Ticket #54182: 54182.2.diff

src/wp-admin/admin-ajax.php

@@ -168 +168 @@
 
 add_action( 'wp_ajax_nopriv_heartbeat', 'wp_ajax_nopriv_heartbeat', 1 );
 
-$action = ( isset( $_REQUEST['action'] ) ) ? $_REQUEST['action'] : '';
+$action = ( isset( $_REQUEST['action'] ) ) ? wp_unslash( $_REQUEST['action'] ) : '';
 
 if ( is_user_logged_in() ) {
         // If no action is registered, return a Bad Request response.

src/wp-admin/admin-post.php

@@ -29 +29 @@
 /** This action is documented in wp-admin/admin.php */
 do_action( 'admin_init' );
 
-$action = empty( $_REQUEST['action'] ) ? '' : $_REQUEST['action'];
+$action = empty( $_REQUEST['action'] ) ? '' : wp_unslash( $_REQUEST['action'] );
 
 if ( ! is_user_logged_in() ) {
         if ( empty( $action ) ) {

src/wp-admin/admin.php

@@ -406 +406 @@
 }
 
 if ( ! empty( $_REQUEST['action'] ) ) {
-        $action = $_REQUEST['action'];
+        $action = wp_unslash( $_REQUEST['action'] );
 
         /**
          * Fires when an 'action' request variable is sent.

src/wp-admin/async-upload.php

@@ -6 +6 @@
  * @subpackage Administration
  */
 
-if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) {
+if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === wp_unslash( $_REQUEST['action'] ) ) {
         define( 'DOING_AJAX', true );
 }
 
@@ -24 +24 @@
 
 header( 'Content-Type: text/plain; charset=' . get_option( 'blog_charset' ) );
 
-if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) {
+if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === wp_unslash( $_REQUEST['action'] ) ) {
         require ABSPATH . 'wp-admin/includes/ajax-actions.php';
 
         send_nosniff_header();

src/wp-admin/authorize-application.php

@@ -225 +225 @@
 
                                 <div class="form-field">
                                         <label for="app_name"><?php _e( 'New Application Password Name' ); ?></label>
-                                        <input type="text" id="app_name" name="app_name" value="<?php echo esc_attr( $app_name ); ?>" required />
+                                        <input type="text" id="app_name" name="app_name" value="<?php echo esc_attr( $app_name ); ?>" placeholder="<?php esc_attr_e( 'WordPress App on My Phone' ); ?>" required />
                                 </div>
 
                                 <?php

src/wp-admin/edit-comments.php

@@ -30 +30 @@
                 $comment_ids    = $wpdb->get_col( $wpdb->prepare( "SELECT comment_ID FROM $wpdb->comments WHERE comment_approved = %s AND %s > comment_date_gmt", $comment_status, $delete_time ) );
                 $doaction       = 'delete';
         } elseif ( isset( $_REQUEST['delete_comments'] ) ) {
-                $comment_ids = $_REQUEST['delete_comments'];
-                $doaction    = $_REQUEST['action'];
+                $comment_ids = wp_unslash( $_REQUEST['delete_comments'] );
+                $doaction    = wp_unslash( $_REQUEST['action'] );
         } elseif ( isset( $_REQUEST['ids'] ) ) {
                 $comment_ids = array_map( 'absint', explode( ',', $_REQUEST['ids'] ) );
         } elseif ( wp_get_referer() ) {

src/wp-admin/includes/class-wp-list-table.php

@@ -527 +527 @@
                 }
 
                 if ( isset( $_REQUEST['action'] ) && -1 != $_REQUEST['action'] ) {
-                        return $_REQUEST['action'];
+                        return wp_unslash( $_REQUEST['action'] );
                 }
 
                 return false;

src/wp-admin/includes/class-wp-terms-list-table.php

@@ -171 +171 @@
          * @return string
          */
         public function current_action() {
-                if ( isset( $_REQUEST['action'] ) && isset( $_REQUEST['delete_tags'] ) && 'delete' === $_REQUEST['action'] ) {
+                if ( isset( $_REQUEST['action'] ) && isset( $_REQUEST['delete_tags'] ) && 'delete' === wp_unslash( $_REQUEST['action'] ) ) {
                         return 'bulk-delete';
                 }
 

src/wp-admin/nav-menus.php

@@ -49 +49 @@
 $num_locations  = count( array_keys( $locations ) );
 
 // Allowed actions: add, update, delete.
-$action = isset( $_REQUEST['action'] ) ? $_REQUEST['action'] : 'edit';
+$action = isset( $_REQUEST['action'] ) ? wp_unslash( $_REQUEST['action'] ) : 'edit';
 
