Ticket #43066: document-password-strength.diff

src/license.txt

@@ -1 +1 @@
 WordPress - Web publishing software
 
-Copyright 2011-2018 by the contributors
+Copyright 2011-2017 by the contributors
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by

src/wp-admin/includes/class-wp-comments-list-table.php

@@ -134 +134 @@
                         'post_type' => $post_type,
                 );
 
-                /**
-                 * Filters the arguments for the comment query in the comments list table.
-                 *
-                 * @since 5.0.0
-                 *
-                 * @param array $args An array of get_comments() arguments.
-                 */
-                $args = apply_filters( 'comments_list_table_query_args', $args );
-
                 $_comments = get_comments( $args );
                 if ( is_array( $_comments ) ) {
                         update_comment_cache( $_comments );

src/wp-admin/includes/update-core.php

@@ -1143 +1143 @@
                 if ( ! $wp_filesystem->exists( $old_file ) ) {
                         continue;
                 }
-
-                // If the file isn't deleted, try writing an empty string to the file instead.
-                if ( ! $wp_filesystem->delete( $old_file, true ) && $wp_filesystem->is_file( $old_file ) ) {
-                        $wp_filesystem->put_contents( $old_file, '' );
-                }
+                $wp_filesystem->delete( $old_file, true );
         }
 
         // Remove any Genericons example.html's from the filesystem

src/wp-admin/js/editor.js

@@ -695 +695 @@
                  */
                 function findBookmarkedPosition( editor ) {
                         // Get the TinyMCE `window` reference, since we need to access the raw selection.
-                        var TinyMCEWindow = editor.getWin(),
-                                selection = TinyMCEWindow.getSelection();
+                        var TinyMCEWIndow = editor.getWin(),
+                                selection = TinyMCEWIndow.getSelection();
 
-                        if ( ! selection || selection.rangeCount < 1 ) {
+                        if ( selection.rangeCount <= 0 ) {
                                 // no selection, no need to continue.
                                 return;
                         }

src/wp-admin/js/media-upload.js

@@ -1 +1 @@
 /* global tinymce, QTags */
-
-/**
- * Contains global functions for the media upload within the post edit screen.
- *
- * Updates the ThickBox anchor href and the ThickBox's own properties in order
- * to set the size and position on every resize event. Also adds a function to
- * send HTML or text to the currently active editor.
- *
- * @file
- * @since 2.5.0
- *
- * @requires jQuery
- */
+// send html to the post editor
 
 var wpActiveEditor, send_to_editor;
 
-/**
- * Sends the HTML passed in the parameters to TinyMCE.
- *
- * @since 2.5.0
- *
- * @global
- *
- * @param {string} html The HTML to be sent to the editor.
- * @returns {void|boolean} Returns false when both TinyMCE and QTags instances
- *                         are unavailable. This means that the HTML was not
- *                         sent to the editor.
- */
 send_to_editor = function( html ) {
         var editor,
                 hasTinymce = typeof tinymce !== 'undefined',
                 hasQuicktags = typeof QTags !== 'undefined';
 
-        // If no active editor is set, try to set it.
         if ( ! wpActiveEditor ) {
                 if ( hasTinymce && tinymce.activeEditor ) {
                         editor = tinymce.activeEditor;
@@ -44 +19 @@
                 editor = tinymce.get( wpActiveEditor );
         }
 
-        // If the editor is set and not hidden, insert the HTML into the content of the
-        // editor.
         if ( editor && ! editor.isHidden() ) {
                 editor.execCommand( 'mceInsertContent', false, html );
         } else if ( hasQuicktags ) {
-                // If quick tags are available, insert the HTML into its content.
                 QTags.insertContent( html );
         } else {
-                // If neither the TinyMCE editor and the quick tags are available, add the HTML
-                // to the current active editor.
                 document.getElementById( wpActiveEditor ).value += html;
         }
 
-        // If the old thickbox remove function exists, call it.
+        // If the old thickbox remove function exists, call it
         if ( window.tb_remove ) {
                 try { window.tb_remove(); } catch( e ) {}
         }
 };
 
+// thickbox settings
 var tb_position;
 (function($) {
-        /**
-         * Recalculates and applies the new ThickBox position based on the current
-         * window size.
-         *
-         * @since 2.6.0
-         *
-         * @global
-         *
-         * @returns {Object[]} Array containing jQuery objects for all the found
-         *                     ThickBox anchors.
-         */
         tb_position = function() {
                 var tbWindow = $('#TB_window'),
                         width = $(window).width(),
@@ -95 +55 @@
                                 tbWindow.css({'top': 20 + adminbar_height + 'px', 'margin-top': '0'});
                 }
 
