Changeset 54548 for branches/5.8
- Timestamp:
- 10/17/2022 05:46:39 PM (2 years ago)
- Location:
- branches/5.8
- Files:
-
- 22 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/5.8
- Property svn:mergeinfo changed
/trunk merged: 54397,54521-54530,54541
- Property svn:mergeinfo changed
-
branches/5.8/src/wp-admin/includes/ajax-actions.php
r51983 r54548 2975 2975 // Filter query clauses to include filenames. 2976 2976 if ( isset( $query['s'] ) ) { 2977 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );2977 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 2978 2978 } 2979 2979 -
branches/5.8/src/wp-admin/includes/post.php
r51116 r54548 1285 1285 // Filter query clauses to include filenames. 1286 1286 if ( isset( $q['s'] ) ) { 1287 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );1287 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 1288 1288 } 1289 1289 -
branches/5.8/src/wp-includes/class-wp-date-query.php
r49672 r54548 150 150 } 151 151 152 if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] )) {153 $this->relation = 'OR';152 if ( isset( $date_query['relation'] ) ) { 153 $this->relation = $this->sanitize_relation( $date_query['relation'] ); 154 154 } else { 155 155 $this->relation = 'AND'; … … 219 219 $this->validate_date_values( $queries ); 220 220 } 221 222 // Sanitize the relation parameter. 223 $queries['relation'] = $this->sanitize_relation( $queries['relation'] ); 221 224 222 225 foreach ( $queries as $key => $q ) { … … 1040 1043 return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time ); 1041 1044 } 1045 1046 /** 1047 * Sanitizes a 'relation' operator. 1048 * 1049 * @since 6.0.3 1050 * 1051 * @param string $relation Raw relation key from the query argument. 1052 * @return string Sanitized relation ('AND' or 'OR'). 1053 */ 1054 public function sanitize_relation( $relation ) { 1055 if ( 'OR' === strtoupper( $relation ) ) { 1056 return 'OR'; 1057 } else { 1058 return 'AND'; 1059 } 1060 } 1042 1061 } -
branches/5.8/src/wp-includes/class-wp-query.php
r50576 r54548 445 445 public $thumbnails_cached = false; 446 446 447 /** 448 * Controls whether an attachment query should include filenames or not. 449 * 450 * @since 6.0.3 451 * @var bool 452 */ 453 protected $allow_query_attachment_by_filename = false; 447 454 /** 448 455 * Cached list of search stopwords. … … 1395 1402 1396 1403 $like = $n . $wpdb->esc_like( $term ) . $n; 1397 $search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s))", $like, $like, $like ); 1404 1405 if ( ! empty( $this->allow_query_attachment_by_filename ) ) { 1406 $search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s) $andor_op (sq1.meta_value $like_op %s))", $like, $like, $like, $like ); 1407 } else { 1408 $search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s))", $like, $like, $like ); 1409 } 1398 1410 $searchand = ' AND '; 1399 1411 } … … 1790 1802 $q = $this->fill_query_vars( $q ); 1791 1803 1804 /** 1805 * Filters whether an attachment query should include filenames or not. 1806 * 1807 * @since 6.0.3 1808 * 1809 * @param bool $allow_query_attachment_by_filename Whether or not to include filenames. 1810 */ 1811 $this->allow_query_attachment_by_filename = apply_filters( 'wp_allow_query_attachment_by_filename', false ); 1812 remove_all_filters( 'wp_allow_query_attachment_by_filename' ); 1813 1792 1814 // Parse meta query. 1793 1815 $this->meta_query = new WP_Meta_Query(); … … 2221 2243 } 2222 2244 2223 if ( ! empty( $this->tax_query->queries ) || ! empty( $this->meta_query->queries ) ) {2245 if ( ! empty( $this->tax_query->queries ) || ! empty( $this->meta_query->queries ) || ! empty( $this->allow_query_attachment_by_filename ) ) { 2224 2246 $groupby = "{$wpdb->posts}.ID"; 2225 2247 } … … 2297 2319 } 2298 2320 $where .= $search . $whichauthor . $whichmimetype; 2321 2322 if ( ! empty( $this->allow_query_attachment_by_filename ) ) { 2323 $join .= " LEFT JOIN {$wpdb->postmeta} AS sq1 ON ( {$wpdb->posts}.ID = sq1.post_id AND sq1.meta_key = '_wp_attached_file' )"; 2324 } 2299 2325 2300 2326 if ( ! empty( $this->meta_query->queries ) ) { -
