Make WordPress Core

Changeset 63102


Ignore:
Timestamp:
08/06/2026 07:43:30 PM (5 weeks ago)
Author:
desrosj
Message:

Security: Backport the WordPress 7.0.3 security fixes to the 6.0 branch.

  • Users: Ensure a proper email address is used before sending email confirmations.
  • Formatting: Prevent stack overflow in safecss_filter_attr.
  • Multisite: Enforce the active signup policy for existing users.
  • HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
  • Users: Prevent Usernames from mangling HTML
  • Canonical: Only redirect for publicly viewable post types.
  • Administration: When wp_is_large_user_count(), ensure that the post author is always added to author dropdown.
  • Editor: Fix output for Post Date.

Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 6.0 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell, isabel_brison, bernhard-reiter, tyxla, aduth.

Location:
branches/6.0
Files:
12 edited

Legend:

Unmodified
Added
Removed
  • branches/6.0/package-lock.json

    r63101 r63102  
    42764276                },
    42774277                "@wordpress/block-library": {
    4278                         "version": "7.3.19",
    4279                         "resolved": "https://registry.npmjs.org/@wordpress/block-library/-/block-library-7.3.19.tgz",
    4280                         "integrity": "sha512-QfxAP1b+TdFxgludt5Z+WN6zi0ARNdKzV3+ITFFBtf7F1nyn33ScrY5tCl6/1Px4tsZkMqbRzTYU3RcO7BbUOg==",
     4278                        "version": "7.3.20",
     4279                        "resolved": "https://registry.npmjs.org/@wordpress/block-library/-/block-library-7.3.20.tgz",
     4280                        "integrity": "sha512-Qqb5MB/+j+Lo72o6ydQ+q+0CvAcAf7Tkajrxh/yhgIWw7ci8W+QKg92mgpD/uLNXhg0fYFQ7pdk+J+0WazbgEg==",
    42814281                        "requires": {
    42824282                                "@babel/runtime": "^7.16.0",
  • branches/6.0/package.json

    r63101 r63102  
    8484                "@wordpress/block-directory": "3.4.19",
    8585                "@wordpress/block-editor": "8.5.11",
    86                 "@wordpress/block-library": "7.3.19",
     86                "@wordpress/block-library": "7.3.20",
    8787                "@wordpress/block-serialization-default-parser": "4.6.1",
    8888                "@wordpress/blocks": "11.5.4",
  • branches/6.0/src/js/_enqueues/admin/inline-edit-post.js

    r63101 r63102  
    306306
    307307                        // The post author no longer has edit capabilities, so we need to add them to the list of authors.
    308                         $(':input[name="post_author"]', editRow).prepend('<option value="' + $('.post_author', rowData).text() + '">' + $('#' + t.type + '-' + id + ' .author').text() + '</option>');
     308                        $(':input[name="post_author"]', editRow).prepend(
     309                                new Option(
     310                                        $('#' + t.type + '-' + id + ' .author').text(),
     311                                        $('.post_author', rowData).text()
     312                                )
     313                        );
    309314                }
    310315                if ( $( ':input[name="post_author"] option', editRow ).length === 1 ) {
  • branches/6.0/src/wp-admin/includes/user.php

    r63101 r63102  
    4545        }
    4646
     47        $errors = new WP_Error();
     48
    4749        $pass1 = '';
    4850        $pass2 = '';
     
    7981
    8082        if ( isset( $_POST['email'] ) ) {
    81                 $user->user_email = sanitize_text_field( wp_unslash( $_POST['email'] ) );
     83                $maybe_email = wp_unslash( $_POST['email'] );
     84                if ( is_string( $maybe_email ) && is_email( $maybe_email ) ) {
     85                        $user->user_email = $maybe_email;
     86                } else {
     87                        $errors->add( 'invalid_email', __( '<strong>Error</strong>: The email address is not correct.' ), array( 'form-field' => 'email' ) );
     88                }
    8289        }
    8390        if ( isset( $_POST['url'] ) ) {
     
