Changeset 54553 for branches/5.7
- Timestamp:
- 10/17/2022 05:53:05 PM (2 years ago)
- Location:
- branches/5.7
- Files:
-
- 20 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/5.7
- Property svn:mergeinfo changed
/trunk merged: 54521-54530,54541
- Property svn:mergeinfo changed
-
branches/5.7/src/wp-admin/includes/ajax-actions.php
r50390 r54553 2975 2975 // Filter query clauses to include filenames. 2976 2976 if ( isset( $query['s'] ) ) { 2977 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );2977 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 2978 2978 } 2979 2979 -
branches/5.7/src/wp-admin/includes/post.php
r50297 r54553 1270 1270 // Filter query clauses to include filenames. 1271 1271 if ( isset( $q['s'] ) ) { 1272 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );1272 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 1273 1273 } 1274 1274 -
branches/5.7/src/wp-includes/class-wp-date-query.php
r49672 r54553 150 150 } 151 151 152 if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] )) {153 $this->relation = 'OR';152 if ( isset( $date_query['relation'] ) ) { 153 $this->relation = $this->sanitize_relation( $date_query['relation'] ); 154 154 } else { 155 155 $this->relation = 'AND'; … … 219 219 $this->validate_date_values( $queries ); 220 220 } 221 222 // Sanitize the relation parameter. 223 $queries['relation'] = $this->sanitize_relation( $queries['relation'] ); 221 224 222 225 foreach ( $queries as $key => $q ) { … … 1040 1043 return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time ); 1041 1044 } 1045 1046 /** 1047 * Sanitizes a 'relation' operator. 1048 * 1049 * @since 6.0.3 1050 * 1051 * @param string $relation Raw relation key from the query argument. 1052 * @return string Sanitized relation ('AND' or 'OR'). 1053 */ 1054 public function sanitize_relation( $relation ) { 1055 if ( 'OR' === strtoupper( $relation ) ) { 1056 return 'OR'; 1057 } else { 1058 return 'AND'; 1059 } 1060 } 1042 1061 } -
branches/5.7/src/wp-includes/class-wp-query.php
r49946 r54553 445 445 public $thumbnails_cached = false; 446 446 447 /** 448 * Controls whether an attachment query should include filenames or not. 449 * 450 * @since 6.0.3 451 * @var bool 452 */ 453 protected $allow_query_attachment_by_filename = false; 447 454 /** 448 455 * Cached list of search stopwords. … … 1395 1402 1396 1403 $like = $n . $wpdb->esc_like( $term ) . $n; 1397 $search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s))", $like, $like, $like ); 1404 1405 if ( ! empty( $this->allow_query_attachment_by_filename ) ) { 1406 $search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s) $andor_op (sq1.meta_value $like_op %s))", $like, $like, $like, $like ); 1407 } else { 1408 $search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s))", $like, $like, $like ); 1409 } 1398 1410 $searchand = ' AND '; 1399 1411 } … … 1790 1802 $q = $this->fill_query_vars( $q ); 1791 1803 1804 /** 1805 * Filters whether an attachment query should include filenames or not. 1806 * 1807 * @since 6.0.3 1808 * 1809 * @param bool $allow_query_attachment_by_filename Whether or not to include filenames. 1810 */ 1811 $this->allow_query_attachment_by_filename = apply_filters( 'wp_allow_query_attachment_by_filename', false ); 1812 remove_all_filters( 'wp_allow_query_attachment_by_filename' ); 1813 1792 1814 // Parse meta query. 1793 1815 $this->meta_query = new WP_Meta_Query(); … … 2221 2243 } 2222 2244 2223 if ( ! empty( $this->tax_query->queries ) || ! empty( $this->meta_query->queries ) ) {2245 if ( ! empty( $this->tax_query->queries ) || ! empty( $this->meta_query->queries ) || ! empty( $this->allow_query_attachment_by_filename ) ) { 2224 2246 $groupby = "{$wpdb->posts}.ID"; 2225 2247 } … … 2297 2319 } 2298 2320 $where .= $search . $whichauthor . $whichmimetype; 2321 2322 if ( ! empty( $this->allow_query_attachment_by_filename ) ) { 2323 $join .= " LEFT JOIN {$wpdb->postmeta} AS sq1 ON ( {$wpdb->posts}.ID = sq1.post_id AND sq1.meta_key = '_wp_attached_file' )"; 2324 } 2299 2325 2300 2326 if ( ! empty( $this->meta_query->queries ) ) { -
branches/5.7/src/wp-includes/comment.php