-                /**
-                 * Recalculates the new height and width for all links with a ThickBox class.
-                 *
-                 * @since 2.6.0
-                 */
                 return $('a.thickbox').each( function() {
                         var href = $(this).attr('href');
                         if ( ! href ) return;
@@ -109 +64 @@
                 });
         };
 
-        // Add handler to recalculates the ThickBox position when the window is resized.
         $(window).resize(function(){ tb_position(); });
 
 })(jQuery);

src/wp-admin/js/password-strength-meter.js

@@ -3 +3 @@
 
 var passwordStrength;
 (function($){
+
+        /**
+         * The Password Strength object.
+         *
+         * Contains functions to determine the password strength.
+         *
+         * @since 3.7.0
+         *
+         * @namespace
+         */
         wp.passwordStrength = {
                 /**
-                 * Determine the strength of a given password
+                 * Determines the strength of a given password.
+                 *
+                 * @since 3.7.0
+                 *
+                 * @param {string} password1 The password.
+                 * @param {Array} blacklist An array of words that will lower the entropy of the password.
+                 * @param {string} password2 The confirmed password.
                  *
-                 * @param string password1 The password
-                 * @param array blacklist An array of words that will lower the entropy of the password
-                 * @param string password2 The confirmed password
+                 * @returns {number} The password strength score.
                  */
                 meter : function( password1, blacklist, password2 ) {
                         if ( ! $.isArray( blacklist ) )
@@ -28 +42 @@
                 },
 
                 /**
-                 * Builds an array of data that should be penalized, because it would lower the entropy of a password if it were used
+                 * Builds an array of data that should be penalized.
+                 *
+                 * Certain words need to be penalized because it would lower the entropy of a password if they were used.
+                 * The blacklist is based on user input fields such as username, first name, email etc.
+                 *
+                 * @since 3.7.0
                  *
-                 * @return array The array of data to be blacklisted
+                 * @returns {Array} The array of data to be blacklisted.
                  */
                 userInputBlacklist : function() {
                         var i, userInputFieldsLength, rawValuesLength, currentField,
@@ -38 +57 @@
                                 blacklist       = [],
                                 userInputFields = [ 'user_login', 'first_name', 'last_name', 'nickname', 'display_name', 'email', 'url', 'description', 'weblog_title', 'admin_email' ];
 
-                        // Collect all the strings we want to blacklist
+                        // Collect all the strings we want to blacklist.
                         rawValues.push( document.title );
                         rawValues.push( document.URL );
 
@@ -54 +73 @@
                                 rawValues.push( currentField.val() );
                         }
 
-                        // Strip out non-alphanumeric characters and convert each word to an individual entry
+                        // Strip out non-alphanumeric characters and convert each word to an individual entry.
                         rawValuesLength = rawValues.length;
                         for ( i = 0; i < rawValuesLength; i++ ) {
                                 if ( rawValues[ i ] ) {
@@ -62 +81 @@
                                 }
                         }
 
-                        // Remove empty values, short words, and duplicates. Short words are likely to cause many false positives.
+                        // Remove empty values, short words and duplicates. Short words are likely to cause many false positives.
                         blacklist = $.grep( blacklist, function( value, key ) {
                                 if ( '' === value || 4 > value.length ) {
                                         return false;
@@ -75 +94 @@
                 }
         };
 
-        // Back-compat.
+        // Backward compatibility.
         passwordStrength = wp.passwordStrength.meter;
 })(jQuery);

src/wp-includes/formatting.php

@@ -5077 +5077 @@
         return urldecode( basename( str_replace( array( '%2F', '%5C' ), '/', urlencode( $path ) ), $suffix ) );
 }
 
-// phpcs:disable WordPress.WP.CapitalPDangit.Misspelled, WordPress.NamingConventions.ValidFunctionName.FunctionNameInvalid -- 8-)
 /**
- * Forever eliminate "Wordpress" from the planet (or at least the little bit we can influence).
+ * Forever eliminate "WordPress" from the planet (or at least the little bit we can influence).
  *
  * Violating our coding standards for a good function name.
  *
@@ -5094 +5093 @@
         // Simple replacement for titles
         $current_filter = current_filter();
         if ( 'the_title' === $current_filter || 'wp_title' === $current_filter ) {
-                return str_replace( 'Wordpress', 'WordPress', $text );
+                return str_replace( 'WordPress', 'WordPress', $text );
         }
         // Still here? Use the more judicious replacement
         static $dblq = false;
@@ -5107 +5106 @@
                 $text
         );
 }
-// phpcs:enable
 