    139146                $user->use_ssl = 1;
    140147        }
    141 
    142         $errors = new WP_Error();
    143148
    144149        /* checking that username has been typed */
  • branches/6.0/src/wp-includes/assets/script-loader-packages.php

    r63101 r63102  
    1 <?php return array('a11y.js' => array('dependencies' => array('wp-dom-ready', 'wp-i18n', 'wp-polyfill'), 'version' => '9955a48198ad4f2bd749aa49d40211c2'), 'annotations.js' => array('dependencies' => array('lodash', 'wp-data', 'wp-hooks', 'wp-i18n', 'wp-polyfill', 'wp-rich-text'), 'version' => '0b465be2288cfd18559519b5a6e1fb43'), 'api-fetch.js' => array('dependencies' => array('wp-i18n', 'wp-polyfill', 'wp-url'), 'version' => '3f6a6af95ed243112cc4aba4577879c9'), 'autop.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'b22574be41df92ce2707c19720f8a6e4'), 'blob.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'ac62b64d31905319c4b0207639b9e7dd'), 'block-directory.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-primitives', 'wp-url'), 'version' => 'e246d8fbeeb7847b3c57d955bad88359'), 'block-editor.js' => array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-a11y', 'wp-api-fetch', 'wp-blob', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-is-shallow-equal', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-notices', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-shortcode', 'wp-token-list', 'wp-url', 'wp-warning', 'wp-wordcount'), 'version' => '87a1b2788251a232e7ad4b4f99039f6d'), 'block-library.js' => array('dependencies' => array('lodash', 'moment', 'wp-a11y', 'wp-api-fetch', 'wp-autop', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-polyfill', 'wp-primitives', 'wp-reusable-blocks', 'wp-rich-text', 'wp-server-side-render', 'wp-url', 'wp-viewport'), 'version' => '80878f15d641a8847dd4a68300e88e7b'), 'block-serialization-default-parser.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'e5be172c9d2a70d194446e28dca7b92a'), 'blocks.js' => array('dependencies' => array('lodash', 'wp-autop', 'wp-blob', 'wp-block-serialization-default-parser', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-shortcode'), 'version' => 'ac2ecb3bc1ae8349ffe849363a5bff1c'), 'components.js' => array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-a11y', 'wp-compose', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-i18n', 'wp-is-shallow-equal', 'wp-keycodes', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-warning'), 'version' => 'f50bbe8a2c807af35a13584cbee2b5fa'), 'compose.js' => array('dependencies' => array('lodash', 'react', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-is-shallow-equal', 'wp-keycodes', 'wp-polyfill', 'wp-priority-queue'), 'version' => '810e86855b2d783a6b59ee3f635cddad'), 'core-data.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-blocks', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-html-entities', 'wp-i18n', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-url'), 'version' => '5a4395c9efede4f95c8ded0762e30a4a'), 'customize-widgets.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-is-shallow-equal', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-plugins', 'wp-polyfill', 'wp-preferences', 'wp-primitives', 'wp-viewport', 'wp-widgets'), 'version' => '46079e5576207e8e43490783447f023e'), 'data.js' => array('dependencies' => array('lodash', 'react', 'wp-compose', 'wp-deprecated', 'wp-element', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-priority-queue', 'wp-redux-routine'), 'version' => '1c712b504f84c8b9fb5a5b101f5c5095'), 'data-controls.js' => array('dependencies' => array('wp-api-fetch', 'wp-data', 'wp-deprecated', 'wp-polyfill'), 'version' => '12589686f5ca4db76be8584499da3a1b'), 'date.js' => array('dependencies' => array('moment', 'wp-polyfill'), 'version' => '81877c7535f2b70a0f898e2f63533db8'), 'deprecated.js' => array('dependencies' => array('wp-hooks', 'wp-polyfill'), 'version' => '69a7e2ea1d8d5392bb0b6db66d5c4500'), 'dom.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => 'a1847daeecaa2a6b272f60939db87cef'), 'dom-ready.js' => array('dependencies' => array('wp-polyfill'), 'version' => '03774ef51ae4221a441bcb7fc87d83d3'), 'edit-post.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-deprecated', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-preferences', 'wp-primitives', 'wp-url', 'wp-viewport', 'wp-warning'), 'version' => '5d1a40cdbddb2a0ff3c1d442783243eb'), 'edit-site.js' => array('dependencies' => array('lodash', 'react', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-deprecated', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-preferences', 'wp-primitives', 'wp-reusable-blocks', 'wp-url', 'wp-viewport'), 'version' => 'e43eb8a01293bc95ad95dbbe860667cf'), 'edit-widgets.