WordPress.org
Get WordPress

Make WordPress Core

Changeset 64925


Ignore:
Timestamp:
10/28/2026 07:38:06 PM (27 hours ago)
Author:
jeremyfelt
Message:

Security: Backport the WordPress 7.1.4 security fixes to the 5.6 branch.

  • Users: Escape user login
  • Privacy: Harden column_email() output escaping in request list tables
  • Editor: Align block-delimiter whitespace matching between the PHP and JavaScript parsers.
  • Customizer: Improve changeset handling.
  • Upgrade/Install: Improve the handling of the upgrade working directory.
  • Customize: Resolve selective refresh partial placements as selectors only
  • Block parser: Only accept HTML whitespace in block delimiters

This also updates @wordpress/block-serialization-default-parser@3.8.1.

Merges [64873], [64874], [64876], [64877], [64879] to the 5.6 branch.

Props xknown, jeremyfelt, jorbin, rfaile313, westonruter, jonsurrell, dmsnell, lancewillett, umut3806, marcs0h, antonade.

Location:
branches/5.6
Files:
22 edited

Legend:

Unmodified
Added
Removed

  • branches/5.6

  • branches/5.6/package-lock.json

    r64193 r64925  
    32713271                },
    32723272                "@wordpress/block-serialization-default-parser": {
    3273                         "version": "3.8.0",
    3274                         "resolved": "https://registry.npmjs.org/@wordpress/block-serialization-default-parser/-/block-serialization-default-parser-3.8.0.tgz",
    3275                         "integrity": "sha512-kd+67ZW+5gwk0Pp+MQwcfV+Q0cpaQwoqzA27FAGu++JEmaOtUXhjAkOPOYedD6S6bC5hLR0v3vkoahwTlBUSzg==",
     3273                        "version": "3.8.1",
     3274                        "resolved": "https://registry.npmjs.org/@wordpress/block-serialization-default-parser/-/block-serialization-default-parser-3.8.1.tgz",
     3275                        "integrity": "sha512-b2apfZS/5Vy6eeXQ/RcVMJFOv/pWvCmzl2ZJb/Tai2ztlJHFc4vpQPovWXqYS228d8CLf+uf8NvsGEtD+A/iCg==",
    32763276                        "requires": {
    32773277                                "@babel/runtime": "^7.11.2"

  • branches/5.6/package.json

    r64193 r64925  
    8888                "@wordpress/block-editor": "5.1.8",
    8989                "@wordpress/block-library": "2.26.11",
    90                 "@wordpress/block-serialization-default-parser": "3.8.0",
     90                "@wordpress/block-serialization-default-parser": "3.8.1",
    9191                "@wordpress/blocks": "6.24.3",
    9292                "@wordpress/components": "11.1.6",

  • branches/5.6/src/js/_enqueues/wp/customize/preview-widgets.js

    r48110 r64925  
    416416                 */
    417417                ensureWidgetPlacementContainers: function( widgetId ) {
    418                         var sidebarPartial = this, widgetPartial, wasInserted = false, partialId = 'widget[' + widgetId + ']';
     418                        var sidebarPartial = this, sidebarArgs, widgetPartial, wasInserted = false, partialId = 'widget[' + widgetId + ']';
    419419                        widgetPartial = api.selectiveRefresh.partial( partialId );
    420420                        if ( ! widgetPartial ) {
    … …  
    424424                        }
    425425
     426                        // Build containers from the registered sidebar, since partial params can be declared in post content.
     427                        sidebarArgs = _.findWhere( self.registeredSidebars, { id: sidebarPartial.sidebarId } );
     428
    426429                        // Make sure that there is a container element for the widget in the sidebar, if at least a placeholder.
    427430                        _.each( sidebarPartial.placements(), function( sidebarPlacement ) {
    428431                                var foundWidgetPlacement, widgetContainerElement;
     432
     433                                if ( ! sidebarArgs ) {
     434                                        return;
     435                                }
    429436
    430437                                foundWidgetPlacement = _.find( widgetPartial.placements(), function( widgetPlacement ) {
    … …  
    436443
    437444                                widgetContainerElement = $(
    438                                         sidebarPartial.params.sidebarArgs.before_widget.replace( /%1\$s/g, widgetId ).replace( /%2\$s/g, 'widget' ) +
    439                                         sidebarPartial.params.sidebarArgs.after_widget
     445                                        sidebarArgs.before_widget.replace( /%1\$s/g, widgetId ).replace( /%2\$s/g, 'widget' ) +
     446                                        sidebarArgs.after_widget
    440447                                );
    441448

