPATH . 'wp-admin/admin.php' );

-header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) );
+header( 'Content-Type: text/plain; charset=' . get_option( 'blog_charset' ) );

 if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) {
 	include( ABSPATH . 'wp-admin/includes/ajax-actions.php' );
--- a/wp-admin/credits.php
+++ b/wp-admin/credits.php
@@ -20,7 +20,7 @@ include( ABSPATH . 'wp-admin/admin-header.php' );

 <h1><?php printf( __( 'Welcome to WordPress %s' ), $display_version ); ?></h1>

-<div class="about-text"><?php printf( __( 'Thank you for updating! WordPress %s makes it even easier to format your content and customize your site.' ), $display_version ); ?></div>
+<div class="about-text"><?php printf( __( 'Thank you for updating! WordPress %s makes your site more connected and responsive.' ), $display_version ); ?></div>

 <div class="wp-badge"><?php printf( __( 'Version %s' ), $display_version ); ?></div>

--- a/wp-admin/css/about-rtl.css
+++ b/wp-admin/css/about-rtl.css
@@ -141,6 +141,14 @@
 	margin-left: 4.799999999%;
 	width: 47.6%;
 }
+.about-wrap .feature-section.two-col .col {
+	display: inline-block;
+	float: none;
+	margin-left: 4.799999999%;
+	width: -webkit-calc( 47.6% - 4px );
+	width: calc( 47.6% - 4px );
+	vertical-align: middle;
+}

 .about-wrap .three-col .col {
 	margin-left: 4.999999999%;
@@ -174,7 +182,7 @@
 /* 2.1 - Typography */

 .about-wrap .headline-feature h2 {
-	margin: 50px 0 30px;
+	margin: 30px 0 30px;
 	font-size: 2.2em;
 	font-weight: 300;
 	line-height: 1.3;
@@ -186,6 +194,10 @@
 	text-align: right;
 }

+.about-wrap .feature-section.two-col h3 {
+	margin-top: 0;
+}
+
 .about-wrap .feature-list h2 {
 	margin: 30px 0 15px;
 	text-align: center;
@@ -215,11 +227,12 @@

 /* 2.2 - Structure */

-.about-wrap .feature-video {
+.about-wrap .headline-feature.feature-video {
 	position: relative;
 	margin: 40px 0;
-	padding-bottom: 56.25%; /* video is 1280 x 720 */
+	padding-bottom: 56.25%;
 	width: 100%;
+	max-width: 100%;
 	height: 0;
 	text-align: center;
 }
@@ -273,10 +286,6 @@
 	text-align: center;
 }

-.about-wrap .embed-cloudup iframe {
-	height: 299px;
-}
-
 .about-wrap .embed-container iframe {
 	max-width: 100%;
 }
@@ -498,11 +507,21 @@
 		width: 100%;
 	}

+	.about-wrap .feature-section.two-col .col,
 	.about-wrap .three-col .col,
 	.about-wrap .headline-feature .feature-section .col {
 		width: 100% !important;
 		float: none !important;
 	}
+
+	.about-wrap .feature-section.two-col .col:last-of-type {
+		margin-top: 0;
+	}
+
+	.feature-section.under-the-hood.three-col .col,
+	.feature-section.under-the-hood.one-col .col {
+		padding-bottom: 0;
+	}
 }

@media only screen and (max-width: 400px) {
--- a/wp-admin/css/about.css
+++ b/wp-admin/css/about.css
@@ -141,6 +141,14 @@
 	margin-right: 4.799999999%;
 	width: 47.6%;
 }
+.about-wrap .feature-section.two-col .col {
+	display: inline-block;
+	float: none;
+	margin-right: 4.799999999%;
+	width: -webkit-calc( 47.6% - 4px );
+	width: calc( 47.6% - 4px );
+	vertical-align: middle;
+}

 .about-wrap .three-col .col {
 	margin-right: 4.999999999%;
@@ -174,7 +182,7 @@
 /* 2.1 - Typography */

 .about-wrap .headline-feature h2 {
-	margin: 50px 0 30px;
+	margin: 30px 0 30px;
 	font-size: 2.2em;
 	font-weight: 300;
 	line-height: 1.3;
@@ -186,6 +194,10 @@
 	text-align: left;
 }

+.about-wrap .feature-section.two-col h3 {
+	margin-top: 0;
+}
+
 .about-wrap .feature-list h2 {
 	margin: 30px 0 15px;
 	text-align: center;
@@ -215,11 +227,12 @@

 /* 2.2 - Structure */

-.about-wrap .feature-video {
+.about-wrap .headline-feature.feature-video {
 	position: relative;
 	margin: 40px 0;
-	padding-bottom: 56.25%; /* video is 1280 x 720 */
+	padding-bottom: 56.25%;
 	width: 100%;
+	max-width: 100%;
 	height: 0;
 	text-align: center;
 }
@@ -273,10 +286,6 @@
 	text-align: center;
 }

-.about-wrap .embed-cloudup iframe {
-	height: 299px;
-}
-
 .about-wrap .embed-container iframe {
 	max-width: 100%;
 }
@@ -498,11 +507,21 @@
 		width: 100%;
 	}

+	.about-wrap .feature-section.two-col .col,
 	.about-wrap .three-col .col,
 	.about-wrap .headline-feature .feature-section .col {
 		width: 100% !important;
 		float: none !important;
 	}
+
+	.about-wrap .feature-section.two-col .col:last-of-type {
+		margin-top: 0;
+	}
+
+	.feature-section.under-the-hood.three-col .col,
+	.feature-section.under-the-hood.one-col .col {
+		padding-bottom: 0;
+	}
 }