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-preferences', 'wp-primitives', 'wp-reusable-blocks', 'wp-url', 'wp-viewport', 'wp-widgets'), 'version' => '9068a5f0e17e6a8498ab64db9eeba05d'), 'editor.js' => array('dependencies' => array('lodash', 'react', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-deprecated', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-notices', 'wp-polyfill', 'wp-preferences', 'wp-primitives', 'wp-reusable-blocks', 'wp-rich-text', 'wp-server-side-render', 'wp-url', 'wp-wordcount'), 'version' => 'fc767dd59b0d65038c1b3001e1430532'), 'element.js' => array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-escape-html', 'wp-polyfill'), 'version' => '49d63820dab84493986cc6596ed39663'), 'escape-html.js' => array('dependencies' => array('wp-polyfill'), 'version' => '8b2f29f7c1716fc96bacf79ab89d21e9'), 'format-library.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-block-editor', 'wp-components', 'wp-data', 'wp-element', 'wp-html-entities', 'wp-i18n', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-url'), 'version' => '9927db3d677671f1a346a29fcc2180f9'), 'hooks.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'ccb51dd1a27721f10dee463a611bfc99'), 'html-entities.js' => array('dependencies' => array('wp-polyfill'), 'version' => '0372a133b4e3e12173d5d0cc3e747871'), 'i18n.js' => array('dependencies' => array('wp-hooks', 'wp-polyfill'), 'version' => '1b8316f1560d573649c9e15bc4857d79'), 'is-shallow-equal.js' => array('dependencies' => array('wp-polyfill'), 'version' => '730c10803561d8ca50d6e8e31210e922'), 'keyboard-shortcuts.js' => array('dependencies' => array('lodash', 'wp-data', 'wp-element', 'wp-keycodes', 'wp-polyfill'), 'version' => 'a27be8bee70d3bb5ac2484e93af22ae0'), 'keycodes.js' => array('dependencies' => array('lodash', 'wp-i18n', 'wp-polyfill'), 'version' => '560d2751c661715556ba0ab8fca0db0a'), 'list-reusable-blocks.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-element', 'wp-i18n', 'wp-polyfill'), 'version' => '29a2b12c691398c6d5118523d63ab3c8'), 'media-utils.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-blob', 'wp-element', 'wp-i18n', 'wp-polyfill'), 'version' => '9bfb6ab7dea0971ba82e77bd24c6aefc'), 'notices.js' => array('dependencies' => array('lodash', 'wp-data', 'wp-polyfill'), 'version' => '8fc315ccd6472e9241e49a34949ffe8a'), 'nux.js' => array('dependencies' => array('lodash', 'wp-components', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => 'c9a8c4d7dfcc849633b383655e7c8662'), 'plugins.js' => array('dependencies' => array('lodash', 'wp-compose', 'wp-element', 'wp-hooks', 'wp-polyfill', 'wp-primitives'), 'version' => 'fabac44934b9ea6e192388c7bd47267c'), 'preferences.js' => array('dependencies' => array('wp-a11y', 'wp-components', 'wp-data', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => 'f32e6cedd81679094dcf14c0fae3e6b7'), 'primitives.js' => array('dependencies' => array('wp-element', 'wp-polyfill'), 'version' => '9b0dbda6f957f1e565ac2ccad9451eff'), 'priority-queue.js' => array('dependencies' => array('wp-polyfill'), 'version' => '6a537f6ddde95a06ef1077dee52a2a71'), 'redux-routine.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => 'e90ad549b17941e05ee8409b7c3235f9'), 'reusable-blocks.js' => array('dependencies' => array('lodash', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-polyfill', 'wp-primitives', 'wp-url'), 'version' => '71ab9c24524b66e2e21e87c9a33d72e3'), 'rich-text.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-compose', 'wp-data', 'wp-element', 'wp-escape-html', 'wp-i18n', 'wp-keycodes', 'wp-polyfill'), 'version' => 'ee4e29023f3f7a0dd96e699c68a00508'), 'server-side-render.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-url'), 'version' => '795a45cf4f4063a14bc9328e2ab78884'), 'shortcode.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => 'd5e2f99fa8ebfb53df9caba414b50db3'), 'token-list.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => 'cb146aeb16eca381359e4eb05617a3ff'), 'url.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '516ceec1315888dd899eafe91401d379'), 'viewport.js' => array('dependencies' => array('lodash', 'wp-compose', 'wp-data', 'wp-element', 'wp-polyfill'), 'version' => 'fe53f569d605f5faac6c151e0b164a76'), 'warning.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'e9a30f6f4be627cdc8316075e2e54546'), 'widgets.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-polyfill', 'wp-primitives'), 'version' => '49e3d47b9827f84a79ef66b789ccc2cb'), 'wordcount.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '0ccf52f1eeb33ab0798ca8d142032d99'));
