Changeset 55780
- Timestamp:
- 05/16/2023 03:39:32 PM (19 months ago)
- Location:
- branches/4.5
- Files:
-
- 9 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/4.5/package-lock.json
r54589 r55780 1 1 { 2 2 "name": "WordPress", 3 "version": "4.5.2 8",3 "version": "4.5.29", 4 4 "lockfileVersion": 1, 5 5 "requires": true, -
branches/4.5/package.json
r54589 r55780 1 1 { 2 2 "name": "WordPress", 3 "version": "4.5.2 8",3 "version": "4.5.29", 4 4 "description": "WordPress is web software you can use to create a beautiful website or blog.", 5 5 "repository": { -
branches/4.5/src/wp-admin/about.php
r55387 r55780 41 41 <div class="changelog point-releases"> 42 42 <h3><?php _e( 'Maintenance and Security Releases' ); ?></h3> 43 <p> 44 <?php 45 printf( 46 /* translators: %s: WordPress version number */ 47 __( '<strong>Version %s</strong> addressed some security issues.' ), 48 '4.5.29' 49 ); 50 ?> 51 <?php 52 printf( 53 /* translators: %s: HelpHub URL */ 54 __( 'For more information, see <a href="%s">the release notes</a>.' ), 55 sprintf( 56 /* translators: %s: WordPress version */ 57 esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ), 58 sanitize_title( '4.5.29' ) 59 ) 60 ); 61 ?> 62 </p> 43 63 <p> 44 64 <?php -
branches/4.5/src/wp-admin/includes/ajax-actions.php
r45950 r55780 2169 2169 } 2170 2170 2171 if ( false === check_ajax_referer( 'set-attachment-thumbnail', '_ajax_nonce', false ) ) { 2172 wp_send_json_error(); 2173 } 2174 2171 2175 $post_ids = array(); 2172 2176 // For each URL, try to find its corresponding post ID. -
branches/4.5/src/wp-includes/js/media/views/frame/video-details.js
r33337 r55780 105 105 wp.ajax.send( 'set-attachment-thumbnail', { 106 106 data : { 107 _ajax_nonce: wp.media.view.settings.nonce.setAttachmentThumbnail, 107 108 urls: urls, 108 109 thumbnail_id: attachment.get( 'id' ) -
branches/4.5/src/wp-includes/js/wp-embed.js
r36708 r55780 38 38 var iframes = document.querySelectorAll( 'iframe[data-secret="' + data.secret + '"]' ), 39 39 blockquotes = document.querySelectorAll( 'blockquote[data-secret="' + data.secret + '"]' ), 40 allowedProtocols = new RegExp( '^https?:$', 'i' ), 40 41 i, source, height, sourceURL, targetURL; 41 42 … … 72 73 sourceURL.href = source.getAttribute( 'src' ); 73 74 targetURL.href = data.value; 75 76 /* Only follow link if the protocol is in the allow list. */ 77 if ( ! allowedProtocols.test( targetURL.protocol ) ) { 78 continue; 79 } 74 80 75 81 /* Only continue if link hostname matches iframe's hostname. */ -
branches/4.5/src/wp-includes/media.php
r37034 r55780 3287 3287 'captions' => ! apply_filters( 'disable_captions', '' ), 3288 3288 'nonce' => array( 3289 'sendToEditor' => wp_create_nonce( 'media-send-to-editor' ), 3289 'sendToEditor' => wp_create_nonce( 'media-send-to-editor' ), 3290 'setAttachmentThumbnail' => wp_create_nonce( 'set-attachment-thumbnail' ), 3290 3291 ), 3291 3292 'post' => array( -
branches/4.5/src/wp-includes/version.php
r54589 r55780 5 5 * @global string $wp_version 6 6 */ 7 $wp_version = '4.5.2 8-src';7 $wp_version = '4.5.29-src'; 8 8 9 9 /** -
branches/4.5/tests/phpunit/tests/ajax/Attachments.php
r37289 r55780 110 110 $this->assertEquals( $expected, $response['data'] ); 111 111 } 112 113 public function test_wp_ajax_set_attachment_thumbnail_success() { 114 // Become an administrator. 115 $post = $_POST; 116 $user_id = self::factory()->user->create( 117 array( 118 'role' => 'administrator', 119 'user_login' => 'user_36578_administrator', 120 'user_email' => 'user_36578_administrator@example.com', 121 ) 122 ); 123 wp_set_current_user( $user_id ); 124 $_POST = array_merge( $_POST, $post ); 125 126 // Upload the attachment itself. 127 $filename = DIR_TESTDATA . '/uploads/small-audio.mp3'; 128 $contents = file_get_contents( $filename ); 129 130 $upload = wp_upload_bits( wp_basename( $filename ), null, $contents ); 131 $attachment = $this->_make_attachment( $upload ); 132 133 // Upload the thumbnail. 134 $filename = DIR_TESTDATA . '/images/waffles.jpg'; 135 $contents = file_get_contents( $filename ); 136 137 $upload = wp_upload_bits( wp_basename( $filename ), null, $contents ); 138 $thumbnail = $this->_make_attachment( $upload ); 139 140 // Set up a default request. 141 $_POST['_ajax_nonce'] = wp_create_nonce( 'set-attachment-thumbnail' ); 142 $_POST['thumbnail_id'] = $thumbnail; 143 $_POST['urls'] = array( wp_get_attachment_url( $attachment ) ); 144 145 // Make the request. 146 try { 147 $this->_handleAjax( 'set-attachment-thumbnail' ); 148 } catch ( WPAjaxDieContinueException $e ) { 149 unset( $e ); 150 } 151 152 // Get the response. 153 $response = json_decode( $this->_last_response, true ); 154 155 // Ensure everything is correct. 156 $this->assertTrue( $response['success'] ); 157 } 158 159 public function test_wp_ajax_set_attachment_thumbnail_missing_nonce() { 160 // Become an administrator. 161 $post = $_POST; 162 $user_id = self::factory()->user->create( 163 array( 164 'role' => 'administrator', 165 'user_login' => 'user_36578_administrator', 166 'user_email' => 'user_36578_administrator@example.com', 167 ) 168 ); 169 wp_set_current_user( $user_id ); 170 $_POST = array_merge( $_POST, $post ); 171 172 // Upload the attachment itself. 173 $filename = DIR_TESTDATA . '/uploads/small-audio.mp3'; 174 $contents = file_get_contents( $filename ); 175 176 $upload = wp_upload_bits( wp_basename( $filename ), null, $contents ); 177 $attachment = $this->_make_attachment( $upload ); 178 179 // Upload the thumbnail. 180 $filename = DIR_TESTDATA . '/images/waffles.jpg'; 181 $contents = file_get_contents( $filename ); 182 183 $upload = wp_upload_bits( wp_basename( $filename ), null, $contents ); 184 $thumbnail = $this->_make_attachment( $upload ); 185 186 // Set up a default request. 187 $_POST['thumbnail_id'] = $thumbnail; 188 $_POST['urls'] = array( wp_get_attachment_url( $attachment ) ); 189 190 // Make the request. 191 try { 192 $this->_handleAjax( 'set-attachment-thumbnail' ); 193 } catch ( WPAjaxDieContinueException $e ) { 194 unset( $e ); 195 } 196 197 // Get the response. 198 $response = json_decode( $this->_last_response, true ); 199 200 // Check that success is false without sending nonce. 201 $this->assertFalse( $response['success'] ); 202 } 112 203 }
Note: See TracChangeset
for help on using the changeset viewer.