  • branches/5.6/src/js/_enqueues/wp/customize/selective-refresh.js

    r48651 r64925  
    263263                                selector += ', ';
    264264                        }
    265                         selector += '[data-customize-partial-id="' + partial.id + '"]'; // @todo Consider injecting customize-partial-id-${id} classnames instead.
    266 
    267                         return $( selector ).map( function() {
     265                        selector += '[data-customize-partial-id="' + $.escapeSelector( partial.id ) + '"]';
     266
     267                        return $( document ).find( selector ).map( function() {
    268268                                var container = $( this ), context;
    269269

  • branches/5.6/src/wp-admin/includes/ajax-actions.php

    r63706 r64925  
    17011701                                        /* translators: %s: The new user. */
    17021702                                        __( 'User %s added' ),
    1703                                         '<a href="#user-' . $user_id . '">' . $user_object->user_login . '</a>'
     1703                                        '<a href="#user-' . $user_id . '">' . esc_html( $user_object->user_login ) . '</a>'
    17041704                                ),
    17051705                                'role'      => $role,

  • branches/5.6/src/wp-admin/includes/class-wp-ms-users-list-table.php

    r49183 r64925  
    239239                        <?php
    240240                        /* translators: %s: User login. */
    241                         printf( __( 'Select %s' ), $user->user_login );
     241                        printf( __( 'Select %s' ), esc_html( $user->user_login ) );
    242242                        ?>
    243243                </label>
    … …  
    272272                if ( current_user_can( 'edit_user', $user->ID ) ) {
    273273                        $edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user->ID ) ) );
    274                         $edit      = "<a href=\"{$edit_link}\">{$user->user_login}</a>";
     274                        $edit      = "<a href=\"{$edit_link}\">" . esc_html( $user->user_login ) . '</a>';
    275275                } else {
    276                         $edit = $user->user_login;
     276                        $edit = esc_html( $user->user_login );
    277277                }
    278278

  • branches/5.6/src/wp-admin/includes/class-wp-privacy-data-export-requests-list-table.php

    r49259 r64925  
    9999                }
    100100
    101                 return sprintf( '<a href="%1$s">%2$s</a> %3$s', esc_url( 'mailto:' . $item->email ), $item->email, $this->row_actions( $row_actions ) );
     101                return sprintf( '<a href="%1$s">%2$s</a> %3$s', esc_url( 'mailto:' . $item->email ), esc_html( $item->email ), $this->row_actions( $row_actions ) );
    102102        }
    103103

  • branches/5.6/src/wp-admin/includes/class-wp-privacy-data-removal-requests-list-table.php

    r49259 r64925  
    105105                }
    106106
    107                 return sprintf( '<a href="%1$s">%2$s</a> %3$s', esc_url( 'mailto:' . $item->email ), $item->email, $this->row_actions( $row_actions ) );
     107                return sprintf( '<a href="%1$s">%2$s</a> %3$s', esc_url( 'mailto:' . $item->email ), esc_html( $item->email ), $this->row_actions( $row_actions ) );
    108108        }
    109109

  • branches/5.6/src/wp-admin/includes/class-wp-privacy-requests-table.php

    r49333 r64925  
    509509         */
    510510        public function column_email( $item ) {
    511                 return sprintf( '<a href="%1$s">%2$s</a> %3$s', esc_url( 'mailto:' . $item->email ), $item->email, $this->row_actions( array() ) );
     511                return sprintf( '<a href="%1$s">%2$s</a> %3$s', esc_url( 'mailto:' . $item->email ), esc_html( $item->email ), $this->row_actions( array() ) );
    512512        }
    513513