     1<?php return array('a11y.js' => array('dependencies' => array('wp-dom-ready', 'wp-i18n', 'wp-polyfill'), 'version' => '9955a48198ad4f2bd749aa49d40211c2'), 'annotations.js' => array('dependencies' => array('lodash', 'wp-data', 'wp-hooks', 'wp-i18n', 'wp-polyfill', 'wp-rich-text'), 'version' => '0b465be2288cfd18559519b5a6e1fb43'), 'api-fetch.js' => array('dependencies' => array('wp-i18n', 'wp-polyfill', 'wp-url'), 'version' => '3f6a6af95ed243112cc4aba4577879c9'), 'autop.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'b22574be41df92ce2707c19720f8a6e4'), 'blob.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'ac62b64d31905319c4b0207639b9e7dd'), 'block-directory.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-primitives', 'wp-url'), 'version' => 'e246d8fbeeb7847b3c57d955bad88359'), 'block-editor.js' => array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-a11y', 'wp-api-fetch', 'wp-blob', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-is-shallow-equal', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-notices', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-shortcode', 'wp-token-list', 'wp-url', 'wp-warning', 'wp-wordcount'), 'version' => '3d40b60a8c7c156126df1598bec452bd'), 'block-library.js' => array('dependencies' => array('lodash', 'moment', 'wp-a11y', 'wp-api-fetch', 'wp-autop', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-polyfill', 'wp-primitives', 'wp-reusable-blocks', 'wp-rich-text', 'wp-server-side-render', 'wp-url', 'wp-viewport'), 'version' => '80878f15d641a8847dd4a68300e88e7b'), 'block-serialization-default-parser.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'e5be172c9d2a70d194446e28dca7b92a'), 'blocks.js' => array('dependencies' => array('lodash', 'wp-autop', 'wp-blob', 'wp-block-serialization-default-parser', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-shortcode'), 'version' => 'ac2ecb3bc1ae8349ffe849363a5bff1c'), 'components.js' => array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-a11y', 'wp-compose', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-i18n', 'wp-is-shallow-equal', 'wp-keycodes', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-warning'), 'version' => 'f80772324b8bb3a752217b2d0ca46e3a'), 'compose.js' => array('dependencies' => array('lodash', 'react', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-is-shallow-equal', 'wp-keycodes', 'wp-polyfill', 'wp-priority-queue'), 'version' => '810e86855b2d783a6b59ee3f635cddad'), 'core-data.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-blocks', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-html-entities', 'wp-i18n', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-url'), 'version' => '5a4395c9efede4f95c8ded0762e30a4a'), 'customize-widgets.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-is-shallow-equal', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-plugins', 'wp-polyfill', 'wp-preferences', 'wp-primitives', 'wp-viewport', 'wp-widgets'), 'version' => '46079e5576207e8e43490783447f023e'), 'data.js' => array('dependencies' => array('lodash', 'react', 'wp-compose', 'wp-deprecated', 'wp-element', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-priority-queue', 'wp-redux-routine'), 'version' => '1c712b504f84c8b9fb5a5b101f5c5095'), 'data-controls.js' => array('dependencies' => array('wp-api-fetch', 'wp-data', 'wp-deprecated', 'wp-polyfill'), 'version' => '12589686f5ca4db76be8584499da3a1b'), 'date.js' => array('dependencies' => array('moment', 'wp-polyfill'), 'version' => '90868e83ac95b41ab18e49f0eb5637b8'), 'deprecated.js' => array('dependencies' => array('wp-hooks', 'wp-polyfill'), 'version' => '69a7e2ea1d8d5392bb0b6db66d5c4500'), 'dom.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => 'a1847daeecaa2a6b272f60939db87cef'), 'dom-ready.js' => array('dependencies' => array('wp-polyfill'), 'version' => '03774ef51ae4221a441bcb7fc87d83d3'), 'edit-post.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-deprecated', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-preferences', 'wp-primitives', 'wp-url', 'wp-viewport', 'wp-warning'), 'version' => '5d1a40cdbddb2a0ff3c1d442783243eb'), 'edit-site.js' => array('dependencies' => array('lodash', 'react', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-deprecated', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-preferences', 'wp-primitives', 'wp-reusable-blocks', 'wp-url', 'wp-viewport'), 'version' => 'e43eb8a01293bc95ad95dbbe860667cf'), 'edit-widgets.