 /*
  * If a JSON blob of navigation menu data is found, expand it and inject it

src/wp-admin/network/site-info.php

@@ -35 +35 @@
 $parsed_scheme = parse_url( $details->siteurl, PHP_URL_SCHEME );
 $is_main_site  = is_main_site( $id );
 
-if ( isset( $_REQUEST['action'] ) && 'update-site' === $_REQUEST['action'] ) {
+if ( isset( $_REQUEST['action'] ) && 'update-site' === wp_unslash( $_REQUEST['action'] ) ) {
         check_admin_referer( 'edit-site' );
 
         switch_to_blog( $id );

src/wp-admin/network/site-new.php

@@ -33 +33 @@
         '<p>' . __( '<a href="https://wordpress.org/support/forum/multisite/">Support Forums</a>' ) . '</p>'
 );
 
-if ( isset( $_REQUEST['action'] ) && 'add-site' === $_REQUEST['action'] ) {
+if ( isset( $_REQUEST['action'] ) && 'add-site' === wp_unslash( $_REQUEST['action'] ) ) {
         check_admin_referer( 'add-blog', '_wpnonce_add-blog' );
 
         if ( ! is_array( $_POST['blog'] ) ) {

src/wp-admin/network/site-settings.php

@@ -34 +34 @@
 
 $is_main_site = is_main_site( $id );
 
-if ( isset( $_REQUEST['action'] ) && 'update-site' === $_REQUEST['action'] && is_array( $_POST['option'] ) ) {
+if ( isset( $_REQUEST['action'] ) && 'update-site' === wp_unslash( $_REQUEST['action'] ) && is_array( $_POST['option'] ) ) {
         check_admin_referer( 'edit-site' );
 
         switch_to_blog( $id );

src/wp-admin/network/user-new.php

@@ -30 +30 @@
         '<p>' . __( '<a href="https://wordpress.org/support/forum/multisite/">Support Forums</a>' ) . '</p>'
 );
 
-if ( isset( $_REQUEST['action'] ) && 'add-user' === $_REQUEST['action'] ) {
+if ( isset( $_REQUEST['action'] ) && 'add-user' === wp_unslash( $_REQUEST['action'] ) ) {
         check_admin_referer( 'add-user', '_wpnonce_add-user' );
 
         if ( ! current_user_can( 'manage_network_users' ) ) {

src/wp-admin/update.php

@@ -22 +22 @@
 if ( isset( $_GET['action'] ) ) {
         $plugin = isset( $_REQUEST['plugin'] ) ? trim( $_REQUEST['plugin'] ) : '';
         $theme  = isset( $_REQUEST['theme'] ) ? urldecode( $_REQUEST['theme'] ) : '';
-        $action = isset( $_REQUEST['action'] ) ? $_REQUEST['action'] : '';
+        $action = isset( $_REQUEST['action'] ) ? wp_unslash( $_REQUEST['action'] ) : '';
 
         if ( 'update-selected' === $action ) {
                 if ( ! current_user_can( 'update_plugins' ) ) {

src/wp-admin/user-edit.php

@@ -767 +767 @@
                         <div class="create-application-password form-wrap">
                                 <div class="form-field">
                                         <label for="new_application_password_name"><?php _e( 'New Application Password Name' ); ?></label>
-                                        <input type="text" size="30" id="new_application_password_name" name="new_application_password_name" class="input" aria-required="true" aria-describedby="new_application_password_name_desc" />
+                                        <input type="text" size="30" id="new_application_password_name" name="new_application_password_name" placeholder="<?php esc_attr_e( 'WordPress App on My Phone' ); ?>" class="input" aria-required="true" aria-describedby="new_application_password_name_desc" />
                                         <p class="description" id="new_application_password_name_desc"><?php _e( 'Required to create an Application Password, but not to update the user.' ); ?></p>
                                 </div>
 

src/wp-admin/user-new.php

@@ -29 +29 @@
         add_filter( 'wpmu_signup_user_notification_email', 'admin_created_user_email' );
 }
 
-if ( isset( $_REQUEST['action'] ) && 'adduser' === $_REQUEST['action'] ) {
+if ( isset( $_REQUEST['action'] ) && 'adduser' === wp_unslash( $_REQUEST['action'] ) ) {
         check_admin_referer( 'add-user', '_wpnonce_add-user' );
 