 /**
  * Sanitize a mime type

src/wp-includes/functions.php

@@ -5459 +5459 @@
  */
 function wp_is_stream( $path ) {
         $wrappers    = stream_get_wrappers();
-        $wrappers    = array_map( 'preg_quote', $wrappers );
         $wrappers_re = '(' . join( '|', $wrappers ) . ')';
 
         return preg_match( "!^$wrappers_re://!", $path ) === 1;

src/wp-includes/js/tinymce/plugins/wplink/plugin.js

@@ -468 +468 @@
                                                         }
                                                 }
                                         } ).autocomplete( 'instance' )._renderItem = function( ul, item ) {
-                                                var fallbackTitle = ( typeof window.wpLinkL10n !== 'undefined' ) ? window.wpLinkL10n.noTitle : '',
-                                                        title = item.title ? item.title : fallbackTitle;
-
                                                 return $( '<li role="option" id="mce-wp-autocomplete-' + item.ID + '">' )
-                                                .append( '<span>' + title + '</span>&nbsp;<span class="wp-editor-float-right">' + item.info + '</span>' )
+                                                .append( '<span>' + item.title + '</span>&nbsp;<span class="wp-editor-float-right">' + item.info + '</span>' )
                                                 .appendTo( ul );
                                         };
 

src/wp-includes/rest-api/class-wp-rest-server.php

@@ -915 +915 @@
                                                 if ( is_wp_error( $permission ) ) {
                                                         $response = $permission;
                                                 } elseif ( false === $permission || null === $permission ) {
-                                                        $response = new WP_Error( 'rest_forbidden', __( 'Sorry, you are not allowed to do that.' ), array( 'status' => rest_authorization_required_code() ) );
+                                                        $response = new WP_Error( 'rest_forbidden', __( 'Sorry, you are not allowed to do that.' ), array( 'status' => 403 ) );
                                                 }
                                         }
                                 }

deleted file tests/phpunit/tests/formatting/CapitalPDangit.php

@@ -1 @@
-<?php
-// phpcs:disable WordPress.WP.CapitalPDangit.Misspelled -- 🙃
-
-/**
- * @group formatting
- */
-class Tests_Formatting_CapitalPDangit extends WP_UnitTestCase {
-        function test_esc_attr_quotes() {
-                global $wp_current_filter;
-                $this->assertEquals( 'Something about WordPress', capital_P_dangit( 'Something about Wordpress' ) );
-                $this->assertEquals( 'Something about (WordPress', capital_P_dangit( 'Something about (Wordpress' ) );
-                $this->assertEquals( 'Something about &#8216;WordPress', capital_P_dangit( 'Something about &#8216;Wordpress' ) );
-                $this->assertEquals( 'Something about &#8220;WordPress', capital_P_dangit( 'Something about &#8220;Wordpress' ) );
-                $this->assertEquals( 'Something about >WordPress', capital_P_dangit( 'Something about >Wordpress' ) );
-                $this->assertEquals( 'Wordpress', capital_P_dangit( 'Wordpress' ) );
-
-                $wp_current_filter = array( 'the_title' );
-                $this->assertEquals( 'WordPress', capital_P_dangit( 'Wordpress' ) );
-        }
-}

tests/phpunit/tests/image/editorImagick.php

@@ -550 +550 @@
          * @ticket 37140
          */
         public function test_remove_orientation_data_on_rotate() {
-                if ( ! function_exists( 'exif_read_data' ) ) {
-                        $this->markTestSkipped( 'This test requires the exif_read_data function.' );
-                }
-
                 $file = DIR_TESTDATA . '/images/test-image-upside-down.jpg';
                 $data = wp_read_image_metadata( $file );
 

tests/phpunit/tests/rest-api/rest-attachments-controller.php

@@ -524 +524 @@
                 $this->assertFalse( isset( $data['media_details']['sizes']['rest-api-test']['source_url'] ) );
         }
 
-        public function test_get_item_private_post_not_authenticated() {
+        public function test_get_item_private_post() {
                 wp_set_current_user( 0 );
                 $draft_post = $this->factory->post->create( array( 'post_status' => 'draft' ) );
                 $id1        = $this->factory->attachment->create_object(
@@ -535 +535 @@
                 );
                 $request    = new WP_REST_Request( 'GET', '/wp/v2/media/' . $id1 );
                 $response   = $this->server->dispatch( $request );
-                $this->assertEquals( 401, $response->get_status() );
+                $this->assertEquals( 403, $response->get_status() );
         }
 
         public function test_get_item_inherit_status_with_invalid_parent() {
@@ -553 +553 @@
                 $this->assertEquals( $attachment_id, $data['id'] );
         }
 
-        public function test_get_item_auto_status_with_invalid_parent_not_authenticated_returns_error() {
+        public function test_get_item_auto_status_with_invalid_parent_returns_error() {
                 $attachment_id = $this->factory->attachment->create_object(
                         $this->test_file, REST_TESTS_IMPOSSIBLY_HIGH_NUMBER, array(
                                 'post_mime_type' => 'image/jpeg',
@@ -564 +564 @@
                 $request       = new WP_REST_Request( 'GET', sprintf( '/wp/v2/media/%d', $attachment_id ) );
                 $response      = $this->server->dispatch( $request );
 