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-preferences', 'wp-primitives', 'wp-reusable-blocks', 'wp-url', 'wp-viewport', 'wp-widgets'), 'version' => '9068a5f0e17e6a8498ab64db9eeba05d'), 'editor.js' => array('dependencies' => array('lodash', 'react', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-deprecated', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-notices', 'wp-polyfill', 'wp-preferences', 'wp-primitives', 'wp-reusable-blocks', 'wp-rich-text', 'wp-server-side-render', 'wp-url', 'wp-wordcount'), 'version' => 'fc767dd59b0d65038c1b3001e1430532'), 'element.js' => array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-escape-html', 'wp-polyfill'), 'version' => '49d63820dab84493986cc6596ed39663'), 'escape-html.js' => array('dependencies' => array('wp-polyfill'), 'version' => '8b2f29f7c1716fc96bacf79ab89d21e9'), 'format-library.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-block-editor', 'wp-components', 'wp-data', 'wp-element', 'wp-html-entities', 'wp-i18n', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-url'), 'version' => '9927db3d677671f1a346a29fcc2180f9'), 'hooks.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'ccb51dd1a27721f10dee463a611bfc99'), 'html-entities.js' => array('dependencies' => array('wp-polyfill'), 'version' => '0372a133b4e3e12173d5d0cc3e747871'), 'i18n.js' => array('dependencies' => array('wp-hooks', 'wp-polyfill'), 'version' => '1b8316f1560d573649c9e15bc4857d79'), 'is-shallow-equal.js' => array('dependencies' => array('wp-polyfill'), 'version' => '730c10803561d8ca50d6e8e31210e922'), 'keyboard-shortcuts.js' => array('dependencies' => array('lodash', 'wp-data', 'wp-element', 'wp-keycodes', 'wp-polyfill'), 'version' => 'a27be8bee70d3bb5ac2484e93af22ae0'), 'keycodes.js' => array('dependencies' => array('lodash', 'wp-i18n', 'wp-polyfill'), 'version' => '560d2751c661715556ba0ab8fca0db0a'), 'list-reusable-blocks.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-element', 'wp-i18n', 'wp-polyfill'), 'version' => '29a2b12c691398c6d5118523d63ab3c8'), 'media-utils.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-blob', 'wp-element', 'wp-i18n', 'wp-polyfill'), 'version' => '9bfb6ab7dea0971ba82e77bd24c6aefc'), 'notices.js' => array('dependencies' => array('lodash', 'wp-data', 'wp-polyfill'), 'version' => '8fc315ccd6472e9241e49a34949ffe8a'), 'nux.js' => array('dependencies' => array('lodash', 'wp-components', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => 'c9a8c4d7dfcc849633b383655e7c8662'), 'plugins.js' => array('dependencies' => array('lodash', 'wp-compose', 'wp-element', 'wp-hooks', 'wp-polyfill', 'wp-primitives'), 'version' => 'fabac44934b9ea6e192388c7bd47267c'), 'preferences.js' => array('dependencies' => array('wp-a11y', 'wp-components', 'wp-data', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => 'f32e6cedd81679094dcf14c0fae3e6b7'), 'primitives.js' => array('dependencies' => array('wp-element', 'wp-polyfill'), 'version' => '9b0dbda6f957f1e565ac2ccad9451eff'), 'priority-queue.js' => array('dependencies' => array('wp-polyfill'), 'version' => '6a537f6ddde95a06ef1077dee52a2a71'), 'redux-routine.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => 'e90ad549b17941e05ee8409b7c3235f9'), 'reusable-blocks.js' => array('dependencies' => array('lodash', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-polyfill', 'wp-primitives', 'wp-url'), 'version' => '71ab9c24524b66e2e21e87c9a33d72e3'), 'rich-text.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-compose', 'wp-data', 'wp-element', 'wp-escape-html', 'wp-i18n', 'wp-keycodes', 'wp-polyfill'), 'version' => 'ee4e29023f3f7a0dd96e699c68a00508'), 'server-side-render.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-url'), 'version' => '795a45cf4f4063a14bc9328e2ab78884'), 'shortcode.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => 'd5e2f99fa8ebfb53df9caba414b50db3'), 'token-list.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => 'cb146aeb16eca381359e4eb05617a3ff'), 'url.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '516ceec1315888dd899eafe91401d379'), 'viewport.js' => array('dependencies' => array('lodash', 'wp-compose', 'wp-data', 'wp-element', 'wp-polyfill'), 'version' => 'fe53f569d605f5faac6c151e0b164a76'), 'warning.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'e9a30f6f4be627cdc8316075e2e54546'), 'widgets.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-polyfill', 'wp-primitives'), 'version' => '49e3d47b9827f84a79ef66b789ccc2cb'), 'wordcount.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '0ccf52f1eeb33ab0798ca8d142032d99'));
  • branches/6.0/src/wp-includes/blocks/post-date.php

