Changeset 54552
- Timestamp:
- 10/17/2022 05:53:02 PM (2 years ago)
- Location:
- branches/4.1
- Files:
-
- 8 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/4.1
- Property svn:mergeinfo changed
/trunk merged: 54521-54523,54525,54527,54529-54530,54541
- Property svn:mergeinfo changed
-
branches/4.1/src/wp-includes/comment.php
r30681 r54552 2201 2201 return 0; 2202 2202 } 2203 2204 $filter_comment = false; 2205 if ( ! has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) { 2206 $filter_comment = ! user_can( isset( $comment['user_id'] ) ? $comment['user_id'] : 0, 'unfiltered_html' ); 2207 } 2208 2209 if ( $filter_comment ) { 2210 add_filter( 'pre_comment_content', 'wp_filter_kses' ); 2211 } 2212 2203 2213 // Escape data pulled from DB. 2204 2214 $comment = wp_slash($comment); … … 2210 2220 2211 2221 $commentarr = wp_filter_comment( $commentarr ); 2222 2223 if ( $filter_comment ) { 2224 remove_filter( 'pre_comment_content', 'wp_filter_kses' ); 2225 } 2212 2226 2213 2227 // Now extract the merged array. -
branches/4.1/src/wp-includes/date.php
r31396 r54552 142 142 public function __construct( $date_query, $default_column = 'post_date' ) { 143 143 144 if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] )) {145 $this->relation = 'OR';144 if ( isset( $date_query['relation'] ) ) { 145 $this->relation = $this->sanitize_relation( $date_query['relation'] ); 146 146 } else { 147 147 $this->relation = 'AND'; … … 224 224 $this->validate_date_values( $queries ); 225 225 } 226 227 // Sanitize the relation parameter. 228 $queries['relation'] = $this->sanitize_relation( $queries['relation'] ); 226 229 227 230 foreach ( $queries as $key => $q ) { … … 1003 1006 return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time ); 1004 1007 } 1008 1009 /** 1010 * Sanitizes a 'relation' operator. 1011 * 1012 * @since 6.0.3 1013 * 1014 * @param string $relation Raw relation key from the query argument. 1015 * @return string Sanitized relation ('AND' or 'OR'). 1016 */ 1017 public function sanitize_relation( $relation ) { 1018 if ( 'OR' === strtoupper( $relation ) ) { 1019 return 'OR'; 1020 } else { 1021 return 'AND'; 1022 } 1023 } 1005 1024 } -
branches/4.1/src/wp-includes/default-widgets.php
r33530 r54552 1019 1019 if ( is_wp_error($rss) ) { 1020 1020 if ( is_admin() || current_user_can('manage_options') ) 1021 echo '<p>' . sprintf( __('<strong>RSS Error</strong>: %s'), $rss->get_error_message() ) . '</p>';1021 echo '<p>' . sprintf( __('<strong>RSS Error</strong>: %s'), esc_html( $rss->get_error_message() ) ) . '</p>'; 1022 1022 return; 1023 1023 } … … 1129 1129 1130 1130 if ( ! empty( $args['error'] ) ) { 1131 echo '<p class="widget-error"><strong>' . sprintf( __( 'RSS Error: %s' ), $args['error']) . '</strong></p>';1131 echo '<p class="widget-error"><strong>' . sprintf( __( 'RSS Error: %s' ), esc_html( $args['error'] ) ) . '</strong></p>'; 1132 1132 } 1133 1133 -
branches/4.1/src/wp-includes/functions.php
r46501 r54552 2435 2435 } else { 2436 2436 $html = __( 'Are you sure you want to do this?' ); 2437 if ( wp_get_referer() ) 2438 $html .= "</p><p><a href='" . esc_url( remove_query_arg( 'updated', wp_get_referer() ) ) . "'>" . __( 'Please try again.' ) . "</a>"; 2437 if ( wp_get_referer() ) { 2438 $wp_http_referer = remove_query_arg( 'updated', wp_get_referer() ); 2439 $wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) ); 2440 $html .= '</p><p>'; 2441 $html .= sprintf( 2442 '<a href="%s">%s</a>', 2443 esc_url( $wp_http_referer ), 2444 __( 'Please try again.' ) 2445 ); 2446 } 2439 2447 } 2440 2448 -
branches/4.1/src/wp-includes/pluggable.php
r47969 r54552 350 350 $phpmailer->ClearCustomHeaders(); 351 351 $phpmailer->ClearReplyTos(); 352 $phpmailer->Body = ''; 353 $phpmailer->AltBody = ''; 352 354 353 355 // From email and name -
branches/4.1/src/wp-mail.php
r39779 r54552 60 60 wp_die( __('There doesn’t seem to be any new mail.') ); 61 61 } 62 63 // Always run as an unauthenticated user. 64 wp_set_current_user( 0 ); 62 65 63 66 for ( $i = 1; $i <= $count; $i++ ) { … … 126 129 $author = sanitize_email($author); 127 130 if ( is_email($author) ) { 128 echo '<p>' . sprintf(__('Author is %s'), $author) . '</p>';129 131 $userdata = get_user_by('email', $author); 130 132 if ( ! empty( $userdata ) ) { -
branches/4.1/src/wp-trackback.php
r30662 r54552 13 13 wp( array( 'tb' => '1' ) ); 14 14 } 15 16 // Always run as an unauthenticated user. 17 wp_set_current_user( 0 ); 15 18 16 19 /**
Note: See TracChangeset
for help on using the changeset viewer.