         $user_details = null;
@@ -174 +174 @@
         }
         wp_redirect( $redirect );
         die();
-} elseif ( isset( $_REQUEST['action'] ) && 'createuser' === $_REQUEST['action'] ) {
+} elseif ( isset( $_REQUEST['action'] ) && 'createuser' === wp_unslash( $_REQUEST['action'] ) ) {
         check_admin_referer( 'create-user', '_wpnonce_create-user' );
 
         if ( ! current_user_can( 'create_users' ) ) {

src/wp-content/themes/twentytwenty/classes/class-twentytwenty-non-latin-languages.php

@@ -118 +118 @@
                         $elements = apply_filters(
                                 'twentytwenty_get_localized_font_family_elements',
                                 array(
-                                        'front-end'      => array( 'body', 'input', 'textarea', 'button', '.button', '.faux-button', '.wp-block-button__link', '.wp-block-file__button', '.has-drop-cap:not(:focus)::first-letter', '.entry-content .wp-block-archives', '.entry-content .wp-block-categories', '.entry-content .wp-block-cover-image', '.entry-content .wp-block-latest-comments', '.entry-content .wp-block-latest-posts', '.entry-content .wp-block-pullquote', '.entry-content .wp-block-quote.is-large', '.entry-content .wp-block-quote.is-style-large', '.entry-content .wp-block-archives *', '.entry-content .wp-block-categories *', '.entry-content .wp-block-latest-posts *', '.entry-content .wp-block-latest-comments *', '.entry-content p', '.entry-content ol', '.entry-content ul', '.entry-content dl', '.entry-content dt', '.entry-content cite', '.entry-content figcaption', '.entry-content .wp-caption-text', '.comment-content p', '.comment-content ol', '.comment-content ul', '.comment-content dl', '.comment-content dt', '.comment-content cite', '.comment-content figcaption', '.comment-content .wp-caption-text', '.widget_text p', '.widget_text ol', '.widget_text ul', '.widget_text dl', '.widget_text dt', '.widget-content .rssSummary', '.widget-content cite', '.widget-content figcaption', '.widget-content .wp-caption-text' ),
+                                        'front-end'      => array( 'body', 'input', 'textarea', 'button', '.button', '.faux-button', '.wp-block-button__link', '.wp-block-file__button', '.has-drop-cap:not(:focus)::first-letter', '.has-drop-cap:not(:focus)::first-letter', '.entry-content .wp-block-archives', '.entry-content .wp-block-categories', '.entry-content .wp-block-cover-image', '.entry-content .wp-block-latest-comments', '.entry-content .wp-block-latest-posts', '.entry-content .wp-block-pullquote', '.entry-content .wp-block-quote.is-large', '.entry-content .wp-block-quote.is-style-large', '.entry-content .wp-block-archives *', '.entry-content .wp-block-categories *', '.entry-content .wp-block-latest-posts *', '.entry-content .wp-block-latest-comments *', '.entry-content p', '.entry-content ol', '.entry-content ul', '.entry-content dl', '.entry-content dt', '.entry-content cite', '.entry-content figcaption', '.entry-content .wp-caption-text', '.comment-content p', '.comment-content ol', '.comment-content ul', '.comment-content dl', '.comment-content dt', '.comment-content cite', '.comment-content figcaption', '.comment-content .wp-caption-text', '.widget_text p', '.widget_text ol', '.widget_text ul', '.widget_text dl', '.widget_text dt', '.widget-content .rssSummary', '.widget-content cite', '.widget-content figcaption', '.widget-content .wp-caption-text' ),
                                         'block-editor'   => array( '.editor-styles-wrapper > *', '.editor-styles-wrapper p', '.editor-styles-wrapper ol', '.editor-styles-wrapper ul', '.editor-styles-wrapper dl', '.editor-styles-wrapper dt', '.editor-post-title__block .editor-post-title__input', '.editor-styles-wrapper .wp-block h1', '.editor-styles-wrapper .wp-block h2', '.editor-styles-wrapper .wp-block h3', '.editor-styles-wrapper .wp-block h4', '.editor-styles-wrapper .wp-block h5', '.editor-styles-wrapper .wp-block h6', '.editor-styles-wrapper .has-drop-cap:not(:focus)::first-letter', '.editor-styles-wrapper cite', '.editor-styles-wrapper figcaption', '.editor-styles-wrapper .wp-caption-text' ),
                                         'classic-editor' => array( 'body#tinymce.wp-editor', 'body#tinymce.wp-editor p', 'body#tinymce.wp-editor ol', 'body#tinymce.wp-editor ul', 'body#tinymce.wp-editor dl', 'body#tinymce.wp-editor dt', 'body#tinymce.wp-editor figcaption', 'body#tinymce.wp-editor .wp-caption-text', 'body#tinymce.wp-editor .wp-caption-dd', 'body#tinymce.wp-editor cite', 'body#tinymce.wp-editor table' ),
                                 )