  • branches/5.6/src/wp-admin/includes/class-wp-upgrader.php

    r48835 r64925  
    291291
    292292        /**
     293         * Builds an unpredictable name for the directory a package is unpacked into.
     294         *
     295         * @since 7.1.4
     296         *
     297         * @param string $package The full local path or URI of the package.
     298         * @return string The directory name, without a path.
     299         */
     300        private function get_working_dir_name( $package ) {
     301                // Strip off any .tmp or .zip suffixes.
     302                $name = basename( basename( $package, '.tmp' ), '.zip' );
     303
     304                return $name . '-' . wp_generate_password( 16, false );
     305        }
     306
     307        /**
    293308         * Unpack a compressed package file.
    294309         *
    … …  
    309324                $upgrade_folder = $wp_filesystem->wp_content_dir() . 'upgrade/';
    310325
    311                 // Clean up contents of upgrade directory beforehand.
     326                // Clean up contents of upgrade directory beforehand, keeping its index.php.
    312327                $upgrade_files = $wp_filesystem->dirlist( $upgrade_folder );
    313328                if ( ! empty( $upgrade_files ) ) {
    314329                        foreach ( $upgrade_files as $file ) {
     330                                if ( 'index.php' === $file['name'] ) {
     331                                        continue;
     332                                }
     333
    315334                                $wp_filesystem->delete( $upgrade_folder . $file['name'], true );
    316335                        }
    317336                }
    318337
    319                 // We need a working directory - strip off any .tmp or .zip suffixes.
    320                 $working_dir = $upgrade_folder . basename( basename( $package, '.tmp' ), '.zip' );
     338                /*
     339                 * The upgrade directory is web-served. Keep it from being listed, as core does
     340                 * for wp-content and its plugins and themes directories, so the name of the
     341                 * working directory created below cannot be discovered from a directory index.
     342                 */
     343                if ( ! $wp_filesystem->is_dir( $upgrade_folder ) ) {
     344                        $wp_filesystem->mkdir( $upgrade_folder, FS_CHMOD_DIR );
     345                }
     346                if ( ! $wp_filesystem->exists( $upgrade_folder . 'index.php' ) ) {
     347                        $wp_filesystem->put_contents( $upgrade_folder . 'index.php', "<?php\n// Silence is golden.\n", FS_CHMOD_FILE );
     348                }
     349
     350                // We need a working directory.
     351                $working_dir = $upgrade_folder . $this->get_working_dir_name( $package );
    321352
    322353                // Clean up working directory.

  • branches/5.6/src/wp-admin/includes/class-wp-users-list-table.php

    r49190 r64925  
    446446
    447447                        if ( current_user_can( 'edit_user', $user_object->ID ) ) {
    448                                 $edit            = "<strong><a href=\"{$edit_link}\">{$user_object->user_login}</a>{$super_admin}</strong><br />";
     448                                $edit            = '<strong><a href="' . $edit_link . '">' . esc_html( $user_object->user_login ) . "</a>{$super_admin}</strong><br />";
    449449                                $actions['edit'] = '<a href="' . $edit_link . '">' . __( 'Edit' ) . '</a>';
    450450                        } else {
    451                                 $edit = "<strong>{$user_object->user_login}{$super_admin}</strong><br />";
     451                                $edit = '<strong>' . esc_html( $user_object->user_login ) . "{$super_admin}</strong><br />";
    452452                        }
    453453
    … …  
    492492                                $user_object->ID,
    493493                                /* translators: %s: User login. */
    494                                 sprintf( __( 'Select %s' ), $user_object->user_login ),
     494                                sprintf( __( 'Select %s' ), esc_html( $user_object->user_login ) ),
    495495                                $role_classes
    496496                        );
    497497
    498498                } else {
    499                         $edit = "<strong>{$user_object->user_login}{$super_admin}</strong>";
     499                        $edit = '<strong>' . esc_html( $user_object->user_login ) . "{$super_admin}</strong>";
    500500                }
    501501