branches/5.8/src/wp-includes/comment.php
r50641 r54548 2467 2467 } 2468 2468 2469 $filter_comment = false; 2470 if ( ! has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) { 2471 $filter_comment = ! user_can( isset( $comment['user_id'] ) ? $comment['user_id'] : 0, 'unfiltered_html' ); 2472 } 2473 2474 if ( $filter_comment ) { 2475 add_filter( 'pre_comment_content', 'wp_filter_kses' ); 2476 } 2477 2469 2478 // Escape data pulled from DB. 2470 2479 $comment = wp_slash( $comment ); … … 2476 2485 2477 2486 $commentarr = wp_filter_comment( $commentarr ); 2487 2488 if ( $filter_comment ) { 2489 remove_filter( 'pre_comment_content', 'wp_filter_kses' ); 2490 } 2478 2491 2479 2492 // Now extract the merged array. -
branches/5.8/src/wp-includes/customize/class-wp-customize-header-image-control.php
r48834 r54548 131 131 132 132 <button type="button" class="choice thumbnail" 133 data-customize-image-value="{{ {data.header.url}}}"133 data-customize-image-value="{{data.header.url}}" 134 134 data-customize-header-image-data="{{JSON.stringify(data.header)}}"> 135 135 <span class="screen-reader-text"><?php _e( 'Set image' ); ?></span> 136 <img src="{{ {data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}" />136 <img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" /> 137 137 </button> 138 138 … … 159 159 <# } else { #> 160 160 161 <img src="{{ {data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}" />161 <img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" /> 162 162 163 163 <# } #> -
branches/5.8/src/wp-includes/customize/class-wp-customize-site-icon-control.php
r50556 r54548 69 69 <img src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>" /> 70 70 </div> 71 <span class="browser-title" aria-hidden="true"><# print( '<?php bloginfo( 'name'); ?>' ) #></span>71 <span class="browser-title" aria-hidden="true"><# print( '<?php echo esc_js( get_bloginfo( 'name' ) ); ?>' ) #></span> 72 72 </div> 73 73 <img class="app-icon-preview" src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as an app icon' ); ?>" /> -
branches/5.8/src/wp-includes/deprecated.php
r51382 r54548 4225 4225 return _excerpt_render_inner_blocks( $columns, $allowed_blocks ); 4226 4226 } 4227 4228 /** 4229 * Filter the SQL clauses of an attachment query to include filenames. 4230 * 4231 * @since 4.7.0 4232 * @deprecated 6.0.3 4233 * @access private 4234 * 4235 * @param array $clauses An array including WHERE, GROUP BY, JOIN, ORDER BY, 4236 * DISTINCT, fields (SELECT), and LIMITS clauses. 4237 * @return array The unmodified clauses. 4238 */ 4239 function _filter_query_attachment_filenames( $clauses ) { 4240 _deprecated_function( __FUNCTION__, '6.0.3', 'add_filter( "wp_allow_query_attachment_by_filename", "__return_true" )'); 4241 remove_filter( 'posts_clauses', __FUNCTION__ ); 4242 return $clauses; 4243 } 4244 -
branches/5.8/src/wp-includes/functions.php
r51741 r54548 3467 3467 $html = __( 'The link you followed has expired.' ); 3468 3468 if ( wp_get_referer() ) { 3469 $wp_http_referer = remove_query_arg( 'updated', wp_get_referer() ); 3470 $wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) ); 3469 3471 $html .= '</p><p>'; 3470 3472 $html .= sprintf( 3471 3473 '<a href="%s">%s</a>', 3472 esc_url( remove_query_arg( 'updated', wp_get_referer() )),3474 esc_url( $wp_http_referer ), 3473 3475 __( 'Please try again.' ) 3474 3476 ); -
branches/5.8/src/wp-includes/media-template.php
r50556 r54548 1494 1494 <img id="preview-favicon" src="{{ data.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>" /> 1495 1495 </div> 1496 <span class="browser-title" aria-hidden="true"><# print( '<?php bloginfo( 'name'); ?>' ) #></span>1496 <span class="browser-title" aria-hidden="true"><# print( '<?php echo esc_js( get_bloginfo( 'name' ) ); ?>' ) #></span> 1497 1497 </div> 1498 1498 -