    r63101 r63102  
    2424        $formatted_date     = get_the_date( empty( $attributes['format'] ) ? '' : $attributes['format'], $post_ID );
    2525        if ( isset( $attributes['isLink'] ) && $attributes['isLink'] ) {
    26                 $formatted_date = sprintf( '<a href="%1s">%2s</a>', get_the_permalink( $post_ID ), $formatted_date );
     26                $formatted_date = sprintf( '<a href="%1$s">%2$s</a>', esc_url( get_the_permalink( $post_ID ) ), esc_html( $formatted_date ) );
     27        } else {
     28                $formatted_date = esc_html( $formatted_date );
    2729        }
    2830
  • branches/6.0/src/wp-includes/canonical.php

    r63101 r63102  
    919919
    920920        if ( get_query_var( 'name' ) ) {
     921                $publicly_viewable_post_types = array_filter( get_post_types( array( 'exclude_from_search' => false ) ), 'is_post_type_viewable' );
     922
    921923                /**
    922924                 * Filters whether to perform a strict guess for a 404 redirect.
     
    939941                if ( get_query_var( 'post_type' ) ) {
    940942                        if ( is_array( get_query_var( 'post_type' ) ) ) {
    941                                 // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
    942                                 $where .= " AND post_type IN ('" . join( "', '", esc_sql( get_query_var( 'post_type' ) ) ) . "')";
     943                                $post_types = array_intersect( get_query_var( 'post_type' ), $publicly_viewable_post_types );
     944                                if ( empty( $post_types ) ) {
     945                                        return false;
     946                                }
     947                                $where .= " AND post_type IN ('" . implode( "', '", esc_sql( $post_types ) ) . "')";
    943948                        } else {
     949                                if ( ! in_array( get_query_var( 'post_type' ), $publicly_viewable_post_types, true ) ) {
     950                                        return false;
     951                                }
    944952                                $where .= $wpdb->prepare( ' AND post_type = %s', get_query_var( 'post_type' ) );
    945953                        }
    946954                } else {
    947                         $where .= " AND post_type IN ('" . implode( "', '", get_post_types( array( 'public' => true ) ) ) . "')";
     955                        $where .= " AND post_type IN ('" . implode( "', '", esc_sql( $publicly_viewable_post_types ) ) . "')";
    948956                }
    949957
  • branches/6.0/src/wp-includes/http.php

