Changeset 61949 for branches/6.2/src/wp-includes/html-api/class-wp-html-tag-processor.php

Timestamp:

03/12/2026 01:47:41 AM (6 months ago)

Author:

peterwilsoncc

Message:

Grouped backports for the 6.2 branch.

• XML-RPC: Switch to wp_safe_remote() when fetching a pingback URL.
• HTML API: Prevent WP_HTML_Tag_Processor instances being unserialized and add some extra logic for validating pattern and template file paths.
• KSES: Optimize PCRE pattern detecting numeric character references.
• Customize: Improve escaping approach used for nav menu attributes.
• Media: Ensure the attachment parent is accessible to the user before showing a link to it in the media manager.
• Administration: Ensure client-side templates are only detected when they're correctly associated with a script tag.
• Filesystem API: Don't attempt to extract invalid files from a zip when using the PclZip library.
• Media: Disable XML entity substitution in getID3.

Merges [61879-61885,61887,61889-61890,61913] to the 6.2 branch.

Props johnbillion, xknown, dmsnell, jorbin, peterwilson, desrosj, westonruter, jonsurrell, aurdasjb.

Location:

branches/6.2

Files:

• . (modified) (1 prop)
• src/wp-includes/html-api/class-wp-html-tag-processor.php (modified) (1 diff)

branches/6.2/src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -2292 +2292 @@
                 return true;
         }
+
+        /**
+         * Wakeup magic method.
+         *
+         * @since 6.9.2
+         */
+        public function __wakeup() {
+                throw new \LogicException( __CLASS__ . ' should never be unserialized' );
+        }
 }