branches/5.8/src/wp-includes/pluggable.php
r50952 r54548 92 92 * @since 2.8.0 93 93 * @since 4.4.0 Added 'ID' as an alias of 'id' for the `$field` parameter. 94 * @since 5.8.0 Returns the global `$current_user` if it's the user being fetched.95 94 * 96 95 * @global WP_User $current_user The current user object which holds the user data. … … 101 100 */ 102 101 function get_user_by( $field, $value ) { 103 global $current_user;104 105 102 $userdata = WP_User::get_data_by( $field, $value ); 106 103 107 104 if ( ! $userdata ) { 108 105 return false; 109 }110 111 if ( $current_user instanceof WP_User && $current_user->ID === (int) $userdata->ID ) {112 return $current_user;113 106 } 114 107 … … 362 355 $phpmailer->clearCustomHeaders(); 363 356 $phpmailer->clearReplyTos(); 357 $phpmailer->Body = ''; 358 $phpmailer->AltBody = ''; 364 359 365 360 // Set "From" name and email. -
branches/5.8/src/wp-includes/post.php
r52465 r54548 7696 7696 7697 7697 /** 7698 * Filters the SQL clauses of an attachment query to include filenames.7699 *7700 * @since 4.7.07701 * @access private7702 *7703 * @global wpdb $wpdb WordPress database abstraction object.7704 *7705 * @param string[] $clauses An array including WHERE, GROUP BY, JOIN, ORDER BY,7706 * DISTINCT, fields (SELECT), and LIMITS clauses.7707 * @return string[] The modified array of clauses.7708 */7709 function _filter_query_attachment_filenames( $clauses ) {7710 global $wpdb;7711 remove_filter( 'posts_clauses', __FUNCTION__ );7712 7713 // Add a LEFT JOIN of the postmeta table so we don't trample existing JOINs.7714 $clauses['join'] .= " LEFT JOIN {$wpdb->postmeta} AS sq1 ON ( {$wpdb->posts}.ID = sq1.post_id AND sq1.meta_key = '_wp_attached_file' )";7715 7716 $clauses['groupby'] = "{$wpdb->posts}.ID";7717 7718 $clauses['where'] = preg_replace(7719 "/\({$wpdb->posts}.post_content (NOT LIKE|LIKE) (\'[^']+\')\)/",7720 '$0 OR ( sq1.meta_value $1 $2 )',7721 $clauses['where']7722 );7723 7724 return $clauses;7725 }7726 7727 /**7728 7698 * Sets the last changed time for the 'posts' cache group. 7729 7699 * -
branches/5.8/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
r51000 r54548 90 90 // Filter query clauses to include filenames. 91 91 if ( isset( $query_args['s'] ) ) { 92 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );92 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 93 93 } 94 94 -
branches/5.8/src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php
r51295 r54548 136 136 137 137 /** 138 * Checks if the terms for a post can be read. 139 * 140 * @since 6.0.3 141 * 142 * @param WP_Post $post Post object. 143 * @param WP_REST_Request $request Full details about the request. 144 * @return bool Whether the terms for the post can be read. 145 */ 146 public function check_read_terms_permission_for_post( $post, $request ) { 147 // If the requested post isn't associated with this taxonomy, deny access. 148 if ( ! is_object_in_taxonomy( $post->post_type, $this->taxonomy ) ) { 149 return false; 150 } 151 152 // Grant access if the post is publicly viewable. 153 if ( is_post_publicly_viewable( $post ) ) { 154 return true; 155 } 156 157 // Otherwise grant access if the post is readable by the logged in user. 158 if ( current_user_can( 'read_post', $post->ID ) ) { 159 return true; 160 } 161 162 // Otherwise, deny access. 163 return false; 164 } 165 166 /** 138 167 * Checks if a request has access to read terms in the specified taxonomy. 139 168 * … … 156 185 array( 'status' => rest_authorization_required_code() ) 157 186 ); 187 } 188 189 if ( ! empty( $request['post'] ) ) { 190 $post = get_post( $request['post'] ); 191 192 if ( ! $post ) { 193 return new WP_Error( 194 'rest_post_invalid_id', 195 __( 'Invalid post ID.' ), 196 array( 197 'status' => 400, 198 ) 199 ); 200 } 201 202 if ( ! $this->check_read_terms_permission_for_post( $post, $request ) ) { 203 return new WP_Error( 204 'rest_forbidden_context', 205 __( 'Sorry, you are not allowed to view terms for this post.' ), 206 array( 207 'status' => rest_authorization_required_code(), 208 ) 209 ); 210 } 158 211 } 159 212 -