@media only screen and (max-width: 400px) {
--- a/wp-admin/css/color-picker-rtl.min.css
+++ b/wp-admin/css/color-picker-rtl.min.css
@@ -1 +1 @@
-.wp-color-picker{width:80px}.wp-picker-container .hidden{display:none}.wp-color-result{background-color:#f7f7f7;border:1px solid #ccc;-webkit-border-radius:3px;border-radius:3px;cursor:pointer;height:22px;margin:0 0 6px 6px;position:relative;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;vertical-align:bottom;display:inline-block;padding-right:30px;-webkit-box-shadow:0 1px 0 #ccc;box-shadow:0 1px 0 #ccc;top:0}.wp-color-result:after{background:#f7f7f7;-webkit-border-radius:2px 0 0 2px;border-radius:2px 0 0 2px;border-right:1px solid #ccc;color:#555;content:attr(title);display:block;font-size:11px;line-height:22px;padding:0 6px;position:relative;left:0;text-align:center;top:0}.wp-color-result:focus,.wp-color-result:hover{background:#fafafa;border-color:#999;color:#23282d}.wp-color-result:focus:after,.wp-color-result:hover:after{color:#23282d;border-color:#a0a5aa;border-right:1px solid #999}.wp-color-result.wp-picker-open:after{content:attr(data-current)}.wp-picker-container,.wp-picker-container:active{display:inline-block;outline:0}.wp-color-result:focus{border-color:#5b9dd9;-webkit-box-shadow:0 0 3px rgba(0,115,170,.8);box-shadow:0 0 3px rgba(0,115,170,.8)}.wp-picker-open+.wp-picker-input-wrap{display:inline-block;vertical-align:top}.wp-picker-container .button{margin-right:6px}.wp-picker-container .iris-square-slider .ui-slider-handle:focus{background-color:#555}.wp-picker-container .iris-picker{-webkit-border-radius:0;border-radius:0;border-color:#dfdfdf;margin-top:6px}.wp-picker-container input[type=text].wp-color-picker{width:65px;font-size:12px;font-family:monospace;text-align:center;line-height:16px;margin:0}.wp-picker-container input[type=text].wp-color-picker:focus::-webkit-input-placeholder{color:transparent}.wp-picker-container input[type=text].wp-color-picker:-moz-placeholder{color:#999}.wp-picker-container input[type=text].iris-error{background-color:#ffebe8;border-color:#c00;color:#000}
+.wp-color-picker{width:80px}.wp-picker-container .hidden{display:none}.wp-color-result{background-color:#f7f7f7;border:1px solid #ccc;-webkit-border-radius:3px;border-radius:3px;cursor:pointer;display:inline-block;height:22px;margin:0 0 6px 6px;position:relative;top:1px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;vertical-align:bottom;display:inline-block;padding-right:30px;-webkit-box-shadow:0 1px 0 #ccc;box-shadow:0 1px 0 #ccc}.wp-color-result:after{background:#f7f7f7;-webkit-border-radius:2px 0 0 2px;border-radius:2px 0 0 2px;border-right:1px solid #ccc;color:#555;content:attr(title);display:block;font-size:11px;line-height:22px;padding:0 6px;position:relative;left:0;text-align:center;top:0}.wp-color-result:focus,.wp-color-result:hover{background:#fafafa;border-color:#999;color:#23282d}.wp-color-result:focus:after,.wp-color-result:hover:after{color:#23282d;border-color:#a0a5aa;border-right:1px solid #999}.wp-color-result{top:0}.wp-color-result.wp-picker-open:after{content:attr(data-current)}.wp-picker-container,.wp-picker-container:active{display:inline-block;outline:0}.wp-color-result:focus{border-color:#5b9dd9;-webkit-box-shadow:0 0 3px rgba(0,115,170,.8);box-shadow:0 0 3px rgba(0,115,170,.8)}.wp-picker-open+.wp-picker-input-wrap{display:inline-block;vertical-align:top}.wp-picker-container .button{margin-right:6px}.wp-picker-container .iris-square-slider .ui-slider-handle:focus{background-color:#555}.wp-picker-container .iris-picker{-webkit-border-radius:0;border-radius:0;border-color:#dfdfdf;margin-top:6px}.wp-picker-container input[type=text].wp-color-picker{width:65px;font-size:12px;font-family:monospace;text-align:center;line-height:16px;margin:0}.wp-picker-container input[type=text].wp-color-picker:focus::-webkit-input-placeholder{color:transparent}.wp-picker-container input[type=text].wp-color-picker:-moz-placeholder{color:#999}.wp-picker-container input[type=text].iris-error{background-color:#ffebe8;border-color:#c00;color:#000}
--- a/wp-admin/css/color-picker.min.css
+++ b/wp-admin/css/color-picker.min.css
@@ -1 +1 @@
-.wp-color-picker{width:80px}.wp-picker-container .hidden{display:none}.wp-color-result{background-color:#f7f7f7;border:1px solid #ccc;-webkit-border-radius:3px;border-radius:3px;cursor:pointer;height:22px;margin:0 6px 6px 0;position:relative;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;vertical-align:bottom;display:inline-block;padding-left:30px;-webkit-box-shadow:0 1px 0 #ccc;box-shadow:0 1px 0 #ccc;top:0}.wp-color-result:after{background:#f7f7f7;-webkit-border-radius:0 2px 2px 0;border-radius:0 2px 2px 0;border-left:1px solid #ccc;color:#555;content:attr(title);display:block;font-size:11px;line-height:22px;padding:0 6px;position:relative;right:0;text-align:center;top:0}.wp-color-result:focus,.wp-color-result:hover{background:#fafafa;border-color:#999;color:#23282d}.wp-color-result:focus:after,.wp-color-result:hover:after{color:#23282d;border-color:#a0a5aa;border-left:1px solid #999}.wp-color-result.wp-picker-open:after{content:attr(data-current)}.wp-picker-container,.wp-picker-container:active{display:inline-block;outline:0}.wp-color-result:focus{border-color:#5b9dd9;-webkit-box-shadow:0 0 3px rgba(0,115,170,.8);box-shadow:0 0 3px rgba(0,115,170,.8)}.wp-picker-open+.wp-picker-input-wrap{display:inline-block;vertical-align:top}.wp-picker-container .button{margin-left:6px}.wp-picker-container .iris-square-slider .ui-slider-handle:focus{background-color:#555}.wp-picker-container .iris-picker{-webkit-border-radius:0;border-radius:0;border-color:#dfdfdf;margin-top:6px}.wp-picker-container input[type=text].wp-color-picker{width:65px;font-size:12px;font-family:monospace;text-align:center;line-height:16px;margin:0}.wp-picker-container input[type=text].wp-color-picker:focus::-webkit-input-placeholder{color:transparent}.wp-picker-container input[type=text].wp-color-picker:-moz-placeholder{color:#999}.wp-picker-container input[type=text].iris-error{background-color:#ffebe8;border-color:#c00;color:#000}
+.wp-color-picker{width:80px}.wp-picker-container .hidden{display:none}.wp-color-result{background-color:#f7f7f7;border:1px solid #ccc;-webkit-border-radius:3px;border-radius:3px;cursor:pointer;display:inline-block;height:22px;margin:0 6px 6px 0;position:relative;top:1px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;vertical-align:bottom;display:inline-block;padding-left:30px;-webkit-box-shadow:0 1px 0 #ccc;box-shadow:0 1px 0 #ccc}.wp-color-result:after{background:#f7f7f7;-webkit-border-radius:0 2px 2px 0;border-radius:0 2px 2px 0;border-left:1px solid #ccc;color:#555;content:attr(title);display:block;font-size:11px;line-height:22px;padding:0 6px;position:relative;right:0;text-align:center;top:0}.wp-color-result:focus,.wp-color-result:hover{background:#fafafa;border-color:#999;color:#23282d}.wp-color-result:focus:after,.wp-color-result:hover:after{color:#23282d;border-color:#a0a5aa;border-left:1px solid #999}.wp-color-result{top:0}.wp-color-result.wp-picker-open:after{content:attr(data-current)}.wp-picker-container,.wp-picker-container:active{display:inline-block;outline:0}.wp-color-result:focus{border-color:#5b9dd9;-webkit-box-shadow:0 0 3px rgba(0,115,170,.8);box-shadow:0 0 3px rgba(0,115,170,.8)}.wp-picker-open+.wp-picker-input-wrap{display:inline-block;vertical-align:top}.wp-picker-container .button{margin-left:6px}.wp-picker-container .iris-square-slider .ui-slider-handle:focus{background-color:#555}.wp-picker-container .iris-picker{-webkit-border-radius:0;border-radius:0;border-color:#dfdfdf;margin-top:6px}.wp-picker-container input[type=text].wp-color-picker{width:65px;font-size:12px;font-family:monospace;text-align:center;line-height:16px;margin:0}.wp-picker-container input[type=text].wp-color-picker:focus::-webkit-input-placeholder{color:transparent}.wp-picker-container input[type=text].wp-color-picker:-moz-placeholder{color:#999}.wp-picker-container input[type=text].iris-error{background-color:#ffebe8;border-color:#c00;color:#000}
--- a/wp-admin/css/colors/blue/colors-rtl.css
+++ b/wp-admin/css/colors/blue/colors-rtl.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #096484;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #bd831f;
  text-shadow: 0 -1px 1px #bd831f, -1px 0 1px #bd831f, 0 1px 1px #bd831f, 1px 0 1px #bd831f;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #e3af55;
  border-color: #bd831f;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #bd831f;
  box-shadow: 0 1px 0 #bd831f;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #d39323, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #d39323, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #d39323;
  border-color: #bd831f;
  -webkit-box-shadow: inset 0 2px 0 #bd831f;
  box-shadow: inset 0 2px 0 #bd831f;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #d1cdc7 !important;
  background: #db9925 !important;
  border-color: #bd831f !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #bd831f !important;
  box-shadow: 0 2px 0 #bd831f !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #bd831f !important;
  box-shadow: inset 0 3px 0 #bd831f !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #fff;
  background-color: #52accc;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #52accc;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #096484;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #096484;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #e1a948;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #e1a948;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #e5f8ff;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #e2ecf1;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #fff;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -539,4 +523,4 @@ div#wp-responsive-toggle a:before {
 .mce-container.mce-menu .mce-menu-item-normal.mce-active,
 .mce-container.mce-menu .mce-menu-item-preview.mce-active {
  background: #096484;
-}
+}
--- a/wp-admin/css/colors/blue/colors-rtl.min.css
+++ b/wp-admin/css/colors/blue/colors-rtl.min.css
--- a/wp-admin/css/colors/blue/colors.css
+++ b/wp-admin/css/colors/blue/colors.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #096484;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #bd831f;
  text-shadow: 0 -1px 1px #bd831f, 1px 0 1px #bd831f, 0 1px 1px #bd831f, -1px 0 1px #bd831f;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #e3af55;
  border-color: #bd831f;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #bd831f;
  box-shadow: 0 1px 0 #bd831f;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #d39323, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #d39323, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #d39323;
  border-color: #bd831f;
  -webkit-box-shadow: inset 0 2px 0 #bd831f;
  box-shadow: inset 0 2px 0 #bd831f;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #d1cdc7 !important;
  background: #db9925 !important;
  border-color: #bd831f !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #bd831f !important;
  box-shadow: 0 2px 0 #bd831f !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #bd831f !important;
  box-shadow: inset 0 3px 0 #bd831f !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #fff;
  background-color: #52accc;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #52accc;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #096484;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #096484;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #e1a948;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #e1a948;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #e5f8ff;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #e2ecf1;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #fff;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -539,4 +523,4 @@ div#wp-responsive-toggle a:before {
 .mce-container.mce-menu .mce-menu-item-normal.mce-active,
 .mce-container.mce-menu .mce-menu-item-preview.mce-active {
  background: #096484;
-}
+}
--- a/wp-admin/css/colors/blue/colors.min.css
+++ b/wp-admin/css/colors/blue/colors.min.css
--- a/wp-admin/css/colors/coffee/colors-rtl.css
+++ b/wp-admin/css/colors/coffee/colors-rtl.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #59524c;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #ae7d55;
  text-shadow: 0 -1px 1px #ae7d55, -1px 0 1px #ae7d55, 0 1px 1px #ae7d55, 1px 0 1px #ae7d55;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #ccad93;
  border-color: #ae7d55;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #ae7d55;
  box-shadow: 0 1px 0 #ae7d55;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #b78b66, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #b78b66, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #b78b66;
  border-color: #ae7d55;
  -webkit-box-shadow: inset 0 2px 0 #ae7d55;
  box-shadow: inset 0 2px 0 #ae7d55;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #d1ccc7 !important;
  background: #ba906d !important;
  border-color: #ae7d55 !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #ae7d55 !important;
  box-shadow: 0 2px 0 #ae7d55 !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #ae7d55 !important;
  box-shadow: inset 0 3px 0 #ae7d55 !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #fff;
  background-color: #59524c;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #59524c;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #c7a589;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #c7a589;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #9ea476;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #9ea476;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #f3f2f1;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #cdcbc9;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #fff;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -539,4 +523,4 @@ div#wp-responsive-toggle a:before {
 .mce-container.mce-menu .mce-menu-item-normal.mce-active,
 .mce-container.mce-menu .mce-menu-item-preview.mce-active {
  background: #c7a589;
-}
+}
--- a/wp-admin/css/colors/coffee/colors-rtl.min.css
+++ b/wp-admin/css/colors/coffee/colors-rtl.min.css
--- a/wp-admin/css/colors/coffee/colors.css
+++ b/wp-admin/css/colors/coffee/colors.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #59524c;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #ae7d55;
  text-shadow: 0 -1px 1px #ae7d55, 1px 0 1px #ae7d55, 0 1px 1px #ae7d55, -1px 0 1px #ae7d55;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #ccad93;
  border-color: #ae7d55;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #ae7d55;
  box-shadow: 0 1px 0 #ae7d55;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #b78b66, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #b78b66, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #b78b66;
  border-color: #ae7d55;
  -webkit-box-shadow: inset 0 2px 0 #ae7d55;
  box-shadow: inset 0 2px 0 #ae7d55;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #d1ccc7 !important;
  background: #ba906d !important;
  border-color: #ae7d55 !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #ae7d55 !important;
  box-shadow: 0 2px 0 #ae7d55 !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #ae7d55 !important;
  box-shadow: inset 0 3px 0 #ae7d55 !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #fff;
  background-color: #59524c;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #59524c;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #c7a589;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #c7a589;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #9ea476;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #9ea476;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #f3f2f1;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #cdcbc9;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #fff;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -539,4 +523,4 @@ div#wp-responsive-toggle a:before {
 .mce-container.mce-menu .mce-menu-item-normal.mce-active,
 .mce-container.mce-menu .mce-menu-item-preview.mce-active {
  background: #c7a589;
-}
+}
--- a/wp-admin/css/colors/coffee/colors.min.css
+++ b/wp-admin/css/colors/coffee/colors.min.css
--- a/wp-admin/css/colors/ectoplasm/colors-rtl.css
+++ b/wp-admin/css/colors/ectoplasm/colors-rtl.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #523f6d;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #727f30;
  text-shadow: 0 -1px 1px #727f30, -1px 0 1px #727f30, 0 1px 1px #727f30, 1px 0 1px #727f30;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #a9bd4f;
  border-color: #727f30;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #727f30;
  box-shadow: 0 1px 0 #727f30;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #829237, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #829237, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #829237;
  border-color: #727f30;
  -webkit-box-shadow: inset 0 2px 0 #727f30;
  box-shadow: inset 0 2px 0 #727f30;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #cfd1c7 !important;
  background: #89993a !important;
  border-color: #727f30 !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #727f30 !important;
  box-shadow: 0 2px 0 #727f30 !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #727f30 !important;
  box-shadow: inset 0 3px 0 #727f30 !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #fff;
  background-color: #523f6d;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #523f6d;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #a3b745;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #a3b745;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #d46f15;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #d46f15;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #ece6f6;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #cbc5d3;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #fff;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -539,4 +523,4 @@ div#wp-responsive-toggle a:before {
 .mce-container.mce-menu .mce-menu-item-normal.mce-active,
 .mce-container.mce-menu .mce-menu-item-preview.mce-active {
  background: #a3b745;
-}
+}
--- a/wp-admin/css/colors/ectoplasm/colors-rtl.min.css
+++ b/wp-admin/css/colors/ectoplasm/colors-rtl.min.css
--- a/wp-admin/css/colors/ectoplasm/colors.css
+++ b/wp-admin/css/colors/ectoplasm/colors.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #523f6d;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #727f30;
  text-shadow: 0 -1px 1px #727f30, 1px 0 1px #727f30, 0 1px 1px #727f30, -1px 0 1px #727f30;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #a9bd4f;
  border-color: #727f30;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #727f30;
  box-shadow: 0 1px 0 #727f30;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #829237, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #829237, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #829237;
  border-color: #727f30;
  -webkit-box-shadow: inset 0 2px 0 #727f30;
  box-shadow: inset 0 2px 0 #727f30;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #cfd1c7 !important;
  background: #89993a !important;
  border-color: #727f30 !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #727f30 !important;
  box-shadow: 0 2px 0 #727f30 !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #727f30 !important;
  box-shadow: inset 0 3px 0 #727f30 !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #fff;
  background-color: #523f6d;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #523f6d;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #a3b745;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #a3b745;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #d46f15;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #d46f15;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #ece6f6;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #cbc5d3;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #fff;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -539,4 +523,4 @@ div#wp-responsive-toggle a:before {
 .mce-container.mce-menu .mce-menu-item-normal.mce-active,
 .mce-container.mce-menu .mce-menu-item-preview.mce-active {
  background: #a3b745;
-}
+}
--- a/wp-admin/css/colors/ectoplasm/colors.min.css
+++ b/wp-admin/css/colors/ectoplasm/colors.min.css
--- a/wp-admin/css/colors/light/colors-rtl.css
+++ b/wp-admin/css/colors/light/colors-rtl.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #04a4cc;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #036881;
  text-shadow: 0 -1px 1px #036881, -1px 0 1px #036881, 0 1px 1px #036881, 1px 0 1px #036881;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #04b0db;
  border-color: #036881;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #036881;
  box-shadow: 0 1px 0 #036881;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #037c9a, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #037c9a, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #037c9a;
  border-color: #036881;
  -webkit-box-shadow: inset 0 2px 0 #036881;
  box-shadow: inset 0 2px 0 #036881;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #c7cfd1 !important;
  background: #0384a4 !important;
  border-color: #036881 !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #036881 !important;
  box-shadow: 0 2px 0 #036881 !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #036881 !important;
  box-shadow: inset 0 3px 0 #036881 !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #333;
  background-color: #e5e5e5;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #e5e5e5;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #888;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #888;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #d64e07;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #d64e07;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #999;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #686868;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #333;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -557,4 +541,4 @@ div#wp-responsive-toggle a:before {
 .theme-section.current,
 .theme-filter.current {
  border-bottom-color: #04a4cc;
-}
+}
--- a/wp-admin/css/colors/light/colors-rtl.min.css
+++ b/wp-admin/css/colors/light/colors-rtl.min.css
--- a/wp-admin/css/colors/light/colors.css
+++ b/wp-admin/css/colors/light/colors.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #04a4cc;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #036881;
  text-shadow: 0 -1px 1px #036881, 1px 0 1px #036881, 0 1px 1px #036881, -1px 0 1px #036881;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #04b0db;
  border-color: #036881;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #036881;
  box-shadow: 0 1px 0 #036881;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #037c9a, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #037c9a, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #037c9a;
  border-color: #036881;
  -webkit-box-shadow: inset 0 2px 0 #036881;
  box-shadow: inset 0 2px 0 #036881;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #c7cfd1 !important;
  background: #0384a4 !important;
  border-color: #036881 !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #036881 !important;
  box-shadow: 0 2px 0 #036881 !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #036881 !important;
  box-shadow: inset 0 3px 0 #036881 !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #333;
  background-color: #e5e5e5;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #e5e5e5;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #888;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #888;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #d64e07;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #d64e07;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #999;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #686868;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #333;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -557,4 +541,4 @@ div#wp-responsive-toggle a:before {
 .theme-section.current,
 .theme-filter.current {
  border-bottom-color: #04a4cc;
-}
+}
--- a/wp-admin/css/colors/light/colors.min.css
+++ b/wp-admin/css/colors/light/colors.min.css
--- a/wp-admin/css/colors/midnight/colors-rtl.css
+++ b/wp-admin/css/colors/midnight/colors-rtl.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #e14d43;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #ba281e;
  text-shadow: 0 -1px 1px #ba281e, -1px 0 1px #ba281e, 0 1px 1px #ba281e, 1px 0 1px #ba281e;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #e35950;
  border-color: #ba281e;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #ba281e;
  box-shadow: 0 1px 0 #ba281e;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #d02c21, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #d02c21, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #d02c21;
  border-color: #ba281e;
  -webkit-box-shadow: inset 0 2px 0 #ba281e;
  box-shadow: inset 0 2px 0 #ba281e;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #d1c8c7 !important;
  background: #d92e23 !important;
  border-color: #ba281e !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #ba281e !important;
  box-shadow: 0 2px 0 #ba281e !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #ba281e !important;
  box-shadow: inset 0 3px 0 #ba281e !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #fff;
  background-color: #363b3f;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #363b3f;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #e14d43;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #e14d43;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #69a8bb;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #69a8bb;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #f1f2f3;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #c3c4c5;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #fff;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -539,4 +523,4 @@ div#wp-responsive-toggle a:before {
 .mce-container.mce-menu .mce-menu-item-normal.mce-active,
 .mce-container.mce-menu .mce-menu-item-preview.mce-active {
  background: #e14d43;
-}
+}
--- a/wp-admin/css/colors/midnight/colors-rtl.min.css
+++ b/wp-admin/css/colors/midnight/colors-rtl.min.css
--- a/wp-admin/css/colors/midnight/colors.css
+++ b/wp-admin/css/colors/midnight/colors.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #e14d43;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #ba281e;
  text-shadow: 0 -1px 1px #ba281e, 1px 0 1px #ba281e, 0 1px 1px #ba281e, -1px 0 1px #ba281e;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #e35950;
  border-color: #ba281e;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #ba281e;
  box-shadow: 0 1px 0 #ba281e;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #d02c21, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #d02c21, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #d02c21;
  border-color: #ba281e;
  -webkit-box-shadow: inset 0 2px 0 #ba281e;
  box-shadow: inset 0 2px 0 #ba281e;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #d1c8c7 !important;
  background: #d92e23 !important;
  border-color: #ba281e !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #ba281e !important;
  box-shadow: 0 2px 0 #ba281e !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #ba281e !important;
  box-shadow: inset 0 3px 0 #ba281e !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #fff;
  background-color: #363b3f;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #363b3f;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #e14d43;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #e14d43;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #69a8bb;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #69a8bb;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #f1f2f3;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #c3c4c5;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #fff;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -539,4 +523,4 @@ div#wp-responsive-toggle a:before {
 .mce-container.mce-menu .mce-menu-item-normal.mce-active,
 .mce-container.mce-menu .mce-menu-item-preview.mce-active {
  background: #e14d43;
-}
+}
--- a/wp-admin/css/colors/midnight/colors.min.css
+++ b/wp-admin/css/colors/midnight/colors.min.css
--- a/wp-admin/css/colors/ocean/colors-rtl.css
+++ b/wp-admin/css/colors/ocean/colors-rtl.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #738e96;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #719a74;
  text-shadow: 0 -1px 1px #719a74, -1px 0 1px #719a74, 0 1px 1px #719a74, 1px 0 1px #719a74;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #a7c0a9;
  border-color: #719a74;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #719a74;
  box-shadow: 0 1px 0 #719a74;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #80a583, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #80a583, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #80a583;
  border-color: #719a74;
  -webkit-box-shadow: inset 0 2px 0 #719a74;
  box-shadow: inset 0 2px 0 #719a74;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #c7d1c8 !important;
  background: #86a989 !important;
  border-color: #719a74 !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #719a74 !important;
  box-shadow: 0 2px 0 #719a74 !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #719a74 !important;
  box-shadow: inset 0 3px 0 #719a74 !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #fff;
  background-color: #738e96;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #738e96;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #9ebaa0;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #9ebaa0;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #aa9d88;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #aa9d88;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #f2fcff;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #d5dde0;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #fff;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -539,4 +523,4 @@ div#wp-responsive-toggle a:before {
 .mce-container.mce-menu .mce-menu-item-normal.mce-active,
 .mce-container.mce-menu .mce-menu-item-preview.mce-active {
  background: #9ebaa0;
-}
+}
--- a/wp-admin/css/colors/ocean/colors-rtl.min.css
+++ b/wp-admin/css/colors/ocean/colors-rtl.min.css
--- a/wp-admin/css/colors/ocean/colors.css
+++ b/wp-admin/css/colors/ocean/colors.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #738e96;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #719a74;
  text-shadow: 0 -1px 1px #719a74, 1px 0 1px #719a74, 0 1px 1px #719a74, -1px 0 1px #719a74;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #a7c0a9;
  border-color: #719a74;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #719a74;
  box-shadow: 0 1px 0 #719a74;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #80a583, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #80a583, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #80a583;
  border-color: #719a74;
  -webkit-box-shadow: inset 0 2px 0 #719a74;
  box-shadow: inset 0 2px 0 #719a74;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #c7d1c8 !important;
  background: #86a989 !important;
  border-color: #719a74 !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #719a74 !important;
  box-shadow: 0 2px 0 #719a74 !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #719a74 !important;
  box-shadow: inset 0 3px 0 #719a74 !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #fff;
  background-color: #738e96;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #738e96;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #9ebaa0;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #9ebaa0;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #aa9d88;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #aa9d88;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #f2fcff;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #d5dde0;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #fff;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -539,4 +523,4 @@ div#wp-responsive-toggle a:before {
 .mce-container.mce-menu .mce-menu-item-normal.mce-active,
 .mce-container.mce-menu .mce-menu-item-preview.mce-active {
  background: #9ebaa0;
-}
+}
--- a/wp-admin/css/colors/ocean/colors.min.css
+++ b/wp-admin/css/colors/ocean/colors.min.css
--- a/wp-admin/css/colors/sunrise/colors-rtl.css
+++ b/wp-admin/css/colors/sunrise/colors-rtl.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #dd823b;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #ad5d1e;
  text-shadow: 0 -1px 1px #ad5d1e, -1px 0 1px #ad5d1e, 0 1px 1px #ad5d1e, 1px 0 1px #ad5d1e;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #df8a48;
  border-color: #ad5d1e;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #ad5d1e;
  box-shadow: 0 1px 0 #ad5d1e;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #c36922, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #c36922, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #c36922;
  border-color: #ad5d1e;
  -webkit-box-shadow: inset 0 2px 0 #ad5d1e;
  box-shadow: inset 0 2px 0 #ad5d1e;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #d1cbc7 !important;
  background: #cc6d23 !important;
  border-color: #ad5d1e !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #ad5d1e !important;
  box-shadow: 0 2px 0 #ad5d1e !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #ad5d1e !important;
  box-shadow: inset 0 3px 0 #ad5d1e !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #fff;
  background-color: #cf4944;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #cf4944;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #dd823b;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #dd823b;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #ccaf0b;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #ccaf0b;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #f3f1f1;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #f1c8c7;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #fff;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -539,4 +523,4 @@ div#wp-responsive-toggle a:before {
 .mce-container.mce-menu .mce-menu-item-normal.mce-active,
 .mce-container.mce-menu .mce-menu-item-preview.mce-active {
  background: #dd823b;
-}
+}
--- a/wp-admin/css/colors/sunrise/colors-rtl.min.css
+++ b/wp-admin/css/colors/sunrise/colors-rtl.min.css
--- a/wp-admin/css/colors/sunrise/colors.css
+++ b/wp-admin/css/colors/sunrise/colors.css
@@ -10,7 +10,6 @@ html {
 a {
  color: #0073aa;
 }
-
 a:hover, a:active, a:focus {
  color: #0096dd;
 }
@@ -31,8 +30,8 @@ input[type=radio]:checked:before {
  background: #dd823b;
 }

