Changeset 54561 for branches/4.6
- Timestamp:
- 10/17/2022 06:03:41 PM (2 years ago)
- Location:
- branches/4.6
- Files:
-
- 11 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/4.6
- Property svn:mergeinfo changed
/trunk merged: 54521-54523,54525-54527,54529-54530,54541
- Property svn:mergeinfo changed
-
branches/4.6/src/wp-includes/comment.php
r44848 r54561 1990 1990 } 1991 1991 1992 $filter_comment = false; 1993 if ( ! has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) { 1994 $filter_comment = ! user_can( isset( $comment['user_id'] ) ? $comment['user_id'] : 0, 'unfiltered_html' ); 1995 } 1996 1997 if ( $filter_comment ) { 1998 add_filter( 'pre_comment_content', 'wp_filter_kses' ); 1999 } 2000 1992 2001 // Escape data pulled from DB. 1993 2002 $comment = wp_slash($comment); … … 1999 2008 2000 2009 $commentarr = wp_filter_comment( $commentarr ); 2010 2011 if ( $filter_comment ) { 2012 remove_filter( 'pre_comment_content', 'wp_filter_kses' ); 2013 } 2001 2014 2002 2015 // Now extract the merged array. -
branches/4.6/src/wp-includes/customize/class-wp-customize-header-image-control.php
r37426 r54561 108 108 109 109 <button type="button" class="choice thumbnail" 110 data-customize-image-value="{{ {data.header.url}}}"110 data-customize-image-value="{{data.header.url}}" 111 111 data-customize-header-image-data="{{JSON.stringify(data.header)}}"> 112 112 <span class="screen-reader-text"><?php _e( 'Set image' ); ?></span> 113 <img src="{{ {data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}">113 <img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" /> 114 114 </button> 115 115 -
branches/4.6/src/wp-includes/customize/class-wp-customize-site-icon-control.php
r37964 r54561 70 70 <img src="{{ data.attachment.sizes.full.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>"/> 71 71 </div> 72 <span class="browser-title" aria-hidden="true"><?php bloginfo( 'name'); ?></span>72 <span class="browser-title" aria-hidden="true"><?php echo esc_js( get_bloginfo( 'name' ) ); ?></span> 73 73 </div> 74 74 <img class="app-icon-preview" src="{{ data.attachment.sizes.full.url }}" alt="<?php esc_attr_e( 'Preview as an app icon' ); ?>"/> -
branches/4.6/src/wp-includes/date.php
r37518 r54561 153 153 public function __construct( $date_query, $default_column = 'post_date' ) { 154 154 155 if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] )) {156 $this->relation = 'OR';155 if ( isset( $date_query['relation'] ) ) { 156 $this->relation = $this->sanitize_relation( $date_query['relation'] ); 157 157 } else { 158 158 $this->relation = 'AND'; … … 233 233 $this->validate_date_values( $queries ); 234 234 } 235 236 // Sanitize the relation parameter. 237 $queries['relation'] = $this->sanitize_relation( $queries['relation'] ); 235 238 236 239 foreach ( $queries as $key => $q ) { … … 1016 1019 return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time ); 1017 1020 } 1021 1022 /** 1023 * Sanitizes a 'relation' operator. 1024 * 1025 * @since 6.0.3 1026 * 1027 * @param string $relation Raw relation key from the query argument. 1028 * @return string Sanitized relation ('AND' or 'OR'). 1029 */ 1030 public function sanitize_relation( $relation ) { 1031 if ( 'OR' === strtoupper( $relation ) ) { 1032 return 'OR'; 1033 } else { 1034 return 'AND'; 1035 } 1036 } 1018 1037 } -
branches/4.6/src/wp-includes/functions.php
r46496 r54561 2628 2628 } else { 2629 2629 $html = __( 'Are you sure you want to do this?' ); 2630 if ( wp_get_referer() ) 2631 $html .= "</p><p><a href='" . esc_url( remove_query_arg( 'updated', wp_get_referer() ) ) . "'>" . __( 'Please try again.' ) . "</a>"; 2630 if ( wp_get_referer() ) { 2631 $wp_http_referer = remove_query_arg( 'updated', wp_get_referer() ); 2632 $wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) ); 2633 $html .= '</p><p>'; 2634 $html .= sprintf( 2635 '<a href="%s">%s</a>', 2636 esc_url( $wp_http_referer ), 2637 __( 'Please try again.' ) 2638 ); 2639 } 2632 2640 } 2633 2641 -
branches/4.6/src/wp-includes/media-template.php
r37963 r54561 1246 1246 <img id="preview-favicon" src="{{ data.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>"/> 1247 1247 </div> 1248 <span class="browser-title" aria-hidden="true"><?php bloginfo( 'name'); ?></span>1248 <span class="browser-title" aria-hidden="true"><?php echo esc_js( get_bloginfo( 'name' ) ); ?></span> 1249 1249 </div> 1250 1250 -
branches/4.6/src/wp-includes/pluggable.php
r47974 r54561 309 309 $phpmailer->ClearCustomHeaders(); 310 310 $phpmailer->ClearReplyTos(); 311 $phpmailer->Body = ''; 312 $phpmailer->AltBody = ''; 311 313 312 314 // From email and name -
branches/4.6/src/wp-includes/widgets.php
r37544 r54561 1234 1234 if ( is_wp_error($rss) ) { 1235 1235 if ( is_admin() || current_user_can('manage_options') ) 1236 echo '<p>' . sprintf( __('<strong>RSS Error</strong>: %s'), $rss->get_error_message() ) . '</p>';1236 echo '<p>' . sprintf( __('<strong>RSS Error</strong>: %s'), esc_html( $rss->get_error_message() ) ) . '</p>'; 1237 1237 return; 1238 1238 } … … 1343 1343 1344 1344 if ( ! empty( $args['error'] ) ) { 1345 echo '<p class="widget-error"><strong>' . sprintf( __( 'RSS Error: %s' ), $args['error']) . '</strong></p>';1345 echo '<p class="widget-error"><strong>' . sprintf( __( 'RSS Error: %s' ), esc_html( $args['error'] ) ) . '</strong></p>'; 1346 1346 } 1347 1347 -
branches/4.6/src/wp-mail.php
r39774 r54561 60 60 wp_die( __('There doesn’t seem to be any new mail.') ); 61 61 } 62 63 // Always run as an unauthenticated user. 64 wp_set_current_user( 0 ); 62 65 63 66 for ( $i = 1; $i <= $count; $i++ ) { … … 125 128 $author = sanitize_email($author); 126 129 if ( is_email($author) ) { 127 echo '<p>' . sprintf(__('Author is %s'), $author) . '</p>';128 130 $userdata = get_user_by('email', $author); 129 131 if ( ! empty( $userdata ) ) { -
branches/4.6/src/wp-trackback.php
r30662 r54561 13 13 wp( array( 'tb' => '1' ) ); 14 14 } 15 16 // Always run as an unauthenticated user. 17 wp_set_current_user( 0 ); 15 18 16 19 /**
Note: See TracChangeset
for help on using the changeset viewer.