branches/5.8/src/wp-includes/user.php
r51411 r54548 1572 1572 * @since 3.0.0 1573 1573 * @since 4.4.0 'clean_user_cache' action was added. 1574 * @since 5.8.0 Refreshes the global user instance if cleaning the user cache for the current user.1575 *1576 * @global WP_User $current_user The current user object which holds the user data.1577 1574 * 1578 1575 * @param WP_User|int $user User object or ID to be cleaned from the cache 1579 1576 */ 1580 1577 function clean_user_cache( $user ) { 1581 global $current_user;1582 1583 1578 if ( is_numeric( $user ) ) { 1584 1579 $user = new WP_User( $user ); … … 1603 1598 */ 1604 1599 do_action( 'clean_user_cache', $user->ID, $user ); 1605 1606 // Refresh the global user instance if the cleaning current user.1607 if ( get_current_user_id() === (int) $user->ID ) {1608 $user_id = (int) $user->ID;1609 $current_user = null;1610 wp_set_current_user( $user_id, '' );1611 }1612 1600 } 1613 1601 -
branches/5.8/src/wp-includes/widgets.php
r51394 r54548 1535 1535 if ( is_wp_error( $rss ) ) { 1536 1536 if ( is_admin() || current_user_can( 'manage_options' ) ) { 1537 echo '<p><strong>' . __( 'RSS Error:' ) . '</strong> ' . $rss->get_error_message() . '</p>';1537 echo '<p><strong>' . __( 'RSS Error:' ) . '</strong> ' . esc_html( $rss->get_error_message() ) . '</p>'; 1538 1538 } 1539 1539 return; … … 1658 1658 1659 1659 if ( ! empty( $args['error'] ) ) { 1660 echo '<p class="widget-error"><strong>' . __( 'RSS Error:' ) . '</strong> ' . $args['error']. '</p>';1660 echo '<p class="widget-error"><strong>' . __( 'RSS Error:' ) . '</strong> ' . esc_html( $args['error'] ) . '</p>'; 1661 1661 } 1662 1662 -
branches/5.8/src/wp-mail.php
r47580 r54548 65 65 wp_die( __( 'There doesn’t seem to be any new mail.' ) ); 66 66 } 67 68 // Always run as an unauthenticated user. 69 wp_set_current_user( 0 ); 67 70 68 71 for ( $i = 1; $i <= $count; $i++ ) { … … 132 135 $author = sanitize_email( $author ); 133 136 if ( is_email( $author ) ) { 134 /* translators: %s: Post author email address. */135 echo '<p>' . sprintf( __( 'Author is %s' ), $author ) . '</p>';136 137 $userdata = get_user_by( 'email', $author ); 137 138 if ( ! empty( $userdata ) ) { -
branches/5.8/src/wp-trackback.php
r49108 r54548 13 13 wp( array( 'tb' => '1' ) ); 14 14 } 15 16 // Always run as an unauthenticated user. 17 wp_set_current_user( 0 ); 15 18 16 19 /** -
branches/5.8/tests/phpunit/tests/pluggable.php
r50916 r54548 324 324 return $signatures; 325 325 } 326 327 /**328 * @ticket 28020329 */330 public function test_get_user_by_should_return_same_instance_as_wp_get_current_user() {331 // Create a test user.332 $new_user = self::factory()->user->create( array( 'role' => 'subscriber' ) );333 334 // Set the test user as the current user.335 $current_user = wp_set_current_user( $new_user );336 337 // Get the test user using get_user_by().338 $from_get_user_by = get_user_by( 'id', $new_user );339 340 $this->assertSame( $current_user, $from_get_user_by );341 }342 326 } -
branches/5.8/tests/phpunit/tests/query/search.php