  • branches/5.6/src/wp-admin/includes/ms.php

    r49384 r64925  
    870870        wp_nonce_field( 'ms-users-delete' );
    871871        $site_admins = get_super_admins();
    872         $admin_out   = '<option value="' . esc_attr( $current_user->ID ) . '">' . $current_user->user_login . '</option>';
     872        $admin_out   = '<option value="' . esc_attr( $current_user->ID ) . '">' . esc_html( $current_user->user_login ) . '</option>';
    873873        ?>
    874874        <table class="form-table" role="presentation">
    … …  
    884884                                                /* translators: %s: User login. */
    885885                                                __( 'Warning! User %s cannot be deleted.' ),
    886                                                 $delete_user->user_login
     886                                                esc_html( $delete_user->user_login )
    887887                                        )
    888888                                );
    … …  
    894894                                                /* translators: %s: User login. */
    895895                                                __( 'Warning! User cannot be deleted. The user %s is a network administrator.' ),
    896                                                 '<em>' . $delete_user->user_login . '</em>'
     896                                                '<em>' . esc_html( $delete_user->user_login ) . '</em>'
    897897                                        )
    898898                                );
    … …  
    900900                        ?>
    901901                        <tr>
    902                                 <th scope="row"><?php echo $delete_user->user_login; ?>
     902                                <th scope="row"><?php echo esc_html( $delete_user->user_login ); ?>
    903903                                        <?php echo '<input type="hidden" name="user[]" value="' . esc_attr( $user_id ) . '" />' . "\n"; ?>
    904904                                </th>
    … …  
    913913                                        /* translators: %s: User login. */
    914914                                        __( 'What should be done with content owned by %s?' ),
    915                                         '<em>' . $delete_user->user_login . '</em>'
     915                                        '<em>' . esc_html( $delete_user->user_login ) . '</em>'
    916916                                );
    917917                                ?>
    … …  
    934934                                                foreach ( $blog_users as $user ) {
    935935                                                        if ( ! in_array( (int) $user->ID, $allusers, true ) ) {
    936                                                                 $user_list .= "<option value='{$user->ID}'>{$user->user_login}</option>";
     936                                                                $user_list .= "<option value='{$user->ID}'>" . esc_html( $user->user_login ) . '</option>';
    937937                                                        }
    938938                                                }

  • branches/5.6/src/wp-admin/includes/update-core.php

    r49775 r64925  
    10381038        // Don't copy wp-content, we'll deal with that below.
    10391039        // We also copy version.php last so failed updates report their old version.
    1040         $skip              = array( 'wp-content', 'wp-includes/version.php' );
     1040        // Never copy a wp-config.php, which could have been written to the working directory.
     1041        $skip              = array( 'wp-content', 'wp-includes/version.php', 'wp-config.php' );
    10411042        $check_is_writable = array();
    10421043

  • branches/5.6/src/wp-admin/user-edit.php

    r50044 r64925  
    491491                foreach ( $public_display as $id => $item ) {
    492492                        ?>
    493                 <option <?php selected( $profileuser->display_name, $item ); ?>><?php echo $item; ?></option>
     493                <option <?php selected( $profileuser->display_name, $item ); ?>><?php echo esc_html( $item ); ?></option>
    494494                        <?php
    495495                }
    … …  
    702702                                <?php
    703703                                /* translators: %s: User's display name. */
    704                                 printf( __( 'Log %s out of all locations.' ), $profileuser->display_name );
     704                                printf( __( 'Log %s out of all locations.' ), esc_html( $profileuser->display_name ) );
    705705                                ?>
    706706                        </p>