r50375 r54553 2462 2462 } 2463 2463 2464 $filter_comment = false; 2465 if ( ! has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) { 2466 $filter_comment = ! user_can( isset( $comment['user_id'] ) ? $comment['user_id'] : 0, 'unfiltered_html' ); 2467 } 2468 2469 if ( $filter_comment ) { 2470 add_filter( 'pre_comment_content', 'wp_filter_kses' ); 2471 } 2472 2464 2473 // Escape data pulled from DB. 2465 2474 $comment = wp_slash( $comment ); … … 2471 2480 2472 2481 $commentarr = wp_filter_comment( $commentarr ); 2482 2483 if ( $filter_comment ) { 2484 remove_filter( 'pre_comment_content', 'wp_filter_kses' ); 2485 } 2473 2486 2474 2487 // Now extract the merged array. -
branches/5.7/src/wp-includes/customize/class-wp-customize-header-image-control.php
r48834 r54553 131 131 132 132 <button type="button" class="choice thumbnail" 133 data-customize-image-value="{{ {data.header.url}}}"133 data-customize-image-value="{{data.header.url}}" 134 134 data-customize-header-image-data="{{JSON.stringify(data.header)}}"> 135 135 <span class="screen-reader-text"><?php _e( 'Set image' ); ?></span> 136 <img src="{{ {data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}" />136 <img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" /> 137 137 </button> 138 138 … … 159 159 <# } else { #> 160 160 161 <img src="{{ {data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}" />161 <img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" /> 162 162 163 163 <# } #> -
branches/5.7/src/wp-includes/customize/class-wp-customize-site-icon-control.php
r47382 r54553 69 69 <img src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>"/> 70 70 </div> 71 <span class="browser-title" aria-hidden="true"><# print( '<?php bloginfo( 'name'); ?>' ) #></span>71 <span class="browser-title" aria-hidden="true"><# print( '<?php echo esc_js( get_bloginfo( 'name' ) ); ?>' ) #></span> 72 72 </div> 73 73 <img class="app-icon-preview" src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as an app icon' ); ?>"/> -
branches/5.7/src/wp-includes/deprecated.php
r50146 r54553 4204 4204 wp_strict_cross_origin_referrer(); 4205 4205 } 4206 4207 /** 4208 * Filter the SQL clauses of an attachment query to include filenames. 4209 * 4210 * @since 4.7.0 4211 * @deprecated 6.0.3 4212 * @access private 4213 * 4214 * @param array $clauses An array including WHERE, GROUP BY, JOIN, ORDER BY, 4215 * DISTINCT, fields (SELECT), and LIMITS clauses. 4216 * @return array The unmodified clauses. 4217 */ 4218 function _filter_query_attachment_filenames( $clauses ) { 4219 _deprecated_function( __FUNCTION__, '6.0.3', 'add_filter( "wp_allow_query_attachment_by_filename", "__return_true" )'); 4220 remove_filter( 'posts_clauses', __FUNCTION__ ); 4221 return $clauses; 4222 } 4223 -
branches/5.7/src/wp-includes/functions.php
r51742 r54553 3289 3289 $html = __( 'The link you followed has expired.' ); 3290 3290 if ( wp_get_referer() ) { 3291 $wp_http_referer = remove_query_arg( 'updated', wp_get_referer() ); 3292 $wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) ); 3291 3293 $html .= '</p><p>'; 3292 3294 $html .= sprintf( 3293 3295 '<a href="%s">%s</a>', 3294 esc_url( remove_query_arg( 'updated', wp_get_referer() )),3296 esc_url( $wp_http_referer ), 3295 3297 __( 'Please try again.' ) 3296 3298 ); -
branches/5.7/src/wp-includes/media-template.php
r50352 r54553 1494 1494 <img id="preview-favicon" src="{{ data.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>"/> 1495 1495 </div> 1496 <span class="browser-title" aria-hidden="true"><# print( '<?php bloginfo( 'name'); ?>' ) #></span>1496 <span class="browser-title" aria-hidden="true"><# print( '<?php echo esc_js( get_bloginfo( 'name' ) ); ?>' ) #></span> 1497 1497 </div> 1498 1498 -
branches/5.7/src/wp-includes/pluggable.php
r50034 r54553 351 351 $phpmailer->clearCustomHeaders(); 352 352 $phpmailer->clearReplyTos(); 353 $phpmailer->Body = ''; 354 $phpmailer->AltBody = ''; 353 355 354 356 // Set "From" name and email. -
branches/5.7/src/wp-includes/post.php