-.wp-core-ui input[type="reset"]:hover,
-.wp-core-ui input[type="reset"]:active {
+.wp-core-ui input[type=reset]:hover,
+.wp-core-ui input[type=reset]:active {
  color: #0096dd;
 }

@@ -45,7 +44,6 @@ input[type=radio]:checked:before {
  box-shadow: 0 1px 0 #ad5d1e;
  text-shadow: 0 -1px 1px #ad5d1e, 1px 0 1px #ad5d1e, 0 1px 1px #ad5d1e, -1px 0 1px #ad5d1e;
 }
-
 .wp-core-ui .button-primary:hover, .wp-core-ui .button-primary:focus {
  background: #df8a48;
  border-color: #ad5d1e;
@@ -53,63 +51,51 @@ input[type=radio]:checked:before {
  -webkit-box-shadow: 0 1px 0 #ad5d1e;
  box-shadow: 0 1px 0 #ad5d1e;
 }
-
 .wp-core-ui .button-primary:focus {
  -webkit-box-shadow: inset 0 1px 0 #c36922, 0 0 2px 1px #33b3db;
  box-shadow: inset 0 1px 0 #c36922, 0 0 2px 1px #33b3db;
 }
-
 .wp-core-ui .button-primary:active {
  background: #c36922;
  border-color: #ad5d1e;
  -webkit-box-shadow: inset 0 2px 0 #ad5d1e;
  box-shadow: inset 0 2px 0 #ad5d1e;
 }
-
 .wp-core-ui .button-primary[disabled], .wp-core-ui .button-primary:disabled, .wp-core-ui .button-primary.button-primary-disabled, .wp-core-ui .button-primary.disabled {
  color: #d1cbc7 !important;
  background: #cc6d23 !important;
  border-color: #ad5d1e !important;
  text-shadow: none !important;
 }
-
 .wp-core-ui .button-primary.button-hero {
  -webkit-box-shadow: 0 2px 0 #ad5d1e !important;
  box-shadow: 0 2px 0 #ad5d1e !important;
 }
-
 .wp-core-ui .button-primary.button-hero:active {
  -webkit-box-shadow: inset 0 3px 0 #ad5d1e !important;
  box-shadow: inset 0 3px 0 #ad5d1e !important;
 }
-
 .wp-core-ui .wp-ui-primary {
  color: #fff;
  background-color: #cf4944;
 }
-
 .wp-core-ui .wp-ui-text-primary {
  color: #cf4944;
 }
-
 .wp-core-ui .wp-ui-highlight {
  color: #fff;
  background-color: #dd823b;
 }
-
 .wp-core-ui .wp-ui-text-highlight {
  color: #dd823b;
 }
-
 .wp-core-ui .wp-ui-notification {
  color: #fff;
  background-color: #ccaf0b;
 }
-
 .wp-core-ui .wp-ui-text-notification {
  color: #ccaf0b;
 }
-
 .wp-core-ui .wp-ui-text-icon {
  color: #f3f1f1;
 }
@@ -191,7 +177,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu a {
  color: #f1c8c7;
 }
-
 #adminmenu .wp-submenu a:focus, #adminmenu .wp-submenu a:hover,
 #adminmenu .wp-has-current-submenu .wp-submenu a:focus,
 #adminmenu .wp-has-current-submenu .wp-submenu a:hover,
@@ -210,7 +195,6 @@ input[type=radio]:checked:before {
 #adminmenu .wp-has-current-submenu.opensub .wp-submenu li.current a {
  color: #fff;
 }
-
 #adminmenu .wp-submenu li.current a:hover, #adminmenu .wp-submenu li.current a:focus,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:hover,
 #adminmenu a.wp-has-current-submenu:focus + .wp-submenu li.current a:focus,
@@ -539,4 +523,4 @@ div#wp-responsive-toggle a:before {
 .mce-container.mce-menu .mce-menu-item-normal.mce-active,
 .mce-container.mce-menu .mce-menu-item-preview.mce-active {
  background: #dd823b;
-}
+}
--- a/wp-admin/css/colors/sunrise/colors.min.css
+++ b/wp-admin/css/colors/sunrise/colors.min.css
--- a/wp-admin/css/common-rtl.css
+++ b/wp-admin/css/common-rtl.css
@@ -1581,7 +1581,7 @@ form.upgrade .hint {

 .toggle-arrow {
 	background-repeat: no-repeat;
-	background-position: top left;
+	background-position: top right;
 	background-color: transparent;
 	height: 22px;
 	line-height: 22px;
@@ -1589,7 +1589,7 @@ form.upgrade .hint {
 }

 .toggle-arrow-active {
-	background-position: bottom left;
+	background-position: bottom right;
 }

 #screen-options-wrap h5, /* Back-compat for old plugins */
@@ -2248,11 +2248,11 @@ div.star-holder {
 	position: relative;
 	height: 17px;
 	width: 100px;
-	background: url(../images/stars.png?ver=20121108) repeat-x bottom left;
+	background: url(../images/stars.png?ver=20121108) repeat-x bottom right;
 }

 div.star-holder .star-rating {
-	background: url(../images/stars.png?ver=20121108) repeat-x top left;
+	background: url(../images/stars.png?ver=20121108) repeat-x top right;
 	height: 17px;
 	float: right;
 }
@@ -2288,9 +2288,9 @@ div.star-holder .star-rating {
 }

 .rtl .star-rating .star-half {
-	-webkit-transform: rotateY(180deg);
-	-ms-transform: rotateY(180deg);
-	transform: rotateY(180deg);
+	-webkit-transform: rotateY(-180deg);
+	-ms-transform: rotateY(-180deg);
+	transform: rotateY(-180deg);
 }

 .star-rating .star-empty:before {
@@ -3402,7 +3402,7 @@ img {
 	/* Back-compat for pre-3.8 */
 	div.star-holder,
 	div.star-holder .star-rating {
-		background: url(../images/stars-2x.png?ver=20121108) repeat-x bottom left;
+		background: url(../images/stars-2x.png?ver=20121108) repeat-x bottom right;
 		-webkit-background-size: 21px 37px;
 		background-size: 21px 37px;
 	}
--- a/wp-admin/css/customize-controls-rtl.min.css
+++ b/wp-admin/css/customize-controls-rtl.min.css
--- a/wp-admin/css/customize-controls.min.css
+++ b/wp-admin/css/customize-controls.min.css
--- a/wp-admin/css/customize-nav-menus-rtl.min.css
+++ b/wp-admin/css/customize-nav-menus-rtl.min.css
--- a/wp-admin/css/customize-nav-menus.min.css
+++ b/wp-admin/css/customize-nav-menus.min.css
--- a/wp-admin/css/customize-widgets-rtl.min.css
+++ b/wp-admin/css/customize-widgets-rtl.min.css
--- a/wp-admin/css/customize-widgets.min.css
+++ b/wp-admin/css/customize-widgets.min.css
--- a/wp-admin/css/deprecated-media-rtl.css
+++ b/wp-admin/css/deprecated-media-rtl.css
@@ -103,19 +103,19 @@ th {
 /* specific to the image upload form */

 .image-align-none-label {
-	background: url(../images/align-none.png) no-repeat center left;
+	background: url(../images/align-none.png) no-repeat center right;
 }

 .image-align-left-label {
-	background: url(../images/align-left.png) no-repeat center left;
+	background: url(../images/align-left.png) no-repeat center right;
 }

 .image-align-center-label {
-	background: url(../images/align-center.png) no-repeat center left;
+	background: url(../images/align-center.png) no-repeat center right;
 }

 .image-align-right-label {
-	background: url(../images/align-right.png) no-repeat center left;
+	background: url(../images/align-right.png) no-repeat center right;
 }

 tr.image-size td {
--- a/wp-admin/css/deprecated-media-rtl.min.css
+++ b/wp-admin/css/deprecated-media-rtl.min.css
--- a/wp-admin/css/deprecated-media.min.css
+++ b/wp-admin/css/deprecated-media.min.css
--- a/wp-admin/css/edit-rtl.css
+++ b/wp-admin/css/edit-rtl.css
@@ -307,8 +307,8 @@ ul.wp-tab-bar li {
 	max-width: 100%;
 	height: auto;
 	width: auto;
-	background-image: -webkit-linear-gradient(-45deg, #c4c4c4 25%, transparent 25%, transparent 75%, #c4c4c4 75%, #c4c4c4), -webkit-linear-gradient(45deg, #c4c4c4 25%, transparent 25%, transparent 75%, #c4c4c4 75%, #c4c4c4);
-	background-image: linear-gradient(-45deg, #c4c4c4 25%, transparent 25%, transparent 75%, #c4c4c4 75%, #c4c4c4), linear-gradient(45deg, #c4c4c4 25%, transparent 25%, transparent 75%, #c4c4c4 75%, #c4c4c4);
+	background-image: -webkit-linear-gradient(-45deg, #c4c4c4 25%, transparent 25%, transparent 75%, #c4c4c4 75%, #c4c4c4), -webkit-linear-gradient(-45deg, #c4c4c4 25%, transparent 25%, transparent 75%, #c4c4c4 75%, #c4c4c4);
+	background-image: linear-gradient(-45deg, #c4c4c4 25%, transparent 25%, transparent 75%, #c4c4c4 75%, #c4c4c4), linear-gradient(-45deg, #c4c4c4 25%, transparent 25%, transparent 75%, #c4c4c4 75%, #c4c4c4);
 	background-position: 100% 0, 10px 10px;
 	-webkit-background-size: 20px 20px;
 	background-size: 20px 20px;
--- a/wp-admin/css/ie-rtl.min.css
+++ b/wp-admin/css/ie-rtl.min.css
--- a/wp-admin/css/ie.min.css
+++ b/wp-admin/css/ie.min.css
--- a/wp-admin/css/install-rtl.min.css
+++ b/wp-admin/css/install-rtl.min.css
--- a/wp-admin/css/install.min.css
+++ b/wp-admin/css/install.min.css
--- a/wp-admin/css/login-rtl.min.css
+++ b/wp-admin/css/login-rtl.min.css
--- a/wp-admin/css/login.min.css
+++ b/wp-admin/css/login.min.css
--- a/wp-admin/css/press-this-rtl.min.css
+++ b/wp-admin/css/press-this-rtl.min.css
--- a/wp-admin/css/press-this.min.css
+++ b/wp-admin/css/press-this.min.css
--- a/wp-admin/css/wp-admin-rtl.min.css
+++ b/wp-admin/css/wp-admin-rtl.min.css
--- a/wp-admin/css/wp-admin.min.css
+++ b/wp-admin/css/wp-admin.min.css
--- a/wp-admin/custom-background.php
+++ b/wp-admin/custom-background.php
@@ -464,6 +464,7 @@ if ( current_theme_supports( 'custom-background', 'default-color' ) )
 	 * @deprecated 3.5.0
 	 */
 	public function wp_set_background_image() {
+		check_ajax_referer( 'custom-background' );
 		if ( ! current_user_can('edit_theme_options') || ! isset( $_POST['attachment_id'] ) ) exit;
 		$attachment_id = absint($_POST['attachment_id']);
 		/** This filter is documented in wp-admin/includes/media.php */
--- a/wp-admin/custom-header.php
+++ b/wp-admin/custom-header.php
@@ -324,7 +324,7 @@ class Custom_Image_Header {
 		?>
 <script type="text/javascript">
 (function($){
-	var default_color = '<?php echo $default_color; ?>',
+	var default_color = '<?php echo esc_js( $default_color ); ?>',
 		header_text_fields;

 	function pickColor(color) {
--- a/wp-admin/customize.php
+++ b/wp-admin/customize.php
@@ -132,7 +132,7 @@ do_action( 'customize_controls_print_scripts' );
 			<div id="customize-info" class="accordion-section customize-info">
 				<div class="accordion-section-title">
 					<span class="preview-notice"><?php
-						echo sprintf( __( 'You are customizing %s' ), '<strong class="panel-title site-title">' . get_bloginfo( 'name' ) . '</strong>' );
+						echo sprintf( __( 'You are customizing %s' ), '<strong class="panel-title site-title">' . get_bloginfo( 'name', 'display' ) . '</strong>' );
 					?></span>
 					<button class="customize-help-toggle dashicons dashicons-editor-help" aria-expanded="false"><span class="screen-reader-text"><?php _e( 'Help' ); ?></span></button>
 				</div>
--- a/wp-admin/edit-tag-form.php
+++ b/wp-admin/edit-tag-form.php
@@ -79,9 +79,9 @@ do_action( "{$taxonomy}_pre_edit_form", $tag, $taxonomy ); ?>
 <div id="message" class="updated">
 	<p><strong><?php echo $message; ?></strong></p>
 	<?php if ( $wp_http_referer ) { ?>
-	<p><a href="<?php echo esc_url( $wp_http_referer ); ?>"><?php printf( __( '&larr; Back to %s' ), $tax->labels->name ); ?></a></p>
+	<p><a href="<?php echo esc_url( wp_validate_redirect( esc_url_raw( $wp_http_referer ), admin_url( 'term.php?taxonomy=' . $taxonomy ) ) ); ?>"><?php printf( __( '&larr; Back to %s' ), $tax->labels->name ); ?></a></p>
 	<?php } else { ?>
-	<p><a href="<?php echo esc_url( wp_get_referer() ); ?>"><?php printf( __( '&larr; Back to %s' ), $tax->labels->name ); ?></a></p>
+	<p><a href="<?php echo esc_url( wp_validate_redirect( esc_url_raw( wp_get_referer() ), admin_url( 'term.php?taxonomy=' . $taxonomy ) ) ); ?>"><?php printf( __( '&larr; Back to %s' ), $tax->labels->name ); ?></a></p>
 	<?php } ?>
 </div>
 <?php endif; ?>
--- a/wp-admin/freedoms.php
+++ b/wp-admin/freedoms.php
@@ -19,7 +19,7 @@ include( ABSPATH . 'wp-admin/admin-header.php' );