  • branches/5.6/src/wp-admin/users.php

    r49286 r64925  
    292292                        if ( $id == $current_user->ID ) {
    293293                                /* translators: 1: User ID, 2: User login. */
    294                                 echo '<li>' . sprintf( __( 'ID #%1$s: %2$s <strong>The current user will not be deleted.</strong>' ), $id, $user->user_login ) . "</li>\n";
     294                                echo '<li>' . sprintf( __( 'ID #%1$s: %2$s <strong>The current user will not be deleted.</strong>' ), $id, esc_html( $user->user_login ) ) . "</li>\n";
    295295                        } else {
    296296                                /* translators: 1: User ID, 2: User login. */
    297                                 echo '<li><input type="hidden" name="users[]" value="' . esc_attr( $id ) . '" />' . sprintf( __( 'ID #%1$s: %2$s' ), $id, $user->user_login ) . "</li>\n";
     297                                echo '<li><input type="hidden" name="users[]" value="' . esc_attr( $id ) . '" />' . sprintf( __( 'ID #%1$s: %2$s' ), $id, esc_html( $user->user_login ) ) . "</li>\n";
    298298                                $go_delete++;
    299299                        }
    … …  
    430430                        if ( ! current_user_can( 'remove_user', $id ) ) {
    431431                                /* translators: 1: User ID, 2: User login. */
    432                                 echo '<li>' . sprintf( __( 'ID #%1$s: %2$s <strong>Sorry, you are not allowed to remove this user.</strong>' ), $id, $user->user_login ) . "</li>\n";
     432                                echo '<li>' . sprintf( __( 'ID #%1$s: %2$s <strong>Sorry, you are not allowed to remove this user.</strong>' ), $id, esc_html( $user->user_login ) ) . "</li>\n";
    433433                        } else {
    434434                                /* translators: 1: User ID, 2: User login. */
    435                                 echo "<li><input type=\"hidden\" name=\"users[]\" value=\"{$id}\" />" . sprintf( __( 'ID #%1$s: %2$s' ), $id, $user->user_login ) . "</li>\n";
     435                                echo "<li><input type=\"hidden\" name=\"users[]\" value=\"{$id}\" />" . sprintf( __( 'ID #%1$s: %2$s' ), $id, esc_html( $user->user_login ) ) . "</li>\n";
    436436                                $go_remove = true;
    437437                        }

  • branches/5.6/src/wp-content/themes/twentytwenty/assets/js/customize-preview.js

    r47122 r64925  
    3939                        partial = this;
    4040                        params = partial.params;
    41                         cover = $( params.selector );
     41                        cover = $( document ).find( params.selector );
    4242
    4343                        if ( cover.length && cover.hasClass( 'bg-image' ) ) {
    … …  
    7373                        params = partial.params;
    7474                        setting = api( params.primarySetting );
    75                         cover = $( params.selector );
     75                        cover = $( document ).find( params.selector );
    7676
    7777                        if ( cover.length ) {

  • branches/5.6/src/wp-includes/admin-bar.php

    r48586 r64925  
    242242        $avatar = get_avatar( $user_id, 26 );
    243243        /* translators: %s: Current user's display name. */
    244         $howdy = sprintf( __( 'Howdy, %s' ), '<span class="display-name">' . $current_user->display_name . '</span>' );
     244        $howdy = sprintf( __( 'Howdy, %s' ), '<span class="display-name">' . esc_html( $current_user->display_name ) . '</span>' );
    245245        $class = empty( $avatar ) ? '' : 'with-avatar';
    246246
    … …  
    289289
    290290        $user_info  = get_avatar( $user_id, 64 );
    291         $user_info .= "<span class='display-name'>{$current_user->display_name}</span>";
     291        $user_info .= "<span class='display-name'>" . esc_html( $current_user->display_name ) . '</span>';
    292292
    293293        if ( $current_user->display_name !== $current_user->user_login ) {
    294                 $user_info .= "<span class='username'>{$current_user->user_login}</span>";
     294                $user_info .= "<span class='username'>" . esc_html( $current_user->user_login ) . '</span>';
    295295        }
    296296