r52466 r54553 7591 7591 7592 7592 /** 7593 * Filters the SQL clauses of an attachment query to include filenames.7594 *7595 * @since 4.7.07596 * @access private7597 *7598 * @global wpdb $wpdb WordPress database abstraction object.7599 *7600 * @param string[] $clauses An array including WHERE, GROUP BY, JOIN, ORDER BY,7601 * DISTINCT, fields (SELECT), and LIMITS clauses.7602 * @return string[] The modified array of clauses.7603 */7604 function _filter_query_attachment_filenames( $clauses ) {7605 global $wpdb;7606 remove_filter( 'posts_clauses', __FUNCTION__ );7607 7608 // Add a LEFT JOIN of the postmeta table so we don't trample existing JOINs.7609 $clauses['join'] .= " LEFT JOIN {$wpdb->postmeta} AS sq1 ON ( {$wpdb->posts}.ID = sq1.post_id AND sq1.meta_key = '_wp_attached_file' )";7610 7611 $clauses['groupby'] = "{$wpdb->posts}.ID";7612 7613 $clauses['where'] = preg_replace(7614 "/\({$wpdb->posts}.post_content (NOT LIKE|LIKE) (\'[^']+\')\)/",7615 '$0 OR ( sq1.meta_value $1 $2 )',7616 $clauses['where']7617 );7618 7619 return $clauses;7620 }7621 7622 /**7623 7593 * Sets the last changed time for the 'posts' cache group. 7624 7594 * -
branches/5.7/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
r50152 r54553 90 90 // Filter query clauses to include filenames. 91 91 if ( isset( $query_args['s'] ) ) { 92 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );92 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 93 93 } 94 94 -
branches/5.7/src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php
r49942 r54553 136 136 137 137 /** 138 * Checks if the terms for a post can be read. 139 * 140 * @since 6.0.3 141 * 142 * @param WP_Post $post Post object. 143 * @param WP_REST_Request $request Full details about the request. 144 * @return bool Whether the terms for the post can be read. 145 */ 146 public function check_read_terms_permission_for_post( $post, $request ) { 147 // If the requested post isn't associated with this taxonomy, deny access. 148 if ( ! is_object_in_taxonomy( $post->post_type, $this->taxonomy ) ) { 149 return false; 150 } 151 152 // Grant access if the post is publicly viewable. 153 if ( is_post_publicly_viewable( $post ) ) { 154 return true; 155 } 156 157 // Otherwise grant access if the post is readable by the logged in user. 158 if ( current_user_can( 'read_post', $post->ID ) ) { 159 return true; 160 } 161 162 // Otherwise, deny access. 163 return false; 164 } 165 166 /** 138 167 * Checks if a request has access to read terms in the specified taxonomy. 139 168 * … … 156 185 array( 'status' => rest_authorization_required_code() ) 157 186 ); 187 } 188 189 if ( ! empty( $request['post'] ) ) { 190 $post = get_post( $request['post'] ); 191 192 if ( ! $post ) { 193 return new WP_Error( 194 'rest_post_invalid_id', 195 __( 'Invalid post ID.' ), 196 array( 197 'status' => 400, 198 ) 199 ); 200 } 201 202 if ( ! $this->check_read_terms_permission_for_post( $post, $request ) ) { 203 return new WP_Error( 204 'rest_forbidden_context', 205 __( 'Sorry, you are not allowed to view terms for this post.' ), 206 array( 207 'status' => rest_authorization_required_code(), 208 ) 209 ); 210 } 158 211 } 159 212 -
branches/5.7/src/wp-includes/widgets.php
r50372 r54553 1527 1527 if ( is_wp_error( $rss ) ) { 1528 1528 if ( is_admin() || current_user_can( 'manage_options' ) ) { 1529 echo '<p><strong>' . __( 'RSS Error:' ) . '</strong> ' . $rss->get_error_message() . '</p>';1529 echo '<p><strong>' . __( 'RSS Error:' ) . '</strong> ' . esc_html( $rss->get_error_message() ) . '</p>'; 1530 1530 } 1531 1531 return; … … 1650 1650 1651 1651 if ( ! empty( $args['error'] ) ) { 1652 echo '<p class="widget-error"><strong>' . __( 'RSS Error:' ) . '</strong> ' . $args['error']. '</p>';1652 echo '<p class="widget-error"><strong>' . __( 'RSS Error:' ) . '</strong> ' . esc_html( $args['error'] ) . '</p>'; 1653 1653 } 1654 1654 -
branches/5.7/src/wp-mail.php
r47580 r54553 65 65 wp_die( __( 'There doesn’t seem to be any new mail.' ) ); 66 66 } 67 68 // Always run as an unauthenticated user. 69 wp_set_current_user( 0 ); 67 70 68 71 for ( $i = 1; $i <= $count; $i++ ) { … … 132 135 $author = sanitize_email( $author ); 133 136 if ( is_email( $author ) ) { 134 /* translators: %s: Post author email address. */135 echo '<p>' . sprintf( __( 'Author is %s' ), $author ) . '</p>';136 137 $userdata = get_user_by( 'email', $author ); 137 138 if ( ! empty( $userdata ) ) { -
branches/5.7/src/wp-trackback.php
r49108 r54553 13 13 wp( array( 'tb' => '1' ) ); 14 14 } 15 16 // Always run as an unauthenticated user. 17 wp_set_current_user( 0 ); 15 18 16 19 /** -
branches/5.7/tests/phpunit/tests/query/search.php