    r63101 r63102  
    554554                if ( $ip ) {
    555555                        $parts = array_map( 'intval', explode( '.', $ip ) );
    556                         if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]
    557                                 || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
    558                                 || ( 192 === $parts[0] && 168 === $parts[1] )
     556
     557                        /*
     558                         * These IP address ranges are not considered valid external hosts for HTTP requests.
     559                         *
     560                         * If the host resolves to an IP address in these ranges, the request will be rejected unless the 'http_request_host_is_external' filter allows it.
     561                         *
     562                         * References:
     563                         *
     564                         * - IPv4 Special-Purpose Address Space: https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
     565                         * - IPv4 Multicast Address Assignments: https://www.rfc-editor.org/rfc/rfc5771.html
     566                         */
     567                        if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]          // 127.0.0.0/8 (loopback), 10.0.0.0/8 (private), 0.0.0.0/8 (this network).
     568                                || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )     // 172.16.0.0/12 (private).
     569                                || ( 192 === $parts[0] && 168 === $parts[1] )                      // 192.168.0.0/16 (private).
     570                                || ( 192 === $parts[0] && 0 === $parts[1] && 0 === $parts[2] )     // 192.0.0.0/24 (IETF protocol assignments).
     571                                || ( 192 === $parts[0] && 0 === $parts[1] && 2 === $parts[2] )     // 192.0.2.0/24 (TEST-NET-1).
     572                                || ( 192 === $parts[0] && 88 === $parts[1] && 99 === $parts[2] )   // 192.88.99.0/24 (6to4 relay anycast).
     573                                || ( 198 === $parts[0] && 51 === $parts[1] && 100 === $parts[2] )  // 198.51.100.0/24 (TEST-NET-2).
     574                                || ( 203 === $parts[0] && 0 === $parts[1] && 113 === $parts[2] )   // 203.0.113.0/24 (TEST-NET-3).
     575                                || ( 169 === $parts[0] && 254 === $parts[1] )                      // 169.254.0.0/16 (link-local and cloud metadata).
     576                                || ( 100 === $parts[0] && 64 <= $parts[1] && 127 >= $parts[1] )    // 100.64.0.0/10 (CGNAT).
     577                                || ( 198 === $parts[0] && 18 <= $parts[1] && 19 >= $parts[1] )     // 198.18.0.0/15 (benchmarking).
     578                                || ( 224 <= $parts[0] && 239 >= $parts[0] )                        // 224.0.0.0/4 (multicast).
     579                                || 240 <= $parts[0]                                                // 240.0.0.0/4 (reserved, includes 255.255.255.255 broadcast).
    559580                        ) {
    560581                                // If host appears local, reject unless specifically allowed.
  • branches/6.0/src/wp-includes/kses.php

    r63101 r63102  
    24712471                        // Allow CSS calc().
    24722472                        $css_test_string = preg_replace( '/calc\(((?:\([^()]*\)?|[^()])*)\)/', '', $css_test_string );
     2473                        if ( null === $css_test_string ) {
     2474                                continue;
     2475                        }
     2476
    24732477                        // Allow CSS var().
    24742478                        $css_test_string = preg_replace( '/\(?var\(--[a-zA-Z0-9_-]*\)/', '', $css_test_string );
     2479                        if ( null === $css_test_string ) {
     2480                                continue;
     2481                        }
    24752482
    24762483                        // Check for any CSS containing \ ( & } = or comments,
    24772484                        // except for url(), calc(), or var() usage checked above.
    2478                         $allow_css = ! preg_match( '%[\\\(&=}]|/\*%', $css_test_string );
     2485                        $allow_css = 0 === preg_match( '%[\\\(&=}]|/\*%', $css_test_string );
    24792486
    24802487                        /**
  • branches/6.0/src/wp-includes/user.php

    r63101 r63102  
    153153                                /* translators: %s: User name. */
    154154                                __( '<strong>Error</strong>: The username <strong>%s</strong> is not registered on this site. If you are unsure of your username, try your email address instead.' ),
    155                                 $username
     155                                esc_html( $username )
    156156                        )
    157157                );
     
    178178                                /* translators: %s: User name. */
    179179                                __( '<strong>Error</strong>: The password you entered for the username %s is incorrect.' ),
    180                                 '<strong>' . $username . '</strong>'
     180                                '<strong>' . esc_html( $username ) . '</strong>'
    181181                        ) .
    182182                        ' <a href="' . wp_lostpassword_url() . '">' .
     