 <h1><?php printf( __( 'Welcome to WordPress %s' ), $display_version ); ?></h1>

-<div class="about-text"><?php printf( __( 'Thank you for updating! WordPress %s makes it even easier to format your content and customize your site.' ), $display_version ); ?></div>
+<div class="about-text"><?php printf( __( 'Thank you for updating! WordPress %s makes your site more connected and responsive.' ), $display_version ); ?></div>

 <div class="wp-badge"><?php printf( __( 'Version %s' ), $display_version ); ?></div>

--- a/wp-admin/includes/ajax-actions.php
+++ b/wp-admin/includes/ajax-actions.php
@@ -197,8 +197,10 @@ function wp_ajax_wp_compression_test() {
 			echo $out;
 			wp_die();
 		} elseif ( 'no' == $_GET['test'] ) {
+			check_ajax_referer( 'update_can_compress_scripts' );
 			update_site_option('can_compress_scripts', 0);
 		} elseif ( 'yes' == $_GET['test'] ) {
+			check_ajax_referer( 'update_can_compress_scripts' );
 			update_site_option('can_compress_scripts', 1);
 		}
 	}
@@ -1005,6 +1007,8 @@ function wp_ajax_replyto_comment( $action ) {
 			if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {
 				kses_remove_filters(); // start with a clean slate
 				kses_init_filters(); // set up the filters
+				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+				add_filter( 'pre_comment_content', 'wp_filter_kses' );
 			}
 		}
 	} else {
@@ -1992,7 +1996,7 @@ function wp_ajax_upload_attachment() {
 			'success' => false,
 			'data'    => array(
 				'message'  => __( 'You do not have permission to upload files.' ),
-				'filename' => $_FILES['async-upload']['name'],
+				'filename' => esc_html( $_FILES['async-upload']['name'] ),
 			)
 		) );

@@ -2006,7 +2010,7 @@ function wp_ajax_upload_attachment() {
 				'success' => false,
 				'data'    => array(
 					'message'  => __( "You don't have permission to attach files to this post." ),
-					'filename' => $_FILES['async-upload']['name'],
+					'filename' => esc_html( $_FILES['async-upload']['name'] ),
 				)
 			) );

@@ -2016,7 +2020,11 @@ function wp_ajax_upload_attachment() {
 		$post_id = null;
 	}

-	$post_data = isset( $_REQUEST['post_data'] ) ? $_REQUEST['post_data'] : array();
+	$post_data = ! empty( $_REQUEST['post_data'] ) ? _wp_get_allowed_postdata( _wp_translate_postdata( false, (array) $_REQUEST['post_data'] ) ) : array();
+
+	if ( is_wp_error( $post_data ) ) {
+		wp_die( $post_data->get_error_message() );
+	}

 	// If the context is custom header or background, make sure the uploaded file is an image.
 	if ( isset( $post_data['context'] ) && in_array( $post_data['context'], array( 'custom-header', 'custom-background' ) ) ) {
@@ -2026,7 +2034,7 @@ function wp_ajax_upload_attachment() {
 				'success' => false,
 				'data'    => array(
 					'message'  => __( 'The uploaded file is not a valid image. Please try again.' ),
-					'filename' => $_FILES['async-upload']['name'],
+					'filename' => esc_html( $_FILES['async-upload']['name'] ),
 				)
 			) );

@@ -2041,7 +2049,7 @@ function wp_ajax_upload_attachment() {
 			'success' => false,
 			'data'    => array(
 				'message'  => $attachment_id->get_error_message(),
-				'filename' => $_FILES['async-upload']['name'],
+				'filename' => esc_html( $_FILES['async-upload']['name'] ),
 			)
 		) );

@@ -2752,7 +2760,7 @@ function wp_ajax_get_revision_diffs() {
 	if ( ! $post = get_post( (int) $_REQUEST['post_id'] ) )
 		wp_send_json_error();

-	if ( ! current_user_can( 'read_post', $post->ID ) )
+	if ( ! current_user_can( 'edit_post', $post->ID ) )
 		wp_send_json_error();

 	// Really just pre-loading the cache here.
@@ -3308,6 +3316,8 @@ function wp_ajax_save_wporg_username() {
 		wp_send_json_error();
 	}

+	check_ajax_referer( 'save_wporg_username_' . get_current_user_id() );
+
 	$username = isset( $_REQUEST['username'] ) ? wp_unslash( $_REQUEST['username'] ) : false;

 	if ( ! $username ) {
--- a/wp-admin/includes/class-wp-filesystem-ftpext.php
+++ b/wp-admin/includes/class-wp-filesystem-ftpext.php
@@ -326,16 +326,14 @@ class WP_Filesystem_FTPext extends WP_Filesystem_Base {
 	 * @param string $file
 	 * @return bool
 	 */
-	public function exists( $file ) {
-		$path = dirname( $file );
-		$filename = basename( $file );
+	public function exists($file) {
+		$list = @ftp_nlist($this->link, $file);

-		$file_list = @ftp_nlist( $this->link, '-a ' . $path );
-		if ( $file_list ) {
-			$file_list = array_map( 'basename', $file_list );
+		if ( empty( $list ) && $this->is_dir( $file ) ) {
+			return true; // File is an empty directory.
 		}

-		return $file_list && in_array( $filename, $file_list );
+		return !empty($list); //empty list = no file, so invert.
 	}

 	/**
--- a/wp-admin/includes/class-wp-filesystem-ftpsockets.php
+++ b/wp-admin/includes/class-wp-filesystem-ftpsockets.php
@@ -342,7 +342,7 @@ class WP_Filesystem_ftpsockets extends WP_Filesystem_Base {
 	 * @return bool
 	 */
 	public function exists( $file ) {
-		$list = $this->ftp->rawlist( $file, '-a' );
+		$list = $this->ftp->nlist( $file );

 		if ( empty( $list ) && $this->is_dir( $file ) ) {
 			return true; // File is an empty directory.
--- a/wp-admin/includes/class-wp-list-table.php
+++ b/wp-admin/includes/class-wp-list-table.php
@@ -1036,38 +1036,6 @@ class WP_List_Table {
 		return count( $columns ) - count( $hidden );
 	}

-	/**
-	 * If 'orderby' is set, return it.
-	 *
-	 * @access protected
-	 * @since 4.4.0
-	 *
-	 * @return string The value of 'orderby' or empty string.
-	 */
-	protected function get_orderby() {
-		if ( isset( $_GET['orderby'] ) ) {
-			return $_GET['orderby'];
-		}
-
-		return '';
-	}
-
-	/**
-	 * If 'order' is 'desc', return it. Else return 'asc'.
-	 *
-	 * @access protected
-	 * @since 4.4.0
-	 *
-	 * @return string 'desc' or 'asc'.
-	 */
-	protected function get_order() {
-		if ( isset( $_GET['order'] ) && 'desc' === $_GET['order'] ) {
-			return 'desc';
-		}
-
-		return 'asc';
-	}
-
 	/**
 	 * Print column headers, accounting for hidden and sortable columns.
 	 *
@@ -1084,8 +1052,17 @@ class WP_List_Table {
 		$current_url = set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
 		$current_url = remove_query_arg( 'paged', $current_url );

-		$current_orderby = $this->get_orderby();
-		$current_order = $this->get_order();
+		if ( isset( $_GET['orderby'] ) ) {
+			$current_orderby = $_GET['orderby'];
+		} else {
+			$current_orderby = '';
+		}
+
+		if ( isset( $_GET['order'] ) && 'desc' === $_GET['order'] ) {
+			$current_order = 'desc';
+		} else {
+			$current_order = 'asc';
+		}

 		if ( ! empty( $columns['cb'] ) ) {
 			static $cb_counter = 1;
--- a/wp-admin/includes/class-wp-media-list-table.php
+++ b/wp-admin/includes/class-wp-media-list-table.php
@@ -392,7 +392,7 @@ class WP_Media_List_Table extends WP_List_Table {
 			<span class="screen-reader-text"><?php _e( 'File name:' ); ?> </span>
 			<?php
 			$file = get_attached_file( $post->ID );
-			echo wp_basename( $file );
+			echo esc_html( wp_basename( $file ) );
 			?>
 		</p>
 		<?php
--- a/wp-admin/includes/class-wp-plugin-install-list-table.php
+++ b/wp-admin/includes/class-wp-plugin-install-list-table.php
@@ -170,8 +170,13 @@ class WP_Plugin_Install_List_Table extends WP_List_Table {
 				break;

 			case 'favorites':
-				$user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
-				update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
+				$action = 'save_wporg_username_' . get_current_user_id();
+				if ( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( wp_unslash( $_GET['_wpnonce'] ), $action ) ) {
+					$user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
+					update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
+				} else {
+					$user = get_user_option( 'wporg_favorites' );
+				}
 				if ( $user )
 					$args['user'] = $user;
 				else
--- a/wp-admin/includes/class-wp-plugins-list-table.php
+++ b/wp-admin/includes/class-wp-plugins-list-table.php
@@ -550,16 +550,16 @@ class WP_Plugins_List_Table extends WP_List_Table {
 				if ( $is_active ) {
 					if ( current_user_can( 'manage_network_plugins' ) ) {
 						/* translators: %s: plugin name */
-						$actions['deactivate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=deactivate&amp;plugin=' . $plugin_file . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'deactivate-plugin_' . $plugin_file ) . '" aria-label="' . esc_attr( sprintf( __( 'Network deactivate %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Network Deactivate' ) . '</a>';
+						$actions['deactivate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=deactivate&amp;plugin=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'deactivate-plugin_' . $plugin_file ) . '" aria-label="' . esc_attr( sprintf( __( 'Network Deactivate %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Network Deactivate' ) . '</a>';
 						}
 				} else {
 					if ( current_user_can( 'manage_network_plugins' ) ) {
 						/* translators: %s: plugin name */
-						$actions['activate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=activate&amp;plugin=' . $plugin_file . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'activate-plugin_' . $plugin_file ) . '" class="edit" aria-label="' . esc_attr( sprintf( __( 'Network Activate %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Network Activate' ) . '</a>';
+						$actions['activate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=activate&amp;plugin=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'activate-plugin_' . $plugin_file ) . '" class="edit" aria-label="' . esc_attr( sprintf( __( 'Network Activate %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Network Activate' ) . '</a>';
 					}
 					if ( current_user_can( 'delete_plugins' ) && ! is_plugin_active( $plugin_file ) ) {
 						/* translators: %s: plugin name */
-						$actions['delete'] = '<a href="' . wp_nonce_url( 'plugins.php?action=delete-selected&amp;checked[]=' . $plugin_file . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'bulk-plugins' ) . '" class="delete" aria-label="' . esc_attr( sprintf( __( 'Delete %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Delete' ) . '</a>';
+						$actions['delete'] = '<a href="' . wp_nonce_url( 'plugins.php?action=delete-selected&amp;checked[]=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'bulk-plugins' ) . '" class="delete" aria-label="' . esc_attr( sprintf( __( 'Delete %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Delete' ) . '</a>';
 					}
 				}
 			} else {
@@ -573,14 +573,14 @@ class WP_Plugins_List_Table extends WP_List_Table {
 					);
 				} elseif ( $is_active ) {
 					/* translators: %s: plugin name */
-					$actions['deactivate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=deactivate&amp;plugin=' . $plugin_file . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'deactivate-plugin_' . $plugin_file ) . '" aria-label="' . esc_attr( sprintf( __( 'Deactivate %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Deactivate' ) . '</a>';
+					$actions['deactivate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=deactivate&amp;plugin=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'deactivate-plugin_' . $plugin_file ) . '" aria-label="' . esc_attr( sprintf( __( 'Deactivate %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Deactivate' ) . '</a>';
 				} else {
 					/* translators: %s: plugin name */
-					$actions['activate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=activate&amp;plugin=' . $plugin_file . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'activate-plugin_' . $plugin_file ) . '" class="edit" aria-label="' . esc_attr( sprintf( __( 'Activate %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Activate' ) . '</a>';
+					$actions['activate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=activate&amp;plugin=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'activate-plugin_' . $plugin_file ) . '" class="edit" aria-label="' . esc_attr( sprintf( __( 'Activate %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Activate' ) . '</a>';

 					if ( ! is_multisite() && current_user_can( 'delete_plugins' ) ) {
 						/* translators: %s: plugin name */
-						$actions['delete'] = '<a href="' . wp_nonce_url( 'plugins.php?action=delete-selected&amp;checked[]=' . $plugin_file . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'bulk-plugins' ) . '" class="delete" aria-label="' . esc_attr( sprintf( __( 'Delete %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Delete' ) . '</a>';
+						$actions['delete'] = '<a href="' . wp_nonce_url( 'plugins.php?action=delete-selected&amp;checked[]=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'bulk-plugins' ) . '" class="delete" aria-label="' . esc_attr( sprintf( __( 'Delete %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Delete' ) . '</a>';
 					}
 				} // end if $is_active

@@ -588,7 +588,7 @@ class WP_Plugins_List_Table extends WP_List_Table {

 			if ( ( ! is_multisite() || $screen->in_admin( 'network' ) ) && current_user_can( 'edit_plugins' ) && is_writable( WP_PLUGIN_DIR . '/' . $plugin_file ) ) {
 				/* translators: %s: plugin name */
-				$actions['edit'] = '<a href="plugin-editor.php?file=' . $plugin_file . '" class="edit" aria-label="' . esc_attr( sprintf( __( 'Edit %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Edit' ) . '</a>';
+				$actions['edit'] = '<a href="plugin-editor.php?file=' . urlencode( $plugin_file ) . '" class="edit" aria-label="' . esc_attr( sprintf( __( 'Edit %s' ), $plugin_data['Name'] ) ) . '">' . __( 'Edit' ) . '</a>';
 			}
 		} // end if $context

--- a/wp-admin/includes/class-wp-posts-list-table.php
+++ b/wp-admin/includes/class-wp-posts-list-table.php
@@ -905,7 +905,7 @@ class WP_Posts_List_Table extends WP_List_Table {
 		}

 		if ( ! is_post_type_hierarchical( $this->screen->post_type ) && 'excerpt' === $mode && current_user_can( 'read_post', $post->ID ) ) {
-			the_excerpt();
+			echo esc_html( get_the_excerpt() );
 		}

 		get_inline_data( $post );
--- a/wp-admin/includes/class-wp-press-this.php
+++ b/wp-admin/includes/class-wp-press-this.php
@@ -119,10 +119,28 @@ class WP_Press_This {
 			'post_type'     => 'post',
 			'post_status'   => 'draft',
 			'post_format'   => ( ! empty( $_POST['post_format'] ) ) ? sanitize_text_field( $_POST['post_format'] ) : '',
-			'tax_input'     => ( ! empty( $_POST['tax_input'] ) ) ? $_POST['tax_input'] : array(),
-			'post_category' => ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array(),
 		);