r50463 r54548 455 455 456 456 add_post_meta( $attachment, '_wp_attached_file', 'some-image1.png', true ); 457 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );457 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 458 458 459 459 // Pass post_type a string value. … … 485 485 486 486 add_post_meta( $attachment, '_wp_attached_file', 'some-image2.png', true ); 487 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );487 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 488 488 489 489 // Pass post_type an array value. … … 544 544 add_post_meta( $attachment, '_wp_attached_file', 'some-image4.png', true ); 545 545 add_post_meta( $attachment, '_test_meta_key', 'value', true ); 546 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );546 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 547 547 548 548 // Pass post_type a string value. … … 584 584 585 585 add_post_meta( $attachment, '_wp_attached_file', 'some-image5.png', true ); 586 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );586 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 587 587 588 588 // Pass post_type a string value. … … 609 609 * @ticket 22744 610 610 */ 611 public function test_filter_query_attachment_filenames_unhooks_itself() { 612 add_filter( 'posts_clauses', '_filter_query_attachment_filenames' ); 613 614 apply_filters( 615 'posts_clauses', 616 array( 617 'where' => '', 618 'groupby' => '', 619 'join' => '', 620 'orderby' => '', 621 'distinct' => '', 622 'fields' => '', 623 'limit' => '', 624 ) 625 ); 626 627 $result = has_filter( 'posts_clauses', '_filter_query_attachment_filenames' ); 628 629 $this->assertFalse( $result ); 611 public function test_wp_query_removes_filter_wp_allow_query_attachment_by_filename() { 612 $attachment = self::factory()->post->create( 613 array( 614 'post_type' => 'attachment', 615 'post_status' => 'publish', 616 'post_title' => 'bar foo', 617 'post_content' => 'foo bar', 618 'post_excerpt' => 'This post has foo', 619 ) 620 ); 621 622 add_post_meta( $attachment, '_wp_attached_file', 'some-image1.png', true ); 623 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 624 625 $q = new WP_Query( 626 array( 627 's' => 'image1', 628 'fields' => 'ids', 629 'post_type' => 'attachment', 630 'post_status' => 'inherit', 631 ) 632 ); 633 634 $this->assertSame( array( $attachment ), $q->posts ); 635 636 /* 637 * WP_Query should have removed the wp_allow_query_attachment_by_filename filter 638 * and thus not match the attachment created above 639 */ 640 $q->get_posts(); 641 $this->assertEmpty( $q->posts ); 630 642 } 631 643 -
branches/5.8/tests/phpunit/tests/rest-api/rest-comments-controller.php
r49603 r54548 2973 2973 'author_name' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>', 2974 2974 'author_user_agent' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>', 2975 'author' => self::$editor_id, 2975 2976 ), 2976 2977 array( … … 2981 2982 'author_name' => 'div strong', 2982 2983 'author_user_agent' => 'div strong', 2984 'author' => self::$editor_id, 2983 2985 ) 2984 2986 ); … … 2990 2992 'author_name' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>', 2991 2993 'author_user_agent' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>', 2994 'author' => self::$editor_id, 2992 2995 ), 2993 2996 array( … … 2998 3001 'author_name' => 'div strong', 2999 3002 'author_user_agent' => 'div strong', 3003 'author' => self::$editor_id, 3000 3004 ) 3001 3005 ); … … 3012 3016 'author_name' => '\\\&\\\ & &invalid; < < &lt;', 3013 3017 'author_user_agent' => '\\\&\\\ & &invalid; < < &lt;', 3018 'author' => self::$superadmin_id, 3014 3019 ), 3015 3020 array( … … 3020 3025 'author_name' => '\\\&\\\ & &invalid; < < &lt;', 3021 3026 'author_user_agent' => '\\\&\\\ & &invalid; < < &lt;', 3027 'author' => self::$superadmin_id, 3022 3028 ) 3023 3029 ); … … 3033 3039 'author_name' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>', 3034 3040 'author_user_agent' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>', 3041 'author' => self::$superadmin_id, 3035 3042 ), 3036 3043 array( … … 3041 3048 'author_name' => 'div strong', 3042 3049 'author_user_agent' => 'div strong', 3050 'author' => self::$superadmin_id, 3043 3051 ) 3044 3052 );
Note: See TracChangeset
for help on using the changeset viewer.