    250250                                /* translators: %s: Email address. */
    251251                                __( '<strong>Error</strong>: The password you entered for the email address %s is incorrect.' ),
    252                                 '<strong>' . $email . '</strong>'
     252                                '<strong>' . esc_html( $email ) . '</strong>'
    253253                        ) .
    254254                        ' <a href="' . wp_lostpassword_url() . '">' .
     
    33143314                                /* translators: %s: Link to the login page. */
    33153315                                __( '<strong>Error:</strong> This email address is already registered. <a href="%s">Log in</a> with this address or choose another one.' ),
    3316                                 wp_login_url()
     3316                                esc_url( wp_login_url() )
    33173317                        )
    33183318                );
     
    33623362                                /* translators: %s: Admin email address. */
    33633363                                __( '<strong>Error</strong>: Could not register you&hellip; please contact the <a href="mailto:%s">site admin</a>!' ),
    3364                                 get_option( 'admin_email' )
     3364                                esc_attr( get_option( 'admin_email' ) )
    33653365                        )
    33663366                );
     
    35853585 * @since 3.0.0
    35863586 * @since 4.9.0 This function was moved from wp-admin/includes/ms.php so it's no longer Multisite specific.
     3587 * @since 7.0.3 Added the `$user_id` parameter, which is sent with the `personal_options_update` action.
     3588 *
     3589 * @param int $user_id Optional. The ID of the user whose email is being changed. Defaults to `$_POST['user_id']` if set, otherwise 0.
    35873590 *
    35883591 * @global WP_Error $errors WP_Error object.
    35893592 */
    3590 function send_confirmation_on_profile_email() {
     3593function send_confirmation_on_profile_email( $user_id = 0 ) {
    35913594        global $errors;
     3595
     3596        // Maintain backward compatibility for those relying on a check based on $_POST['user_id'].
     3597        if ( ! $user_id && isset( $_POST['user_id'] ) ) {
     3598                $user_id = (int) $_POST['user_id'];
     3599        }
    35923600
    35933601        $current_user = wp_get_current_user();
     
    35963604        }
    35973605
    3598         if ( $current_user->ID != $_POST['user_id'] ) {
     3606        if ( 0 === $current_user->ID || $current_user->ID !== (int) $user_id ) {
    35993607                return false;
    36003608        }
     
    36103618                        );
    36113619
     3620                        $_POST['email'] = addslashes( $current_user->user_email );
    36123621                        return;
    36133622                }
     
    36233632                        delete_user_meta( $current_user->ID, '_new_email' );
    36243633
     3634                        $_POST['email'] = addslashes( $current_user->user_email );
    36253635                        return;
    36263636                }
  • branches/6.0/src/wp-login.php

    r63101 r63102  
    11201120                                        /* translators: %s: Link to the login page. */
    11211121                                        __( 'Check your email for the confirmation link, then visit the <a href="%s">login page</a>.' ),
    1122                                         wp_login_url()
     1122                                        esc_url( wp_login_url() )
    11231123                                ),
    11241124                                'message'
     
    11301130                                        /* translators: %s: Link to the login page. */
    11311131                                        __( 'Registration complete. Please check your email, then visit the <a href="%s">login page</a>.' ),
    1132                                         wp_login_url()
     1132                                        esc_url( wp_login_url() )
    11331133                                ),
    11341134                                'message'
  • branches/6.0/src/wp-signup.php

    r63101 r63102  
    965965                        break;
    966966                case 'gimmeanotherblog':
    967                         validate_another_blog_signup();
     967                        if ( 'all' === $active_signup || 'blog' === $active_signup ) {
     968                                validate_another_blog_signup();
     969                        } else {
     970                                _e( 'Site registration has been disabled.' );
     971                        }
    968972                        break;
    969973                case 'default':
Note: See TracChangeset for help on using the changeset viewer.