  • branches/5.6/src/wp-includes/assets/script-loader-packages.php

    r54573 r64925  
    1 <?php return array('a11y.js' => array('dependencies' => array('wp-dom-ready', 'wp-i18n', 'wp-polyfill'), 'version' => '6d98587879c8c19080b1e3a855e946be'), 'annotations.js' => array('dependencies' => array('lodash', 'wp-data', 'wp-hooks', 'wp-i18n', 'wp-polyfill', 'wp-rich-text'), 'version' => '7e632871049335586b0d9c3057baedbb'), 'api-fetch.js' => array('dependencies' => array('wp-i18n', 'wp-polyfill', 'wp-url'), 'version' => '9d28f58ef7c5024b312e65bc2ddfe4fc'), 'autop.js' => array('dependencies' => array('wp-polyfill'), 'version' => '46344923664714dbd8b729a8e45156f8'), 'blob.js' => array('dependencies' => array('wp-polyfill'), 'version' => '72222aa8da2b1686a4f3ff592e15ff3b'), 'block-directory.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-data-controls', 'wp-edit-post', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-primitives'), 'version' => '2d8c506d0b1125c6089e00a3f9a9e66b'), 'block-editor.js' => array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-a11y', 'wp-blob', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-is-shallow-equal', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-notices', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-shortcode', 'wp-token-list', 'wp-url', 'wp-viewport', 'wp-warning', 'wp-wordcount'), 'version' => 'ec6acc7be8b4773e914cc2fb164d0971'), 'block-library.js' => array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-api-fetch', 'wp-autop', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-polyfill', 'wp-primitives', 'wp-reusable-blocks', 'wp-rich-text', 'wp-server-side-render', 'wp-url', 'wp-viewport'), 'version' => '8beea1ef4c70b2aac892c558c0287937'), 'block-serialization-default-parser.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'd0f9ebaf5c46ca058852005b47bcf613'), 'blocks.js' => array('dependencies' => array('lodash', 'wp-autop', 'wp-blob', 'wp-block-serialization-default-parser', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-primitives', 'wp-shortcode'), 'version' => 'f67689f361ab59c7dad85276f387fcb8'), 'components.js' => array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-a11y', 'wp-compose', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-is-shallow-equal', 'wp-keycodes', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-warning'), 'version' => '614b83afb5f74282f4cee10140ef2fc3'), 'compose.js' => array('dependencies' => array('lodash', 'react', 'wp-element', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-priority-queue'), 'version' => 'd87491e5ab841d917c5cd68dc712c6c7'), 'core-data.js' => array('dependencies' => array('lodash', 'wp-blocks', 'wp-data', 'wp-data-controls', 'wp-deprecated', 'wp-element', 'wp-i18n', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-url'), 'version' => '9dcad7bce6eca9d557a117d46e45810a'), 'data.js' => array('dependencies' => array('lodash', 'react', 'wp-compose', 'wp-deprecated', 'wp-element', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-priority-queue', 'wp-redux-routine'), 'version' => '3bab2780d3e6f8ae03ebd668f52f02ea'), 'data-controls.js' => array('dependencies' => array('wp-api-fetch', 'wp-data', 'wp-polyfill'), 'version' => 'a65b10ed093076b98cfe778869208b37'), 'date.js' => array('dependencies' => array('moment', 'wp-polyfill'), 'version' => '8ae959439a81453190260b6a30198ef1'), 'deprecated.js' => array('dependencies' => array('wp-hooks', 'wp-polyfill'), 'version' => '26aefabb46263ab5dac6d7f6c63b664c'), 'dom.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '2b324c8d7249ec39a8b83805d3a52364'), 'dom-ready.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'a6586b64552c9c6924b8093e9ef4f74e'), 'edit-post.