+		// Only accept categories if the user actually can assign
+		$category_tax = get_taxonomy( 'category' );
+		if ( current_user_can( $category_tax->cap->assign_terms ) ) {
+			$post_data['post_category'] = ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array();
+		}
+
+		// Only accept taxonomies if the user can actually assign
+		if ( ! empty( $_POST['tax_input'] ) ) {
+			$tax_input = $_POST['tax_input'];
+			foreach ( $tax_input as $tax => $_ti ) {
+				$tax_object = get_taxonomy( $tax );
+				if ( ! $tax_object || ! current_user_can( $tax_object->cap->assign_terms ) ) {
+					unset( $tax_input[ $tax ] );
+				}
+			}
+
+			$post_data['tax_input'] = $tax_input;
+		}
+
+		// Toggle status to pending if user cannot actually publish
 		if ( ! empty( $_POST['post_status'] ) && 'publish' === $_POST['post_status'] ) {
 			if ( current_user_can( 'publish_posts' ) ) {
 				$post['post_status'] = 'publish';
@@ -444,7 +462,7 @@ class WP_Press_This {
 	 * @since 4.2.0
 	 *
 	 * @param string $src Embed source URL.
-	 * @return string If not from a supported provider, an empty string. Otherwise, a reformattd embed URL.
+	 * @return string If not from a supported provider, an empty string. Otherwise, a reformatted embed URL.
 	 */
 	private function _limit_embed( $src ) {
 		$src = $this->_limit_url( $src );
@@ -692,7 +710,11 @@ class WP_Press_This {
 			 * making PT fully backward compatible with the older bookmarklet.
 			 */
 			if ( empty( $_POST ) && ! empty( $data['u'] ) ) {
-				$data = $this->source_data_fetch_fallback( $data['u'], $data );
+				if ( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( $_GET['_wpnonce'], 'scan-site' ) ) {
+					$data = $this->source_data_fetch_fallback( $data['u'], $data );
+				} else {
+					$data['errors'] = 'missing nonce';
+				}
 			} else {
 				foreach ( array( '_images', '_embeds' ) as $type ) {
 					if ( empty( $_POST[ $type ] ) ) {
@@ -874,6 +896,12 @@ class WP_Press_This {
 	public function categories_html( $post ) {
 		$taxonomy = get_taxonomy( 'category' );

+		// Bail if user cannot assign terms
+		if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) {
+			return;
+		}
+
+		// Only show "add" if user can edit terms
 		if ( current_user_can( $taxonomy->cap->edit_terms ) ) {
 			?>
 			<button type="button" class="add-cat-toggle button-link" aria-expanded="false">
@@ -1226,7 +1254,7 @@ class WP_Press_This {
 		$site_data = array(
 			'v' => ! empty( $data['v'] ) ? $data['v'] : '',
 			'u' => ! empty( $data['u'] ) ? $data['u'] : '',
-			'hasData' => ! empty( $data ),
+			'hasData' => ! empty( $data ) && ! isset( $data['errors'] ),
 		);

 		if ( ! empty( $images ) ) {
@@ -1287,6 +1315,12 @@ class WP_Press_This {
 		wp_enqueue_script( 'json2' );
 		wp_enqueue_script( 'editor' );

+		$categories_tax   = get_taxonomy( 'category' );
+		$show_categories  = current_user_can( $categories_tax->cap->assign_terms ) || current_user_can( $categories_tax->cap->edit_terms );
+
+		$tag_tax          = get_taxonomy( 'post_tag' );
+		$show_tags        = current_user_can( $tag_tax->cap->assign_terms );
+
 		$supports_formats = false;
 		$post_format      = 0;

@@ -1352,8 +1386,9 @@ class WP_Press_This {
 	<div id="scanbar" class="scan">
 		<form method="GET">
 			<label for="url-scan" class="screen-reader-text"><?php _e( 'Scan site for content' ); ?></label>
-			<input type="url" name="u" id="url-scan" class="scan-url" value="" placeholder="<?php esc_attr_e( 'Enter a URL to scan' ) ?>" />
+			<input type="url" name="u" id="url-scan" class="scan-url" value="<?php echo esc_attr( $site_data['u'] ) ?>" placeholder="<?php esc_attr_e( 'Enter a URL to scan' ) ?>" />
 			<input type="submit" name="url-scan-submit" id="url-scan-submit" class="scan-submit" value="<?php esc_attr_e( 'Scan' ) ?>" />
+			<?php wp_nonce_field( 'scan-site' ); ?>
 		</form>
 	</div>

@@ -1438,17 +1473,21 @@ class WP_Press_This {
 					</button>
 				<?php endif; ?>

-				<button type="button" class="button-link post-option">
-					<span class="dashicons dashicons-category"></span>
-					<span class="post-option-title"><?php _e( 'Categories' ); ?></span>
-					<span class="dashicons post-option-forward"></span>
-				</button>
+				<?php if ( $show_categories ) : ?>
+					<button type="button" class="button-link post-option">
+						<span class="dashicons dashicons-category"></span>
+						<span class="post-option-title"><?php _e( 'Categories' ); ?></span>
+						<span class="dashicons post-option-forward"></span>
+					</button>
+				<?php endif; ?>

-				<button type="button" class="button-link post-option">
-					<span class="dashicons dashicons-tag"></span>
-					<span class="post-option-title"><?php _e( 'Tags' ); ?></span>
-					<span class="dashicons post-option-forward"></span>
-				</button>
+				<?php if ( $show_tags ) : ?>
+					<button type="button" class="button-link post-option">
+						<span class="dashicons dashicons-tag"></span>
+						<span class="post-option-title"><?php _e( 'Tags' ); ?></span>
+						<span class="dashicons post-option-forward"></span>
+					</button>
+				<?php endif; ?>
 			</div>

 			<?php if ( $supports_formats ) : ?>
@@ -1462,23 +1501,27 @@ class WP_Press_This {
 				</div>
 			<?php endif; ?>

-			<div class="setting-modal is-off-screen is-hidden">
-				<button type="button" class="button-link modal-close">
-					<span class="dashicons post-option-back"></span>
-					<span class="setting-title" aria-hidden="true"><?php _e( 'Categories' ); ?></span>
-					<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
-				</button>
-				<?php $this->categories_html( $post ); ?>
-			</div>
+			<?php if ( $show_categories ) : ?>
+				<div class="setting-modal is-off-screen is-hidden">
+					<button type="button" class="button-link modal-close">
+						<span class="dashicons post-option-back"></span>
+						<span class="setting-title" aria-hidden="true"><?php _e( 'Categories' ); ?></span>
+						<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
+					</button>
+					<?php $this->categories_html( $post ); ?>
+				</div>
+			<?php endif; ?>

-			<div class="setting-modal tags is-off-screen is-hidden">
-				<button type="button" class="button-link modal-close">
-					<span class="dashicons post-option-back"></span>
-					<span class="setting-title" aria-hidden="true"><?php _e( 'Tags' ); ?></span>
-					<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
-				</button>
-				<?php $this->tags_html( $post ); ?>
-			</div>
+			<?php if ( $show_tags ) : ?>
+				<div class="setting-modal tags is-off-screen is-hidden">
+					<button type="button" class="button-link modal-close">
+						<span class="dashicons post-option-back"></span>
+						<span class="setting-title" aria-hidden="true"><?php _e( 'Tags' ); ?></span>
+						<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
+					</button>
+					<?php $this->tags_html( $post ); ?>
+				</div>
+			<?php endif; ?>
 		</div><!-- .options-panel -->
 	</div><!-- .wrapper -->

--- a/wp-admin/includes/class-wp-screen.php
+++ b/wp-admin/includes/class-wp-screen.php
@@ -290,7 +290,9 @@ final class WP_Screen {

 			switch ( $base ) {
 				case 'post' :
-					if ( isset( $_GET['post'] ) )
+					if ( isset( $_GET['post'] ) && isset( $_POST['post_ID'] ) && (int) $_GET['post'] !== (int) $_POST['post_ID'] )
+						wp_die( __( 'A post ID mismatch has been detected.' ), __( 'Sorry, you are not allowed to edit this item.' ), 400 );
+					elseif ( isset( $_GET['post'] ) )
 						$post_id = (int) $_GET['post'];
 					elseif ( isset( $_POST['post_ID'] ) )
 						$post_id = (int) $_POST['post_ID'];
@@ -530,7 +532,7 @@ final class WP_Screen {
 			}
 		}

-		sort( $priorities );
+		ksort( $priorities );

 		$sorted = array();
 		foreach ( $priorities as $list ) {
@@ -915,7 +917,8 @@ final class WP_Screen {

 		switch ( $this->base ) {
 			case 'widgets':
-				$this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off">' . __('Disable accessibility mode') . "</a></p>\n";
+				$nonce = wp_create_nonce( 'widgets-access' );
+				$this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on&_wpnonce=' . urlencode( $nonce ) . '">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off&_wpnonce=' . urlencode( $nonce ) . '">' . __('Disable accessibility mode') . "</a></p>\n";
 				break;
 			case 'post' :
 				$expand = '<fieldset class="editor-expand hidden"><legend>' . __( 'Additional settings' ) . '</legend><label for="editor-expand-toggle">';
@@ -998,7 +1001,7 @@ final class WP_Screen {
 		 * Filter whether to show the Screen Options submit button.
 		 *
 		 * @since 4.4.0
-		 * 
+		 *
 		 * @param bool      $show_button Whether to show Screen Options submit button.
 		 *                               Default false.
 		 * @param WP_Screen $this        Current WP_Screen instance.
@@ -1087,7 +1090,7 @@ final class WP_Screen {

 			$id = "$column-hide";
 			echo '<label>';
-			echo '<input class="hide-column-tog" name="' . $id . '" type="checkbox" value="' . $column . '"' . checked( ! in_array( $column, $hidden ), true, false ) . ' />';
+			echo '<input class="hide-column-tog" name="' . $id . '" type="checkbox" id="' . $id . '" value="' . $column . '"' . checked( ! in_array( $column, $hidden ), true, false ) . ' />';
 			echo "$title</label>\n";
 		}
 		?>
--- a/wp-admin/includes/class-wp-upgrader.php
+++ b/wp-admin/includes/class-wp-upgrader.php
@@ -2580,8 +2580,12 @@ class File_Upload_Upgrader {
 			if ( ! ( ( $uploads = wp_upload_dir() ) && false === $uploads['error'] ) )
 				wp_die( $uploads['error'] );

-			$this->filename = $_GET[$urlholder];
+			$this->filename = sanitize_file_name( $_GET[ $urlholder ] );
 			$this->package = $uploads['basedir'] . '/' . $this->filename;
+
+			if ( 0 !== strpos( realpath( $this->package ), realpath( $uploads['basedir'] ) ) ) {
+				wp_die( __( 'Please select a file' ) );
+			}
 		}
 	}

--- a/wp-admin/includes/file.php
+++ b/wp-admin/includes/file.php
@@ -623,6 +623,10 @@ function _unzip_file_ziparchive($file, $to, $needed_dirs = array() ) {
 		if ( '__MACOSX/' === substr($info['name'], 0, 9) ) // Skip the OS X-created __MACOSX directory
 			continue;

+		if ( 0 !== validate_file( $info['name'] ) ) {
+			return new WP_Error( 'invalid_file_ziparchive', __( 'Could not extract file from archive.' ), $info['name'] );
+		}
+
 		$uncompressed_size += $info['size'];

 		if ( '/' == substr($info['name'], -1) ) // directory
@@ -780,6 +784,10 @@ function _unzip_file_pclzip($file, $to, $needed_dirs = array()) {
 		if ( '__MACOSX/' === substr($file['filename'], 0, 9) ) // Don't extract the OS X-created __MACOSX directory files
 			continue;

+		if ( 0 !== validate_file( $file['filename'] ) ) {
+			return new WP_Error( 'invalid_file_pclzip', __( 'Could not extract file from archive.' ), $file['filename'] );
+		}
+
 		if ( ! $wp_filesystem->put_contents( $to . $file['filename'], $file['content'], FS_CHMOD_FILE) )
 			return new WP_Error( 'copy_failed_pclzip', __( 'Could not copy file.' ), $file['filename'] );
 	}
@@ -1060,14 +1068,28 @@ function request_filesystem_credentials($form_post, $type = '', $error = false,

 	$credentials = get_option('ftp_credentials', array( 'hostname' => '', 'username' => ''));

+	$submitted_form = wp_unslash( $_POST );
+
+	// Verify nonce, or unset submitted form field values on failure
+	if ( ! isset( $_POST['_fs_nonce'] ) || ! wp_verify_nonce( $_POST['_fs_nonce'], 'filesystem-credentials' ) ) {
+		unset(
+			$submitted_form['hostname'],
+			$submitted_form['username'],
+			$submitted_form['password'],
+			$submitted_form['public_key'],
+			$submitted_form['private_key'],
+			$submitted_form['connection_type']
+		);
+	}
+
 	// If defined, set it to that, Else, If POST'd, set it to that, If not, Set it to whatever it previously was(saved details in option)
-	$credentials['hostname'] = defined('FTP_HOST') ? FTP_HOST : (!empty($_POST['hostname']) ? wp_unslash( $_POST['hostname'] ) : $credentials['hostname']);
-	$credentials['username'] = defined('FTP_USER') ? FTP_USER : (!empty($_POST['username']) ? wp_unslash( $_POST['username'] ) : $credentials['username']);
-	$credentials['password'] = defined('FTP_PASS') ? FTP_PASS : (!empty($_POST['password']) ? wp_unslash( $_POST['password'] ) : '');
+	$credentials['hostname'] = defined('FTP_HOST') ? FTP_HOST : (!empty($submitted_form['hostname']) ? $submitted_form['hostname'] : $credentials['hostname']);
+	$credentials['username'] = defined('FTP_USER') ? FTP_USER : (!empty($submitted_form['username']) ? $submitted_form['username'] : $credentials['username']);
+	$credentials['password'] = defined('FTP_PASS') ? FTP_PASS : (!empty($submitted_form['password']) ? $submitted_form['password'] : '');

 	// Check to see if we are setting the public/private keys for ssh
-	$credentials['public_key'] = defined('FTP_PUBKEY') ? FTP_PUBKEY : (!empty($_POST['public_key']) ? wp_unslash( $_POST['public_key'] ) : '');
-	$credentials['private_key'] = defined('FTP_PRIKEY') ? FTP_PRIKEY : (!empty($_POST['private_key']) ? wp_unslash( $_POST['private_key'] ) : '');
+	$credentials['public_key'] = defined('FTP_PUBKEY') ? FTP_PUBKEY : (!empty($submitted_form['public_key']) ? $submitted_form['public_key'] : '');
+	$credentials['private_key'] = defined('FTP_PRIKEY') ? FTP_PRIKEY : (!empty($submitted_form['private_key']) ? $submitted_form['private_key'] : '');