-                $this->assertErrorResponse( 'rest_forbidden', $response, 401 );
+                $this->assertErrorResponse( 'rest_forbidden', $response, 403 );
         }
 
         public function test_create_item() {

tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -1327 +1327 @@
                 $this->assertEquals( rest_url( '/wp/v2/users/' . self::$author_id ), $links['author'][0]['href'] );
         }
 
-        public function test_get_post_draft_status_not_authenicated() {
+        public function test_get_post_without_permission() {
                 $draft_id = $this->factory->post->create(
                         array(
                                 'post_status' => 'draft',
@@ -1338 +1338 @@
                 $request  = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', $draft_id ) );
                 $response = $this->server->dispatch( $request );
 
-                $this->assertErrorResponse( 'rest_forbidden', $response, 401 );
+                $this->assertErrorResponse( 'rest_forbidden', $response, 403 );
         }
 
         public function test_get_post_invalid_id() {
@@ -1464 +1464 @@
                 $this->assertTrue( $data['excerpt']['protected'] );
         }
 
-        public function test_get_item_read_permission_custom_post_status_not_authenticated() {
+        public function test_get_item_read_permission_custom_post_status() {
                 register_post_status( 'testpubstatus', array( 'public' => true ) );
                 register_post_status( 'testprivtatus', array( 'public' => false ) );
                 // Public status
@@ -1486 +1486 @@
                 );
                 $request  = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', self::$post_id ) );
                 $response = $this->server->dispatch( $request );
-                $this->assertEquals( 401, $response->get_status() );
+                $this->assertEquals( 403, $response->get_status() );
         }
 
         public function test_prepare_item() {

tests/phpunit/tests/rest-api/rest-settings-controller.php

@@ -10 +10 @@
  * @group restapi
  */
 class WP_Test_REST_Settings_Controller extends WP_Test_REST_Controller_Testcase {
-        
         protected static $administrator;
-        protected static $author;
 
         public static function wpSetUpBeforeClass( $factory ) {
                 self::$administrator = $factory->user->create(
@@ -20 +18 @@
                                 'role' => 'administrator',
                         )
                 );
-
-                self::$author        = $factory->user->create(
-                        array(
-                                'role' => 'author',
-                        )
-                );
         }
 
         public static function wpTearDownAfterClass() {
                 self::delete_user( self::$administrator );
-                self::delete_user( self::$author );
         }
 
         public function setUp() {
@@ -54 +45 @@
         public function test_context_param() {
         }
 
-        public function test_get_item_is_not_public_not_authenticated() {
-                $request  = new WP_REST_Request( 'GET', '/wp/v2/settings' );
-                $response = $this->server->dispatch( $request );
-                $this->assertEquals( 401, $response->get_status() );
-        }
-
-        public function test_get_item_is_not_public_no_permission() {
-                wp_set_current_user( self::$author );
+        public function test_get_item_is_not_public() {
                 $request  = new WP_REST_Request( 'GET', '/wp/v2/settings' );
                 $response = $this->server->dispatch( $request );
                 $this->assertEquals( 403, $response->get_status() );

tests/phpunit/tests/rest-api/rest-taxonomies-controller.php

@@ -11 +11 @@
  */
 class WP_Test_REST_Taxonomies_Controller extends WP_Test_REST_Controller_Testcase {
 
-        protected static $contributor_id;
-
-        public static function wpSetUpBeforeClass( $factory ) {
-                self::$contributor_id = $factory->user->create(
-                        array(
-                                'role' => 'contributor',
-                        )
-                );
-        }
-
-        public static function wpTearDownAfterClass() {
-                self::delete_user( self::$contributor_id );
-        }
-
         public function test_register_routes() {
                 $routes = $this->server->get_routes();
 
@@ -115 +101 @@
                 $this->assertErrorResponse( 'rest_taxonomy_invalid', $response, 404 );
         }
 
-        public function test_get_non_public_taxonomy_not_authenticated() {
-                register_taxonomy( 'api-private', 'post', array( 'public' => false ) );
-
-                $request  = new WP_REST_Request( 'GET', '/wp/v2/taxonomies/api-private' );
-                $response = $this->server->dispatch( $request );
-                $this->assertErrorResponse( 'rest_forbidden', $response, 401 );
-        }
-
-                public function test_get_non_public_taxonomy_no_permission() {
-                wp_set_current_user( self::$contributor_id );
+        public function test_get_non_public_taxonomy() {
                 register_taxonomy( 'api-private', 'post', array( 'public' => false ) );
 
                 $request  = new WP_REST_Request( 'GET', '/wp/v2/taxonomies/api-private' );