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-data-controls', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-primitives', 'wp-reusable-blocks', 'wp-url', 'wp-viewport', 'wp-warning'), 'version' => '77c6beef2d6da7db6a8ce51cccc9447e'), 'editor.js' => array('dependencies' => array('lodash', 'react', 'wp-api-fetch', 'wp-autop', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-data-controls', 'wp-date', 'wp-deprecated', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-notices', 'wp-polyfill', 'wp-primitives', 'wp-reusable-blocks', 'wp-rich-text', 'wp-server-side-render', 'wp-url', 'wp-viewport', 'wp-wordcount'), 'version' => 'ec8a27ad08bb39c13a28ad254f4ac316'), 'element.js' => array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-escape-html', 'wp-polyfill'), 'version' => '2484bb1f7768590fd1dfb077e0385200'), 'escape-html.js' => array('dependencies' => array('wp-polyfill'), 'version' => '11a9ed20aa0e5b49a24e416455d2311e'), 'format-library.js' => array('dependencies' => array('lodash', 'wp-block-editor', 'wp-components', 'wp-data', 'wp-dom', 'wp-element', 'wp-html-entities', 'wp-i18n', 'wp-keycodes', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-url'), 'version' => '667d82cc8bcf9a37fe5a94ec7629630d'), 'hooks.js' => array('dependencies' => array('wp-polyfill'), 'version' => '76a5722c079a12ec8a42dcb3874d9d66'), 'html-entities.js' => array('dependencies' => array('wp-polyfill'), 'version' => '5f0f2fc8f6cde41ab343549aa0b50183'), 'i18n.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'd3a3d3210bfb2ca7ef6bdba31c413250'), 'is-shallow-equal.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'b2327d0572e72da49f9e26cc3a53de34'), 'keyboard-shortcuts.js' => array('dependencies' => array('lodash', 'wp-compose', 'wp-data', 'wp-keycodes', 'wp-polyfill'), 'version' => '8b3c847079e8b235728aa35e166fea56'), 'keycodes.js' => array('dependencies' => array('lodash', 'wp-i18n', 'wp-polyfill'), 'version' => '3b63bf025b7879801d724528993b5e26'), 'list-reusable-blocks.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-element', 'wp-i18n', 'wp-polyfill'), 'version' => '4e8778ead4480c03445841853d780e5f'), 'media-utils.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-blob', 'wp-element', 'wp-i18n', 'wp-polyfill'), 'version' => 'f28e88248b4b5e2a19d86ea66f404f23'), 'notices.js' => array('dependencies' => array('lodash', 'wp-data', 'wp-polyfill'), 'version' => '690f3b4a52a09f1f621918c762a10272'), 'nux.js' => array('dependencies' => array('lodash', 'wp-components', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => '10dc58ff29dacce89f56870934a48659'), 'plugins.js' => array('dependencies' => array('lodash', 'wp-compose', 'wp-element', 'wp-hooks', 'wp-polyfill', 'wp-primitives'), 'version' => 'b26cb9a7d97012f662da22943ee99c1d'), 'primitives.js' => array('dependencies' => array('wp-element', 'wp-polyfill'), 'version' => '893b0eee5573b5b435e1065d3b3aa11d'), 'priority-queue.js' => array('dependencies' => array('wp-polyfill'), 'version' => '61fc9b8c45afe763799612e733d04e5d'), 'redux-routine.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => 'caae3879a1870fe55d4d6c91882b4aec'), 'reusable-blocks.js' => array('dependencies' => array('wp-block-editor', 'wp-blocks', 'wp-components', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-polyfill', 'wp-primitives'), 'version' => '903185c108d2d75af4a1ff4d4aa5f6a0'), 'rich-text.js' => array('dependencies' => array('lodash', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-escape-html', 'wp-keycodes', 'wp-polyfill'), 'version' => '2e8ab5d07ffe7a8dca38935914cd1fb4'), 'server-side-render.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-components', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-url'), 'version' => '5b41896d723f96d6f10f75440d86378a'), 'shortcode.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '0f4a8551daa990e80114889793034ff6'), 'token-list.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '8c1de0af2850ea512bf7ee4ea8a6af09'), 'url.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '5cfad922551470f0d04552a83d5e7eb4'), 'viewport.js' => array('dependencies' => array('lodash', 'wp-compose', 'wp-data', 'wp-element', 'wp-polyfill'), 'version' => '7fa6a8ee86592080d7dc3c2319c0aa82'), 'warning.js' => array('dependencies' => array('wp-polyfill'), 'version' => '202ac16e99afe7c33c257b248625a947'), 'wordcount.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '8134af8a132c0ab063d74d2151f21e31'));