 	// Sanitize the hostname, Some people might pass in odd-data:
 	$credentials['hostname'] = preg_replace('|\w+://|', '', $credentials['hostname']); //Strip any schemes off
@@ -1084,8 +1106,8 @@ function request_filesystem_credentials($form_post, $type = '', $error = false,
 		$credentials['connection_type'] = 'ssh';
 	} elseif ( ( defined( 'FTP_SSL' ) && FTP_SSL ) && 'ftpext' == $type ) { //Only the FTP Extension understands SSL
 		$credentials['connection_type'] = 'ftps';
-	} elseif ( ! empty( $_POST['connection_type'] ) ) {
-		$credentials['connection_type'] = wp_unslash( $_POST['connection_type'] );
+	} elseif ( ! empty( $submitted_form['connection_type'] ) ) {
+		$credentials['connection_type'] = $submitted_form['connection_type'];
 	} elseif ( ! isset( $credentials['connection_type'] ) ) { //All else fails (And it's not defaulted to something else saved), Default to FTP
 		$credentials['connection_type'] = 'ftp';
 	}
@@ -1227,11 +1249,12 @@ echo "<$heading_tag id='request-filesystem-credentials-title'>" . __( 'Connectio
 </fieldset>
 <?php
 foreach ( (array) $extra_fields as $field ) {
-	if ( isset( $_POST[ $field ] ) )
-		echo '<input type="hidden" name="' . esc_attr( $field ) . '" value="' . esc_attr( wp_unslash( $_POST[ $field ] ) ) . '" />';
+	if ( isset( $submitted_form[ $field ] ) )
+		echo '<input type="hidden" name="' . esc_attr( $field ) . '" value="' . esc_attr( $submitted_form[ $field ] ) . '" />';
 }
 ?>
 	<p class="request-filesystem-credentials-action-buttons">
+		<?php wp_nonce_field( 'filesystem-credentials', '_fs_nonce', false, true ); ?>
 		<button class="button cancel-button" data-js-action="close" type="button"><?php _e( 'Cancel' ); ?></button>
 		<?php submit_button( __( 'Proceed' ), 'button', 'upgrade', false ); ?>
 	</p>
--- a/wp-admin/includes/image.php
+++ b/wp-admin/includes/image.php
@@ -408,12 +408,14 @@ function wp_read_image_metadata( $file ) {
 		}
 	}

-	foreach ( $meta as &$value ) {
-		if ( is_string( $value ) ) {
-			$value = wp_kses_post( $value );
+	foreach ( $meta['keywords'] as $key => $keyword ) {
+		if ( ! seems_utf8( $keyword ) ) {
+			$meta['keywords'][ $key ] = utf8_encode( $keyword );
 		}
 	}

+	$meta = wp_kses_post_deep( $meta );
+
 	/**
 	 * Filter the array of meta data read from an image's exif data.
 	 *
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -286,7 +286,7 @@ function media_handle_upload($file_id, $post_id, $post_data = array(), $override
 	$url = $file['url'];
 	$type = $file['type'];
 	$file = $file['file'];
-	$title = $name;
+	$title = sanitize_text_field( $name );
 	$content = '';
 	$excerpt = '';

@@ -460,7 +460,7 @@ wp_enqueue_style( 'ie' );
 ?>
 <script type="text/javascript">
 addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
 isRtl = <?php echo (int) is_rtl(); ?>;
 </script>
 <?php
@@ -2781,8 +2781,11 @@ function edit_form_image_editor( $post ) {
 	<label for="attachment_content"><strong><?php _e( 'Description' ); ?></strong><?php
 	if ( preg_match( '#^(audio|video)/#', $post->post_mime_type ) ) {
 		echo ': ' . __( 'Displayed on attachment pages.' );
-	} ?></label>
-	<?php wp_editor( $post->post_content, 'attachment_content', $editor_args ); ?>
+	}
+
+	?>
+	</label>
+	<?php wp_editor( format_to_edit( $post->post_content ), 'attachment_content', $editor_args ); ?>

 	</div>
 	<?php
@@ -2938,7 +2941,7 @@ function wp_add_id3_tag_data( &$metadata, $data ) {
 		if ( ! empty( $data[$version]['comments'] ) ) {
 			foreach ( $data[$version]['comments'] as $key => $list ) {
 				if ( 'length' !== $key && ! empty( $list ) ) {
-					$metadata[$key] = reset( $list );
+					$metadata[$key] = wp_kses_post( reset( $list ) );
 					// Fix bug in byte stream analysis.
 					if ( 'terms_of_use' === $key && 0 === strpos( $metadata[$key], 'yright notice.' ) )
 						$metadata[$key] = 'Cop' . $metadata[$key];
--- a/wp-admin/includes/misc.php
+++ b/wp-admin/includes/misc.php
@@ -436,24 +436,48 @@ function set_screen_options() {
 					return;
 				break;
 			default:
+				$screen_option = false;
+
+				if ( '_page' === substr( $option, -5 ) || 'layout_columns' === $option ) {
+					/**
+					 * Filters a screen option value before it is set.
+					 *
+					 * The filter can also be used to modify non-standard [items]_per_page
+					 * settings. See the parent function for a full list of standard options.
+					 *
+					 * Returning false to the filter will skip saving the current option.
+					 *
+					 * @since 2.8.0
+					 * @since 5.4.2 Only applied to options ending with '_page',
+					 *              or the 'layout_columns' option.
+					 *
+					 * @see set_screen_options()
+					 *
+					 * @param mixed  $screen_option The value to save instead of the option value.
+					 *                              Default false (to skip saving the current option).
+					 * @param string $option        The option name.
+					 * @param int    $value         The option value.
+					 */
+					$screen_option = apply_filters( 'set-screen-option', $screen_option, $option, $value ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+				}

 				/**
 				 * Filter a screen option value before it is set.
 				 *
-				 * The filter can also be used to modify non-standard [items]_per_page
-				 * settings. See the parent function for a full list of standard options.
+				 * The dynamic portion of the hook, `$option`, refers to the option name.
 				 *
 				 * Returning false to the filter will skip saving the current option.
 				 *
-				 * @since 2.8.0
+				 * @since 5.4.2
 				 *
 				 * @see set_screen_options()
 				 *
-				 * @param bool|int $value  Screen option value. Default false to skip.
-				 * @param string   $option The option name.
-				 * @param int      $value  The number of rows to use.
+				 * @param mixed   $screen_option The value to save instead of the option value.
+				 *                               Default false (to skip saving the current option).
+				 * @param string  $option        The option name.
+				 * @param int     $value         The option value.
 				 */
-				$value = apply_filters( 'set-screen-option', false, $option, $value );
+				$value = apply_filters( "set_screen_option_{$option}", $screen_option, $option, $value );

 				if ( false === $value )
 					return;
--- a/wp-admin/includes/ms.php
+++ b/wp-admin/includes/ms.php
@@ -975,7 +975,7 @@ function can_edit_network( $site_id ) {
 function _thickbox_path_admin_subfolder() {
 ?>
 <script type="text/javascript">
-var tb_pathToImage = "<?php echo includes_url( 'js/thickbox/loadingAnimation.gif', 'relative' ); ?>";
+var tb_pathToImage = "<?php echo esc_js( includes_url( 'js/thickbox/loadingAnimation.gif', 'relative' ) ); ?>";
 </script>
 <?php
 }
--- a/wp-admin/includes/plugin-install.php
+++ b/wp-admin/includes/plugin-install.php
@@ -300,7 +300,8 @@ function install_plugins_upload() {
 *
 */
 function install_plugins_favorites_form() {
-	$user = ! empty( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
+	$user   = get_user_option( 'wporg_favorites' );
+	$action = 'save_wporg_username_' . get_current_user_id();
 	?>
 	<p class="install-help"><?php _e( 'If you have marked plugins as favorites on WordPress.org, you can browse them here.' ); ?></p>
 	<form method="get">
@@ -309,6 +310,7 @@ function install_plugins_favorites_form() {
 			<label for="user"><?php _e( 'Your WordPress.org username:' ); ?></label>
 			<input type="search" id="user" name="user" value="<?php echo esc_attr( $user ); ?>" />
 			<input type="submit" class="button" value="<?php esc_attr_e( 'Get Favorites' ); ?>" />
+			<input type="hidden" id="wporg-username-nonce" name="_wpnonce" value="<?php echo esc_attr( wp_create_nonce( $action ) ); ?>" /> 
 		</p>
 	</form>
 	<?php
--- a/wp-admin/includes/post.php
+++ b/wp-admin/includes/post.php
@@ -165,9 +165,37 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
 		$post_data['post_date_gmt'] = get_gmt_from_date( $post_data['post_date'] );
 	}

+	if ( isset( $post_data['post_category'] ) ) {
+		$category_object = get_taxonomy( 'category' );
+		if ( ! current_user_can( $category_object->cap->assign_terms ) ) {
+			unset( $post_data['post_category'] );
+		}
+	}
+
 	return $post_data;
 }

+/**
+ * Returns only allowed post data fields
+ *
+ * @since 4.9.9
+ *
+ * @param array $post_data Array of post data. Defaults to the contents of $_POST.
+ * @return object|bool WP_Error on failure, true on success.
+ */
+function _wp_get_allowed_postdata( $post_data = null ) {
+	if ( empty( $post_data ) ) {
+		$post_data = $_POST;
+	}
+
+	// Pass through errors
+	if ( is_wp_error( $post_data ) ) {
+		return $post_data;
+	}
+
+	return array_diff_key( $post_data, array_flip( array( 'meta_input', 'file', 'guid' ) ) );
+}
+
 /**
 * Update an existing post with values provided in $_POST.
 *
@@ -236,6 +264,7 @@ function edit_post( $post_data = null ) {
 	$post_data = _wp_translate_postdata( true, $post_data );
 	if ( is_wp_error($post_data) )
 		wp_die( $post_data->get_error_message() );
+	$translated = _wp_get_allowed_postdata( $post_data );

 	// Post Formats
 	if ( isset( $post_data['post_format'] ) )
@@ -313,7 +342,7 @@ function edit_post( $post_data = null ) {
 		$attachment_data = isset( $post_data['attachments'][ $post_ID ] ) ? $post_data['attachments'][ $post_ID ] : array();

 		/** This filter is documented in wp-admin/includes/media.php */
-		$post_data = apply_filters( 'attachment_fields_to_save', $post_data, $attachment_data );
+		$translated = apply_filters( 'attachment_fields_to_save', $translated, $attachment_data );
 	}

 	// Convert taxonomy input to term IDs, to avoid ambiguity.
@@ -358,7 +387,7 @@ function edit_post( $post_data = null ) {
 				}
 			}

-			$post_data['tax_input'][ $taxonomy ] = $clean_terms;
+			$translated['tax_input'][ $taxonomy ] = $clean_terms;
 		}
 	}

@@ -366,18 +395,18 @@ function edit_post( $post_data = null ) {

 	update_post_meta( $post_ID, '_edit_last', get_current_user_id() );

-	$success = wp_update_post( $post_data );
+	$success = wp_update_post( $translated );
 	// If the save failed, see if we can sanity check the main fields and try again
 	if ( ! $success && is_callable( array( $wpdb, 'strip_invalid_text_for_column' ) ) ) {
 		$fields = array( 'post_title', 'post_content', 'post_excerpt' );

 		foreach ( $fields as $field ) {
-			if ( isset( $post_data[ $field ] ) ) {
-				$post_data[ $field ] = $wpdb->strip_invalid_text_for_column( $wpdb->posts, $field, $post_data[ $field ] );
+			if ( isset( $translated[ $field ] ) ) {
+				$translated[ $field ] = $wpdb->strip_invalid_text_for_column( $wpdb->posts, $field, $translated[ $field ] );
 			}
 		}

-		wp_update_post( $post_data );
+		wp_update_post( $translated );
 	}

 	// Now that we have an ID we can fix any attachment anchor hrefs
@@ -537,9 +566,9 @@ function bulk_edit_posts( $post_data = null ) {
 			unset( $post_data['tax_input']['category'] );
 		}

+		$post_data['post_ID']        = $post_ID;
 		$post_data['post_type'] = $post->post_type;
 		$post_data['post_mime_type'] = $post->post_mime_type;
-		$post_data['guid'] = $post->guid;

 		foreach ( array( 'comment_status', 'ping_status', 'post_author' ) as $field ) {
 			if ( ! isset( $post_data[ $field ] ) ) {
@@ -547,14 +576,12 @@ function bulk_edit_posts( $post_data = null ) {
 			}
 		}

-		$post_data['ID'] = $post_ID;
-		$post_data['post_ID'] = $post_ID;
-
 		$post_data = _wp_translate_postdata( true, $post_data );
 		if ( is_wp_error( $post_data ) ) {
 			$skipped[] = $post_ID;
 			continue;
 		}
+		$post_data = _wp_get_allowed_postdata( $post_data );

 		$updated[] = wp_update_post( $post_data );

@@ -565,8 +592,8 @@ function bulk_edit_posts( $post_data = null ) {
 				unstick_post( $post_ID );
 		}

-		if ( isset( $post_data['post_format'] ) )
-			set_post_format( $post_ID, $post_data['post_format'] );
+		if ( isset( $shared_post_data['post_format'] ) )
+			set_post_format( $post_ID, $shared_post_data['post_format'] );
 	}

 	return array( 'updated' => $updated, 'skipped' => $skipped, 'locked' => $locked );
@@ -747,9 +774,10 @@ function wp_write_post() {
 	$translated = _wp_translate_postdata( false );
 	if ( is_wp_error($translated) )
 		return $translated;
+	$translated = _wp_get_allowed_postdata( $translated );

 	// Create the post.
-	$post_ID = wp_insert_post( $_POST );
+	$post_ID = wp_insert_post( $translated );
 	if ( is_wp_error( $post_ID ) )
 		return $post_ID;

@@ -1008,16 +1036,12 @@ function wp_edit_posts_query( $q = false ) {
 		$orderby = $q['orderby'];
 	} elseif ( isset( $q['post_status'] ) && in_array( $q['post_status'], array( 'pending', 'draft' ) ) ) {
 		$orderby = 'modified';
-	} elseif ( ! is_post_type_hierarchical( $post_type ) ) {
-		$orderby = 'date';
 	}

 	if ( isset( $q['order'] ) ) {
 		$order = $q['order'];
 	} elseif ( isset( $q['post_status'] ) && 'pending' == $q['post_status'] ) {
 		$order = 'ASC';
-	} else {
-		$order = 'desc';
 	}

 	$per_page = "edit_{$post_type}_per_page";
@@ -1306,7 +1330,7 @@ function get_sample_permalink_html( $id, $new_title = null, $new_slug = null ) {
 				$view_link = get_permalink( $post );
 			} else {
 				// Allow non-published (private, future) to be viewed at a pretty permalink.
-				$view_link = str_replace( array( '%pagename%', '%postname%' ), $post->post_name, urldecode( $permalink ) );
+				$view_link = str_replace( array( '%pagename%', '%postname%' ), $post->post_name, $permalink );
 			}
 		}
 	}
@@ -1316,7 +1340,8 @@ function get_sample_permalink_html( $id, $new_title = null, $new_slug = null ) {
 		$return = '<strong>' . __( 'Permalink:' ) . "</strong>\n";

 		if ( false !== $view_link ) {
-			$return .= '<a id="sample-permalink" href="' . esc_url( $view_link ) . '"' . $preview_target . '>' . $view_link . "</a>\n";
+			$display_link = urldecode( $view_link );
+			$return .= '<a id="sample-permalink" href="' . esc_url( $view_link ) . '"' . $preview_target . '>' . esc_html( $display_link ) . "</a>\n";
 		} else {
 			$return .= '<span id="sample-permalink">' . $permalink . "</span>\n";
 		}
@@ -1340,14 +1365,14 @@ function get_sample_permalink_html( $id, $new_title = null, $new_slug = null ) {
 			}
 		}