r48939 r54553 456 456 457 457 add_post_meta( $attachment, '_wp_attached_file', 'some-image1.png', true ); 458 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );458 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 459 459 460 460 // Pass post_type a string value. … … 486 486 487 487 add_post_meta( $attachment, '_wp_attached_file', 'some-image2.png', true ); 488 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );488 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 489 489 490 490 // Pass post_type an array value. … … 545 545 add_post_meta( $attachment, '_wp_attached_file', 'some-image4.png', true ); 546 546 add_post_meta( $attachment, '_test_meta_key', 'value', true ); 547 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );547 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 548 548 549 549 // Pass post_type a string value. … … 585 585 586 586 add_post_meta( $attachment, '_wp_attached_file', 'some-image5.png', true ); 587 add_filter( ' posts_clauses', '_filter_query_attachment_filenames' );587 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 588 588 589 589 // Pass post_type a string value. … … 610 610 * @ticket 22744 611 611 */ 612 public function test_filter_query_attachment_filenames_unhooks_itself() { 613 add_filter( 'posts_clauses', '_filter_query_attachment_filenames' ); 614 615 apply_filters( 616 'posts_clauses', 617 array( 618 'where' => '', 619 'groupby' => '', 620 'join' => '', 621 'orderby' => '', 622 'distinct' => '', 623 'fields' => '', 624 'limit' => '', 625 ) 626 ); 627 628 $result = has_filter( 'posts_clauses', '_filter_query_attachment_filenames' ); 629 630 $this->assertFalse( $result ); 612 public function test_wp_query_removes_filter_wp_allow_query_attachment_by_filename() { 613 $attachment = self::factory()->post->create( 614 array( 615 'post_type' => 'attachment', 616 'post_status' => 'publish', 617 'post_title' => 'bar foo', 618 'post_content' => 'foo bar', 619 'post_excerpt' => 'This post has foo', 620 ) 621 ); 622 623 add_post_meta( $attachment, '_wp_attached_file', 'some-image1.png', true ); 624 add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' ); 625 626 $q = new WP_Query( 627 array( 628 's' => 'image1', 629 'fields' => 'ids', 630 'post_type' => 'attachment', 631 'post_status' => 'inherit', 632 ) 633 ); 634 635 $this->assertSame( array( $attachment ), $q->posts ); 636 637 /* 638 * WP_Query should have removed the wp_allow_query_attachment_by_filename filter 639 * and thus not match the attachment created above 640 */ 641 $q->get_posts(); 642 $this->assertEmpty( $q->posts ); 631 643 } 632 644 -
branches/5.7/tests/phpunit/tests/rest-api/rest-comments-controller.php
r49603 r54553 2973 2973 'author_name' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>', 2974 2974 'author_user_agent' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>', 2975 'author' => self::$editor_id, 2975 2976 ), 2976 2977 array( … … 2981 2982 'author_name' => 'div strong', 2982 2983 'author_user_agent' => 'div strong', 2984 'author' => self::$editor_id, 2983 2985 ) 2984 2986 ); … … 2990 2992 'author_name' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>', 2991 2993 'author_user_agent' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>', 2994 'author' => self::$editor_id, 2992 2995 ), 2993 2996 array( … … 2998 3001 'author_name' => 'div strong', 2999 3002 'author_user_agent' => 'div strong', 3003 'author' => self::$editor_id, 3000 3004 ) 3001 3005 ); … … 3012 3016 'author_name' => '\\\&\\\ & &invalid; < < &lt;', 3013 3017 'author_user_agent' => '\\\&\\\ & &invalid; < < &lt;', 3018 'author' => self::$superadmin_id, 3014 3019 ), 3015 3020 array( … … 3020 3025 'author_name' => '\\\&\\\ & &invalid; < < &lt;', 3021 3026 'author_user_agent' => '\\\&\\\ & &invalid; < < &lt;', 3027 'author' => self::$superadmin_id, 3022 3028 ) 3023 3029 ); … … 3033 3039 'author_name' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>', 3034 3040 'author_user_agent' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>', 3041 'author' => self::$superadmin_id, 3035 3042 ), 3036 3043 array( … … 3041 3048 'author_name' => 'div strong', 3042 3049 'author_user_agent' => 'div strong', 3050 'author' => self::$superadmin_id, 3043 3051 ) 3044 3052 );
Note: See TracChangeset
for help on using the changeset viewer.