Make WordPress Core


Ignore:
Timestamp:
10/29/2020 07:04:00 PM (5 years ago)
Author:
whyisjake
Message:

General: WordPress updates

  • XML-RPC: Improve error messages for unprivileged users.
  • External Libraries: Disable deserialization in Requests_Utility_FilteredIterator
  • Embeds: Disable embeds on deactivated Multisite sites.
  • Coding standards: Modify escaping functions to avoid potential false positives.
  • XML-RPC: Return error message if attachment ID is incorrect.
  • Upgrade/install: Improve logic check when determining installation status.
  • Meta: Sanitize meta key before checking protection status.
  • Themes: Ensure that only privileged users can set a background image when a theme is using the deprecated custom background page.

Brings the changes from [49380,49382-49388] to the 4.4 branch.

Props xknown, zieladam, peterwilsoncc, whyisjake, desrosj, dd32.

Location:
branches/4.4
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.4

  • branches/4.4/src/wp-admin/includes/template.php

    r41434 r49402  
    15831583addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
    15841584function tb_close(){var win=window.dialogArguments||opener||parent||top;win.tb_remove();}
    1585 var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
    1586     pagenow = '<?php echo $current_screen->id; ?>',
    1587     typenow = '<?php echo $current_screen->post_type; ?>',
    1588     adminpage = '<?php echo $admin_body_class; ?>',
    1589     thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
    1590     decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
     1585var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
     1586    pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
     1587    typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
     1588    adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
     1589    thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
     1590    decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
    15911591    isRtl = <?php echo (int) is_rtl(); ?>;
    15921592</script>
Note: See TracChangeset for help on using the changeset viewer.