-		$post_name_html = '<span id="editable-post-name">' . $post_name_abridged . '</span>';
-		$display_link = str_replace( array( '%pagename%', '%postname%' ), $post_name_html, urldecode( $permalink ) );
+		$post_name_html = '<span id="editable-post-name">' . esc_html( $post_name_abridged ) . '</span>';
+		$display_link = str_replace( array( '%pagename%', '%postname%' ), $post_name_html, esc_html( urldecode( $permalink ) ) );

 		$return = '<strong>' . __( 'Permalink:' ) . "</strong>\n";
 		$return .= '<span id="sample-permalink"><a href="' . esc_url( $view_link ) . '"' . $preview_target . '>' . $display_link . "</a></span>\n";
 		$return .= '&lrm;'; // Fix bi-directional text display defect in RTL languages.
 		$return .= '<span id="edit-slug-buttons"><button type="button" class="edit-slug button button-small hide-if-no-js" aria-label="' . __( 'Edit permalink' ) . '">' . __( 'Edit' ) . "</button></span>\n";
-		$return .= '<span id="editable-post-name-full">' . $post_name . "</span>\n";
+		$return .= '<span id="editable-post-name-full">' . esc_html( $post_name ) . "</span>\n";
 	}

 	/**
@@ -1660,6 +1685,7 @@ function wp_create_post_autosave( $post_data ) {
 	$post_data = _wp_translate_postdata( true, $post_data );
 	if ( is_wp_error( $post_data ) )
 		return $post_data;
+	$post_data = _wp_get_allowed_postdata( $post_data );

 	$post_author = get_current_user_id();

@@ -1844,4 +1870,4 @@ function redirect_post($post_id = '') {
 	 */
 	wp_redirect( apply_filters( 'redirect_post_location', $location, $post_id ) );
 	exit;
-}
+}
--- a/wp-admin/includes/screen.php
+++ b/wp-admin/includes/screen.php
@@ -57,7 +57,9 @@ function get_hidden_columns( $screen ) {

 	$hidden = get_user_option( 'manage' . $screen->id . 'columnshidden' );

-	if ( ! $hidden ) {
+	$use_defaults = ! is_array( $hidden );
+
+	if ( $use_defaults ) {
 		$hidden = array();

 		/**
@@ -75,11 +77,13 @@ function get_hidden_columns( $screen ) {
 	 * Filter the list of hidden columns.
 	 *
 	 * @since 4.4.0
+	 * @since 4.4.1		Added the `use_defaults` parameter.
 	 *
 	 * @param array     $hidden An array of hidden columns.
 	 * @param WP_Screen $screen WP_Screen object of the current screen.
+	 * @param bool      $use_defaults Whether to show the default columns.
 	 */
-	return apply_filters( 'hidden_columns', $hidden, $screen );
+	return apply_filters( 'hidden_columns', $hidden, $screen, $use_defaults );
 }

 /**
--- a/wp-admin/includes/template.php
+++ b/wp-admin/includes/template.php
@@ -769,7 +769,7 @@ function page_template_dropdown( $default = '' ) {
 	ksort( $templates );
 	foreach ( array_keys( $templates ) as $template ) {
 		$selected = selected( $default, $templates[ $template ], false );
-		echo "\n\t<option value='" . $templates[ $template ] . "' $selected>$template</option>";
+		echo "\n\t<option value='" . esc_attr( $templates[ $template ] ) . "' $selected>" . esc_html( $template ) . "</option>";
 	}
 }

@@ -1582,12 +1582,12 @@ wp_enqueue_style( 'colors' );
 <script type="text/javascript">
 addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
 function tb_close(){var win=window.dialogArguments||opener||parent||top;win.tb_remove();}
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
-	pagenow = '<?php echo $current_screen->id; ?>',
-	typenow = '<?php echo $current_screen->post_type; ?>',
-	adminpage = '<?php echo $admin_body_class; ?>',
-	thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
-	decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
+	pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
+	typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
+	adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
+	thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
+	decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
 	isRtl = <?php echo (int) is_rtl(); ?>;
 </script>
 <?php
@@ -1784,6 +1784,7 @@ function _media_states( $post ) {
 function compression_test() {
 ?>
 	<script type="text/javascript">
+	var compressionNonce = <?php echo wp_json_encode( wp_create_nonce( 'update_can_compress_scripts' ) ); ?>;
 	var testCompression = {
 		get : function(test) {
 			var x;
@@ -1803,7 +1804,7 @@ function compression_test() {
 					}
 				};

-				x.open('GET', ajaxurl + '?action=wp-compression-test&test='+test+'&'+(new Date()).getTime(), true);
+				x.open('GET', ajaxurl + '?action=wp-compression-test&test='+test+'&_ajax_nonce='+compressionNonce+'&'+(new Date()).getTime(), true);
 				x.send('');
 			}
 		},
--- a/wp-admin/includes/update-core.php
+++ b/wp-admin/includes/update-core.php
@@ -700,6 +700,9 @@ $_old_files = array(
 'wp-admin/js/wp-fullscreen.min.js',
 'wp-includes/js/tinymce/wp-mce-help.php',
 'wp-includes/js/tinymce/plugins/wpfullscreen',
+// 4.9.2
+'wp-includes/js/mediaelement/flashmediaelement.swf',
+'wp-includes/js/mediaelement/silverlightmediaelement.xap',
 );

 /**
@@ -1076,7 +1079,11 @@ function update_core($from, $to) {
 		$old_file = $to . $old_file;
 		if ( !$wp_filesystem->exists($old_file) )
 			continue;
-		$wp_filesystem->delete($old_file, true);
+
+		// If the file isn't deleted, try writing an empty string to the file instead.
+		if ( ! $wp_filesystem->delete( $old_file, true ) && $wp_filesystem->is_file( $old_file ) ) {
+			$wp_filesystem->put_contents( $old_file, '' );
+		}
 	}

 	// Remove any Genericons example.html's from the filesystem
--- a/wp-admin/includes/upgrade.php
+++ b/wp-admin/includes/upgrade.php
@@ -1216,8 +1216,8 @@ function upgrade_280() {
 		$start = 0;
 		while( $rows = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options ORDER BY option_id LIMIT $start, 20" ) ) {
 			foreach ( $rows as $row ) {
-				$value = $row->option_value;
-				if ( !@unserialize( $value ) )
+				$value = maybe_unserialize( $row->option_value );
+				if ( $value === $row->option_value )
 					$value = stripslashes( $value );
 				if ( $value !== $row->option_value ) {
 					update_option( $row->option_name, $value );
@@ -2096,6 +2096,9 @@ function dbDelta( $queries = '', $execute = true ) {
 	 */
 	$iqueries = apply_filters( 'dbdelta_insert_queries', $iqueries );

+	$text_fields = array( 'tinytext', 'text', 'mediumtext', 'longtext' );
+	$blob_fields = array( 'tinyblob', 'blob', 'mediumblob', 'longblob' );
+
 	$global_tables = $wpdb->tables( 'global' );
 	foreach ( $cqueries as $table => $qry ) {
 		// Upgrade global tables only for the main site. Don't upgrade at all if conditions are not optimal.
@@ -2165,9 +2168,24 @@ function dbDelta( $queries = '', $execute = true ) {

 				// Is actual field type different from the field type in query?
 				if ($tablefield->Type != $fieldtype) {
+					$do_change = true;
+					if ( in_array( strtolower( $fieldtype ), $text_fields ) && in_array( strtolower( $tablefield->Type ), $text_fields ) ) {
+						if ( array_search( strtolower( $fieldtype ), $text_fields ) < array_search( strtolower( $tablefield->Type ), $text_fields ) ) {
+							$do_change = false;
+						}
+					}
+
+					if ( in_array( strtolower( $fieldtype ), $blob_fields ) && in_array( strtolower( $tablefield->Type ), $blob_fields ) ) {
+						if ( array_search( strtolower( $fieldtype ), $blob_fields ) < array_search( strtolower( $tablefield->Type ), $blob_fields ) ) {
+							$do_change = false;
+						}
+					}
+
+					if ( $do_change ) {
 					// Add a query to change the column type
-					$cqueries[] = "ALTER TABLE {$table} CHANGE COLUMN {$tablefield->Field} " . $cfields[strtolower($tablefield->Field)];
-					$for_update[$table.'.'.$tablefield->Field] = "Changed type of {$table}.{$tablefield->Field} from {$tablefield->Type} to {$fieldtype}";
+						$cqueries[] = "ALTER TABLE {$table} CHANGE COLUMN {$tablefield->Field} " . $cfields[strtolower($tablefield->Field)];
+						$for_update[$table.'.'.$tablefield->Field] = "Changed type of {$table}.{$tablefield->Field} from {$tablefield->Type} to {$fieldtype}";
+					}
 				}