src/wp-content/themes/twentytwentyone/inc/template-functions.php

@@ -315 +315 @@
         $elements = apply_filters(
                 'twenty_twenty_one_get_localized_font_family_elements',
                 array(
-                        'front-end'      => array( 'body', 'input', 'textarea', 'button', '.button', '.faux-button', '.wp-block-button__link', '.wp-block-file__button', '.has-drop-cap:not(:focus)::first-letter', '.entry-content .wp-block-archives', '.entry-content .wp-block-categories', '.entry-content .wp-block-cover-image', '.entry-content .wp-block-latest-comments', '.entry-content .wp-block-latest-posts', '.entry-content .wp-block-pullquote', '.entry-content .wp-block-quote.is-large', '.entry-content .wp-block-quote.is-style-large', '.entry-content .wp-block-archives *', '.entry-content .wp-block-categories *', '.entry-content .wp-block-latest-posts *', '.entry-content .wp-block-latest-comments *', '.entry-content p', '.entry-content ol', '.entry-content ul', '.entry-content dl', '.entry-content dt', '.entry-content cite', '.entry-content figcaption', '.entry-content .wp-caption-text', '.comment-content p', '.comment-content ol', '.comment-content ul', '.comment-content dl', '.comment-content dt', '.comment-content cite', '.comment-content figcaption', '.comment-content .wp-caption-text', '.widget_text p', '.widget_text ol', '.widget_text ul', '.widget_text dl', '.widget_text dt', '.widget-content .rssSummary', '.widget-content cite', '.widget-content figcaption', '.widget-content .wp-caption-text' ),
+                        'front-end'      => array( 'body', 'input', 'textarea', 'button', '.button', '.faux-button', '.wp-block-button__link', '.wp-block-file__button', '.has-drop-cap:not(:focus)::first-letter', '.has-drop-cap:not(:focus)::first-letter', '.entry-content .wp-block-archives', '.entry-content .wp-block-categories', '.entry-content .wp-block-cover-image', '.entry-content .wp-block-latest-comments', '.entry-content .wp-block-latest-posts', '.entry-content .wp-block-pullquote', '.entry-content .wp-block-quote.is-large', '.entry-content .wp-block-quote.is-style-large', '.entry-content .wp-block-archives *', '.entry-content .wp-block-categories *', '.entry-content .wp-block-latest-posts *', '.entry-content .wp-block-latest-comments *', '.entry-content p', '.entry-content ol', '.entry-content ul', '.entry-content dl', '.entry-content dt', '.entry-content cite', '.entry-content figcaption', '.entry-content .wp-caption-text', '.comment-content p', '.comment-content ol', '.comment-content ul', '.comment-content dl', '.comment-content dt', '.comment-content cite', '.comment-content figcaption', '.comment-content .wp-caption-text', '.widget_text p', '.widget_text ol', '.widget_text ul', '.widget_text dl', '.widget_text dt', '.widget-content .rssSummary', '.widget-content cite', '.widget-content figcaption', '.widget-content .wp-caption-text' ),
                         'block-editor'   => array( '.editor-styles-wrapper > *', '.editor-styles-wrapper p', '.editor-styles-wrapper ol', '.editor-styles-wrapper ul', '.editor-styles-wrapper dl', '.editor-styles-wrapper dt', '.editor-post-title__block .editor-post-title__input', '.editor-styles-wrapper .wp-block h1', '.editor-styles-wrapper .wp-block h2', '.editor-styles-wrapper .wp-block h3', '.editor-styles-wrapper .wp-block h4', '.editor-styles-wrapper .wp-block h5', '.editor-styles-wrapper .wp-block h6', '.editor-styles-wrapper .has-drop-cap:not(:focus)::first-letter', '.editor-styles-wrapper cite', '.editor-styles-wrapper figcaption', '.editor-styles-wrapper .wp-caption-text' ),
                         'classic-editor' => array( 'body#tinymce.wp-editor', 'body#tinymce.wp-editor p', 'body#tinymce.wp-editor ol', 'body#tinymce.wp-editor ul', 'body#tinymce.wp-editor dl', 'body#tinymce.wp-editor dt', 'body#tinymce.wp-editor figcaption', 'body#tinymce.wp-editor .wp-caption-text', 'body#tinymce.wp-editor .wp-caption-dd', 'body#tinymce.wp-editor cite', 'body#tinymce.wp-editor table' ),
                 )

src/wp-includes/class-http.php

@@ -881 +881 @@
                 $home = parse_url( get_option( 'siteurl' ) );
 
                 // Don't block requests back to ourselves by default.
-                if ( 'localhost' === $check['host'] || ( isset( $home['host'] ) && $home['host'] === $check['host'] ) ) {
+                if ( 'localhost' === $check['host'] || ( isset( $home['host'] ) && $home['host'] == $check['host'] ) ) {
                         /**
                          * Filters whether to block local HTTP API requests.
                          *

src/wp-includes/class-wp-admin-bar.php

@@ -18 +18 @@
         public $user;
 
         /**
-         * @since 3.3.0
-         *
          * @param string $name
          * @return string|array|void
          */
@@ -35 +33 @@
         }
 
         /**
-         * Initializes the admin bar.
-         *
-         * @since 3.1.0
          */
         public function initialize() {
                 $this->user = new stdClass;
@@ -87 +82 @@
         }
 
         /**
-         * Adds a node (menu item) to the admin bar menu.
+         * Add a node (menu item) to the Admin Bar menu.
          *
          * @since 3.3.0
          *
@@ -98 +93 @@
         }
 
         /**
-         * Removes a node from the admin bar.
+         * Remove a node from the admin bar.
          *
          * @since 3.1.0
          *
@@ -184 +179 @@
         }
 
         /**
-         * @since 3.3.0
-         *
          * @param array $args
          */
         final protected function _set_node( $args ) {
@@ -195 +188 @@
         /**
          * Gets a node.
          *
-         * @since 3.3.0
-         *
          * @param string $id
          * @return object|void Node.
          */
@@ -208 +199 @@
         }
 
         /**
-         * @since 3.3.0
-         *
          * @param string $id
          * @return object|void
          */
@@ -228 +217 @@
         }
 
         /**
-         * @since 3.3.0
-         *
          * @return array|void
          */
         final public function get_nodes() {
@@ -245 +232 @@
         }
 
         /**
-         * @since 3.3.0
-         *
          * @return array|void
          */
         final protected function _get_nodes() {
@@ -258 +243 @@
         }
 
         /**
-         * Adds a group to a toolbar menu node.
+         * Add a group to a toolbar menu node.
          *
          * Groups can be used to organize toolbar items into distinct sections of a toolbar menu.
          *
@@ -282 +267 @@
         /**
          * Remove a node.
          *
-         * @since 3.1.0
-         *
          * @param string $id The ID of the item.
          */
         public function remove_node( $id ) {
@@ -291 +274 @@
         }
 
         /**
-         * @since 3.3.0
-         *
          * @param string $id
          */
         final protected function _unset_node( $id ) {
@@ -300 +281 @@
         }
 
         /**
-         * @since 3.1.0
          */
         public function render() {
                 $root = $this->_bind();
@@ -310 +290 @@
         }
 
         /**
-         * @since 3.3.0
-         *
          * @return object|void
          */
         final protected function _bind() {
@@ -448 +426 @@
         }
 
         /**
-         * @since 3.3.0
-         *
          * @param object $root
          */
         final protected function _render( $root ) {
@@ -481 +457 @@
         }
 
         /**
-         * @since 3.3.0
-         *
          * @param object $node
          */
         final protected function _render_container( $node ) {
@@ -498 +472 @@
         }
 
         /**
-         * @since 3.3.0
-         *
          * @param object $node
          */
         final protected function _render_group( $node ) {
@@ -525 +497 @@
         }
 
         /**
-         * @since 3.3.0
-         *
          * @param object $node
          */
         final protected function _render_item( $node ) {
@@ -626 +596 @@
         }
 
         /**
-         * Adds menus to the admin bar.
-         *
-         * @since 3.1.0
          */
         public function add_menus() {
                 // User-related, aligned right.

src/wp-includes/class-wp-http-ixr-client.php

@@ -97 +97 @@
                         return false;
                 }
 
-                if ( 200 !== wp_remote_retrieve_response_code( $response ) ) {
+                if ( 200 != wp_remote_retrieve_response_code( $response ) ) {
                         $this->error = new IXR_Error( -32301, 'transport error - HTTP status code was not 200 (' . wp_remote_retrieve_response_code( $response ) . ')' );
                         return false;
                 }

src/wp-login.php

@@ -364 +364 @@
 // Main.
 //
 
-$action = isset( $_REQUEST['action'] ) ? $_REQUEST['action'] : 'login';
+$action = isset( $_REQUEST['action'] ) ? wp_unslash( $_REQUEST['action'] ) : 'login';
 $errors = new WP_Error();
 
 if ( isset( $_GET['key'] ) ) {