 				// Get the default value from the array
--- a/wp-admin/install.php
+++ b/wp-admin/install.php
@@ -69,6 +69,7 @@ function display_header( $body_classes = '' ) {
 <head>
 	<meta name="viewport" content="width=device-width" />
 	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+	<meta name="robots" content="noindex,nofollow" />
 	<title><?php _e( 'WordPress &rsaquo; Installation' ); ?></title>
 	<?php
 		wp_admin_css( 'install', true );
--- a/wp-admin/js/accordion.min.js
+++ b/wp-admin/js/accordion.min.js
@@ -1 +1 @@
-!function(a){function b(a){var b=a.closest(".accordion-section"),c=b.find("[aria-expanded]").first(),d=b.closest(".accordion-container"),e=d.find(".open"),f=e.find("[aria-expanded]").first(),g=b.find(".accordion-section-content");b.hasClass("cannot-expand")||(d.addClass("opening"),b.hasClass("open")?(b.toggleClass("open"),g.toggle(!0).slideToggle(150)):(f.attr("aria-expanded","false"),e.removeClass("open"),e.find(".accordion-section-content").show().slideUp(150),g.toggle(!1).slideToggle(150),b.toggleClass("open")),setTimeout(function(){d.removeClass("opening")},150),c&&c.attr("aria-expanded",String("false"===c.attr("aria-expanded"))))}a(document).ready(function(){a(".accordion-container").on("click keydown",".accordion-section-title",function(c){("keydown"!==c.type||13===c.which)&&(c.preventDefault(),b(a(this)))})})}(jQuery);
+!function(s){s(document).ready(function(){s(".accordion-container").on("click keydown",".accordion-section-title",function(e){var n,o,a,i,t;"keydown"===e.type&&13!==e.which||(e.preventDefault(),n=s(this),o=n.closest(".accordion-section"),a=o.find("[aria-expanded]").first(),i=o.closest(".accordion-container"),t=i.find(".open"),e=t.find("[aria-expanded]").first(),n=o.find(".accordion-section-content"),o.hasClass("cannot-expand")||(i.addClass("opening"),o.hasClass("open")?(o.toggleClass("open"),n.toggle(!0).slideToggle(150)):(e.attr("aria-expanded","false"),t.removeClass("open"),t.find(".accordion-section-content").show().slideUp(150),n.toggle(!1).slideToggle(150),o.toggleClass("open")),setTimeout(function(){i.removeClass("opening")},150),a&&a.attr("aria-expanded",String("false"===a.attr("aria-expanded")))))})})}(jQuery);
--- a/wp-admin/js/bookmarklet.min.js
+++ b/wp-admin/js/bookmarklet.min.js
@@ -1 +1 @@
-(function(a,b,c,d){function e(a,c){if("undefined"!=typeof c){var d=b.createElement("input");d.name=a,d.value=c,d.type="hidden",p.appendChild(d)}}var f,g,h,i,j,k,l,m,n,o=a.encodeURIComponent,p=b.createElement("form"),q=b.getElementsByTagName("head")[0],r="_press_this_app",s=!0;if(d){if(!c.match(/^https?:/))return void(top.location.href=d);if(d+="&u="+o(c),c.match(/^https:/)&&d.match(/^http:/)&&(s=!1),a.getSelection?h=a.getSelection()+"":b.getSelection?h=b.getSelection()+"":b.selection&&(h=b.selection.createRange().text||""),d+="&buster="+(new Date).getTime(),s||(b.title&&(d+="&t="+o(b.title.substr(0,256))),h&&(d+="&s="+o(h.substr(0,512)))),f=a.outerWidth||b.documentElement.clientWidth||600,g=a.outerHeight||b.documentElement.clientHeight||700,f=800>f||f>5e3?600:.7*f,g=800>g||g>3e3?700:.9*g,!s)return void a.open(d,r,"location,resizable,scrollbars,width="+f+",height="+g);i=q.getElementsByTagName("meta")||[];for(var t=0;t<i.length&&!(t>200);t++){var u=i[t],v=u.getAttribute("name"),w=u.getAttribute("property"),x=u.getAttribute("content");x&&(v?e("_meta["+v+"]",x):w&&e("_meta["+w+"]",x))}j=q.getElementsByTagName("link")||[];for(var y=0;y<j.length&&!(y>=50);y++){var z=j[y],A=z.getAttribute("rel");("canonical"===A||"icon"===A||"shortlink"===A)&&e("_links["+A+"]",z.getAttribute("href"))}b.body.getElementsByClassName&&(k=b.body.getElementsByClassName("hfeed")[0]),k=b.getElementById("content")||k||b.body,l=k.getElementsByTagName("img")||[];for(var B=0;B<l.length&&!(B>=100);B++)n=l[B],n.src.indexOf("avatar")>-1||n.className.indexOf("avatar")>-1||n.width&&n.width<256||n.height&&n.height<128||e("_images[]",n.src);m=b.body.getElementsByTagName("iframe")||[];for(var C=0;C<m.length&&!(C>=50);C++)e("_embeds[]",m[C].src);b.title&&e("t",b.title),h&&e("s",h),p.setAttribute("method","POST"),p.setAttribute("action",d),p.setAttribute("target",r),p.setAttribute("style","display: none;"),a.open("about:blank",r,"location,resizable,scrollbars,width="+f+",height="+g),b.body.appendChild(p),p.submit()}})(window,document,top.location.href,window.pt_url);
+(function(e,n,t,i){var a,l,o,r,s,m,g,h=e.encodeURIComponent,c=n.createElement("form"),d=n.getElementsByTagName("head")[0],b="_press_this_app",u=!0;if(i)if(t.match(/^https?:/))if(i+="&u="+h(t),t.match(/^https:/)&&i.match(/^http:/)&&(u=!1),e.getSelection?a=e.getSelection()+"":n.getSelection?a=n.getSelection()+"":n.selection&&(a=n.selection.createRange().text||""),i+="&buster="+(new Date).getTime(),u||(n.title&&(i+="&t="+h(n.title.substr(0,256))),a&&(i+="&s="+h(a.substr(0,512)))),t=(t=e.outerWidth||n.documentElement.clientWidth||600)<800||5e3<t?600:.7*t,h=(h=e.outerHeight||n.documentElement.clientHeight||700)<800||3e3<h?700:.9*h,u){l=d.getElementsByTagName("meta")||[];for(var p=0;p<l.length&&!(200<p);p++){var f=l[p],y=f.getAttribute("name"),v=f.getAttribute("property"),f=f.getAttribute("content");f&&(y?N("_meta["+y+"]",f):v&&N("_meta["+v+"]",f))}o=d.getElementsByTagName("link")||[];for(var E=0;E<o.length&&!(50<=E);E++){var w=o[E],A=w.getAttribute("rel");"canonical"!==A&&"icon"!==A&&"shortlink"!==A||N("_links["+A+"]",w.getAttribute("href"))}n.body.getElementsByClassName&&(r=n.body.getElementsByClassName("hfeed")[0]),s=(r=n.getElementById("content")||r||n.body).getElementsByTagName("img")||[];for(var _=0;_<s.length&&!(100<=_);_++)-1<(g=s[_]).src.indexOf("avatar")||-1<g.className.indexOf("avatar")||g.width&&g.width<256||g.height&&g.height<128||N("_images[]",g.src);m=n.body.getElementsByTagName("iframe")||[];for(var B=0;B<m.length&&!(50<=B);B++)N("_embeds[]",m[B].src);n.title&&N("t",n.title),a&&N("s",a),c.setAttribute("method","POST"),c.setAttribute("action",i),c.setAttribute("target",b),c.setAttribute("style","display: none;"),e.open("about:blank",b,"location,resizable,scrollbars,width="+t+",height="+h),n.body.appendChild(c),c.submit()}else e.open(i,b,"location,resizable,scrollbars,width="+t+",height="+h);else top.location.href=i;function N(e,t){var i;void 0!==t&&((i=n.createElement("input")).name=e,i.value=t,i.type="hidden",c.appendChild(i))}})(window,document,top.location.href,window.pt_url);
--- a/wp-admin/js/color-picker.min.js
+++ b/wp-admin/js/color-picker.min.js
@@ -1 +1 @@
-!function(a,b){var c,d='<a tabindex="0" class="wp-color-result" />',e='<div class="wp-picker-holder" />',f='<div class="wp-picker-container" />',g='<input type="button" class="button button-small hidden" />';c={options:{defaultColor:!1,change:!1,clear:!1,hide:!0,palettes:!0,width:255,mode:"hsv"},_create:function(){if(a.support.iris){var b=this,c=b.element;a.extend(b.options,c.data()),b.close=a.proxy(b.close,b),b.initialValue=c.val(),c.addClass("wp-color-picker").hide().wrap(f),b.wrap=c.parent(),b.toggler=a(d).insertBefore(c).css({backgroundColor:b.initialValue}).attr("title",wpColorPickerL10n.pick).attr("data-current",wpColorPickerL10n.current),b.pickerContainer=a(e).insertAfter(c),b.button=a(g),b.options.defaultColor?b.button.addClass("wp-picker-default").val(wpColorPickerL10n.defaultString):b.button.addClass("wp-picker-clear").val(wpColorPickerL10n.clear),c.wrap('<span class="wp-picker-input-wrap" />').after(b.button),c.iris({target:b.pickerContainer,hide:b.options.hide,width:b.options.width,mode:b.options.mode,palettes:b.options.palettes,change:function(c,d){b.toggler.css({backgroundColor:d.color.toString()}),a.isFunction(b.options.change)&&b.options.change.call(this,c,d)}}),c.val(b.initialValue),b._addListeners(),b.options.hide||b.toggler.click()}},_addListeners:function(){var b=this;b.wrap.on("click.wpcolorpicker",function(a){a.stopPropagation()}),b.toggler.click(function(){b.toggler.hasClass("wp-picker-open")?b.close():b.open()}),b.element.change(function(c){var d=a(this),e=d.val();(""===e||"#"===e)&&(b.toggler.css("backgroundColor",""),a.isFunction(b.options.clear)&&b.options.clear.call(this,c))}),b.toggler.on("keyup",function(a){(13===a.keyCode||32===a.keyCode)&&(a.preventDefault(),b.toggler.trigger("click").next().focus())}),b.button.click(function(c){var d=a(this);d.hasClass("wp-picker-clear")?(b.element.val(""),b.toggler.css("backgroundColor",""),a.isFunction(b.options.clear)&&b.options.clear.call(this,c)):d.hasClass("wp-picker-default")&&b.element.val(b.options.defaultColor).change()})},open:function(){this.element.show().iris("toggle").focus(),this.button.removeClass("hidden"),this.wrap.addClass("wp-picker-active"),this.toggler.addClass("wp-picker-open"),a("body").trigger("click.wpcolorpicker").on("click.wpcolorpicker",this.close)},close:function(){this.element.hide().iris("toggle"),this.button.addClass("hidden"),this.wrap.removeClass("wp-picker-active"),this.toggler.removeClass("wp-picker-open"),a("body").off("click.wpcolorpicker",this.close)},color:function(a){return a===b?this.element.iris("option","color"):void this.element.iris("option","color",a)},defaultColor:function(a){return a===b?this.options.defaultColor:void(this.options.defaultColor=a)}},a.widget("wp.wpColorPicker",c)}(jQuery);
+!function(i,e){var o={options:{defaultColor:!1,change:!1,clear:!1,hide:!0,palettes:!0,width:255,mode:"hsv"},_create:function(){var t,o;i.support.iris&&(o=(t=this).element,i.extend(t.options,o.data()),t.close=i.proxy(t.close,t),t.initialValue=o.val(),o.addClass("wp-color-picker").hide().wrap('<div class="wp-picker-container" />'),t.wrap=o.parent(),t.toggler=i('<a tabindex="0" class="wp-color-result" />').insertBefore(o).css({backgroundColor:t.initialValue}).attr("title",wpColorPickerL10n.pick).attr("data-current",wpColorPickerL10n.current),t.pickerContainer=i('<div class="wp-picker-holder" />').insertAfter(o),t.button=i('<input type="button" class="button button-small hidden" />'),t.options.defaultColor?t.button.addClass("wp-picker-default").val(wpColorPickerL10n.defaultString):t.button.addClass("wp-picker-clear").val(wpColorPickerL10n.clear),o.wrap('<span class="wp-picker-input-wrap" />').after(t.button),o.iris({target:t.pickerContainer,hide:t.options.hide,width:t.options.width,mode:t.options.mode,palettes:t.options.palettes,change:function(o,e){t.toggler.css({backgroundColor:e.color.toString()}),i.isFunction(t.options.change)&&t.options.change.call(this,o,e)}}),o.val(t.initialValue),t._addListeners(),t.options.hide||t.toggler.click())},_addListeners:function(){var t=this;t.wrap.on("click.wpcolorpicker",function(o){o.stopPropagation()}),t.toggler.click(function(){t.toggler.hasClass("wp-picker-open")?t.close():t.open()}),t.element.change(function(o){var e=i(this).val();""!==e&&"#"!==e||(t.toggler.css("backgroundColor",""),i.isFunction(t.options.clear)&&t.options.clear.call(this,o))}),t.toggler.on("keyup",function(o){13!==o.keyCode&&32!==o.keyCode||(o.preventDefault(),t.toggler.trigger("click").next().focus())}),t.button.click(function(o){var e=i(this);e.hasClass("wp-picker-clear")?(t.element.val(""),t.toggler.css("backgroundColor",""),i.isFunction(t.options.clear)&&t.options.clear.call(this,o)):e.hasClass("wp-picker-default")&&t.element.val(t.options.defaultColor).change()})},open:function(){this.element.show().iris("toggle").focus(),this.button.removeClass("hidden"),this.wrap.addClass("wp-picker-active"),this.toggler.addClass("wp-picker-open"),i("body").trigger("click.wpcolorpicker").on("click.wpcolorpicker",this.close)},close:function(){this.element.hide().iris("toggle"),this.button.addClass("hidden"),this.wrap.removeClass("wp-picker-active"),this.toggler.removeClass("wp-picker-open"),i("body").off("click.wpcolorpicker",this.close)},color:function(o){if(o===e)return this.element.iris("option","color");this.element.iris("option","color",o)},defaultColor:function(o){if(o===e)return this.options.defaultColor;this.options.defaultColor=o}};i.widget("wp.wpColorPicker",o)}(jQuery);
--- a/wp-admin/js/comment.min.js
+++ b/wp-admin/js/comment.min.js
@@ -1 +1 @@
-jQuery(document).ready(function(a){postboxes.add_postbox_toggles("comment");var b=a("#timestampdiv"),c=a("#timestamp"),d=c.html(),e=b.find(".timestamp-wrap"),f=b.siblings("a.edit-timestamp");f.click(function(c){b.is(":hidden")&&(b.slideDown("fast",function(){a("input, select",e).first().focus()}),a(this).hide()),c.preventDefault()}),b.find(".cancel-timestamp").click(function(e){f.show().focus(),b.slideUp("fast"),a("#mm").val(a("#hidden_mm").val()),a("#jj").val(a("#hidden_jj").val()),a("#aa").val(a("#hidden_aa").val()),a("#hh").val(a("#hidden_hh").val()),a("#mn").val(a("#hidden_mn").val()),c.html(d),e.preventDefault()}),b.find(".save-timestamp").click(function(d){var g=a("#aa").val(),h=a("#mm").val(),i=a("#jj").val(),j=a("#hh").val(),k=a("#mn").val(),l=new Date(g,h-1,i,j,k);return d.preventDefault(),l.getFullYear()!=g||1+l.getMonth()!=h||l.getDate()!=i||l.getMinutes()!=k?void e.addClass("form-invalid"):(e.removeClass("form-invalid"),c.html(commentL10n.submittedOn+" <b>"+commentL10n.dateFormat.replace("%1$s",a('option[value="'+h+'"]',"#mm").attr("data-text")).replace("%2$s",parseInt(i,10)).replace("%3$s",g).replace("%4$s",("00"+j).slice(-2)).replace("%5$s",("00"+k).slice(-2))+"</b> "),f.show().focus(),void b.slideUp("fast"))})});
+jQuery(document).ready(function(m){postboxes.add_postbox_toggles("comment");var d=m("#timestampdiv"),c=m("#timestamp"),a=c.html(),o=d.find(".timestamp-wrap"),v=d.siblings("a.edit-timestamp");v.click(function(e){d.is(":hidden")&&(d.slideDown("fast",function(){m("input, select",o).first().focus()}),m(this).hide()),e.preventDefault()}),d.find(".cancel-timestamp").click(function(e){v.show().focus(),d.slideUp("fast"),m("#mm").val(m("#hidden_mm").val()),m("#jj").val(m("#hidden_jj").val()),m("#aa").val(m("#hidden_aa").val()),m("#hh").val(m("#hidden_hh").val()),m("#mn").val(m("#hidden_mn").val()),c.html(a),e.preventDefault()}),d.find(".save-timestamp").click(function(e){var a=m("#aa").val(),t=m("#mm").val(),l=m("#jj").val(),i=m("#hh").val(),n=m("#mn").val(),s=new Date(a,t-1,l,i,n);e.preventDefault(),s.getFullYear()==a&&1+s.getMonth()==t&&s.getDate()==l&&s.getMinutes()==n?(o.removeClass("form-invalid"),c.html(commentL10n.submittedOn+" <b>"+commentL10n.dateFormat.replace("%1$s",m('option[value="'+t+'"]',"#mm").attr("data-text")).replace("%2$s",parseInt(l,10)).replace("%3$s",a).replace("%4$s",("00"+i).slice(-2)).replace("%5$s",("00"+n).slice(-2))+"</b> "),v.show().focus(),d.slideUp("fast")):o.addClass("form-invalid")})});
--- a/wp-admin/js/common.js
+++ b/wp-admin/js/common.js
@@ -397,7 +397,7 @@ $document.ready( function() {
 	 * The `.below-h2` class is here just for backwards compatibility with plugins
 	 * that are (incorrectly) using it. Do not use. Use `.inline` instead. See #34570.
 	 */
-	$( 'div.updated, div.error, div.notice' ).not( '.inline, .below-h2' ).insertAfter( $( '.wrap' ).children( ':header' ).first() );
+	$( 'div.updated, div.error, div.notice' ).not( '.inline, .below-h2' ).insertAfter( $( '.wrap h1, .wrap h2' ).first() );

 	// Make notices dismissible
 	function makeNoticesDismissible() {
--- a/wp-admin/js/common.min.js
+++ b/wp-admin/js/common.min.js
--- a/wp-admin/js/custom-background.js
+++ b/wp-admin/js/custom-background.js
@@ -56,11 +56,13 @@
 			frame.on( 'select', function() {
 				// Grab the selected attachment.
 				var attachment = frame.state().get('selection').first();
+				var nonceValue = $( '#_wpnonce' ).val() || '';

 				// Run an AJAX request to set the background image.
 				$.post( ajaxurl, {
 					action: 'set-background-image',
 					attachment_id: attachment.id,
+					_ajax_nonce: nonceValue,
 					size: 'full'
 				}).done( function() {
 					// When the request completes, reload the window.
--- a/wp-admin/js/custom-background.min.js
+++ b/wp-admin/js/custom-background.min.js
@@ -1 +1 @@
-!function(a){a(document).ready(function(){var b,c=a("#custom-background-image");a("#background-color").wpColorPicker({change:function(a,b){c.css("background-color",b.color.toString())},clear:function(){c.css("background-color","")}}),a('input[name="background-position-x"]').change(function(){c.css("background-position",a(this).val()+" top")}),a('input[name="background-repeat"]').change(function(){c.css("background-repeat",a(this).val())}),a("#choose-from-library-link").click(function(c){var d=a(this);return c.preventDefault(),b?void b.open():(b=wp.media.frames.customBackground=wp.media({title:d.data("choose"),library:{type:"image"},button:{text:d.data("update"),close:!1}}),b.on("select",function(){var c=b.state().get("selection").first();a.post(ajaxurl,{action:"set-background-image",attachment_id:c.id,size:"full"}).done(function(){window.location.reload()})}),void b.open())})})}(jQuery);
+!function(c){c(document).ready(function(){var a,t=c("#custom-background-image");c("#background-color").wpColorPicker({change:function(o,n){t.css("background-color",n.color.toString())},clear:function(){t.css("background-color","")}}),c('input[name="background-position-x"]').change(function(){t.css("background-position",c(this).val()+" top")}),c('input[name="background-repeat"]').change(function(){t.css("background-repeat",c(this).val())}),c("#choose-from-library-link").click(function(o){var n=c(this);o.preventDefault(),a||(a=wp.media.frames.customBackground=wp.media({title:n.data("choose"),library:{type:"image"},button:{text:n.data("update"),close:!1}})).on("select",function(){var o=a.state().get("selection").first(),n=c("#_wpnonce").val()||"";c.post(ajaxurl,{action:"set-background-image",attachment_id:o.id,_ajax_nonce:n,size:"full"}).done(function(){window.location.reload()})}),a.open()})})}(jQuery);
--- a/wp-admin/js/customize-controls.js
+++ b/wp-admin/js/customize-controls.js
@@ -3364,6 +3364,16 @@
 			}
 		});

+		// Ensure preview nonce is included with every customized request, to allow post data to be read.
+		$.ajaxPrefilter( function injectPreviewNonce( options ) {
+			if ( ! /wp_customize=on/.test( options.data ) ) {
+				return;
+			}
+			options.data += '&' + $.param({
+				customize_preview_nonce: api.settings.nonce.preview
+			});
+		});
+
 		// Refresh the nonces if the preview sends updated nonces over.
 		api.previewer.bind( 'nonce', function( nonce ) {
 			$.extend( this.nonce, nonce );
--- a/wp-admin/js/customize-controls.min.js
+++ b/wp-admin/js/customize-controls.min.js
--- a/wp-admin/js/customize-nav-menus.min.js
+++ b/wp-admin/js/customize-nav-menus.min.js
--- a/wp-admin/js/customize-widgets.min.js
+++ b/wp-admin/js/customize-widgets.min.js
--- a/Show More
+++ b/Show More