     1<?php return array('a11y.js' => array('dependencies' => array('wp-dom-ready', 'wp-i18n', 'wp-polyfill'), 'version' => '6d98587879c8c19080b1e3a855e946be'), 'annotations.js' => array('dependencies' => array('lodash', 'wp-data', 'wp-hooks', 'wp-i18n', 'wp-polyfill', 'wp-rich-text'), 'version' => '7e632871049335586b0d9c3057baedbb'), 'api-fetch.js' => array('dependencies' => array('wp-i18n', 'wp-polyfill', 'wp-url'), 'version' => '9d28f58ef7c5024b312e65bc2ddfe4fc'), 'autop.js' => array('dependencies' => array('wp-polyfill'), 'version' => '46344923664714dbd8b729a8e45156f8'), 'blob.js' => array('dependencies' => array('wp-polyfill'), 'version' => '72222aa8da2b1686a4f3ff592e15ff3b'), 'block-directory.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-data-controls', 'wp-edit-post', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-primitives'), 'version' => '2d8c506d0b1125c6089e00a3f9a9e66b'), 'block-editor.js' => array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-a11y', 'wp-blob', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-is-shallow-equal', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-notices', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-shortcode', 'wp-token-list', 'wp-url', 'wp-viewport', 'wp-warning', 'wp-wordcount'), 'version' => 'ec6acc7be8b4773e914cc2fb164d0971'), 'block-library.js' => array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-api-fetch', 'wp-autop', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-polyfill', 'wp-primitives', 'wp-reusable-blocks', 'wp-rich-text', 'wp-server-side-render', 'wp-url', 'wp-viewport'), 'version' => '8beea1ef4c70b2aac892c558c0287937'), 'block-serialization-default-parser.js' => array('dependencies' => array('wp-polyfill'), 'version' => '89999d319f206c2a82145227e4793694'), 'blocks.js' => array('dependencies' => array('lodash', 'wp-autop', 'wp-blob', 'wp-block-serialization-default-parser', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-primitives', 'wp-shortcode'), 'version' => 'f67689f361ab59c7dad85276f387fcb8'), 'components.js' => array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-a11y', 'wp-compose', 'wp-date', 'wp-deprecated', 'wp-dom', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-is-shallow-equal', 'wp-keycodes', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-warning'), 'version' => '614b83afb5f74282f4cee10140ef2fc3'), 'compose.js' => array('dependencies' => array('lodash', 'react', 'wp-element', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-priority-queue'), 'version' => 'd87491e5ab841d917c5cd68dc712c6c7'), 'core-data.js' => array('dependencies' => array('lodash', 'wp-blocks', 'wp-data', 'wp-data-controls', 'wp-deprecated', 'wp-element', 'wp-i18n', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-url'), 'version' => '9dcad7bce6eca9d557a117d46e45810a'), 'data.js' => array('dependencies' => array('lodash', 'react', 'wp-compose', 'wp-deprecated', 'wp-element', 'wp-is-shallow-equal', 'wp-polyfill', 'wp-priority-queue', 'wp-redux-routine'), 'version' => '3bab2780d3e6f8ae03ebd668f52f02ea'), 'data-controls.js' => array('dependencies' => array('wp-api-fetch', 'wp-data', 'wp-polyfill'), 'version' => 'a65b10ed093076b98cfe778869208b37'), 'date.js' => array('dependencies' => array('moment', 'wp-polyfill'), 'version' => '8ae959439a81453190260b6a30198ef1'), 'deprecated.js' => array('dependencies' => array('wp-hooks', 'wp-polyfill'), 'version' => '26aefabb46263ab5dac6d7f6c63b664c'), 'dom.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '2b324c8d7249ec39a8b83805d3a52364'), 'dom-ready.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'a6586b64552c9c6924b8093e9ef4f74e'), 'edit-post.js' => array('dependencies' => array('lodash', 'wp-a11y', 'wp-api-fetch', 'wp-block-editor', 'wp-block-library', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-data-controls', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-primitives', 'wp-reusable-blocks', 'wp-url', 'wp-viewport', 'wp-warning'), 'version' => '77c6beef2d6da7db6a8ce51cccc9447e'), 'editor.js' => array('dependencies' => array('lodash', 'react', 'wp-api-fetch', 'wp-autop', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-data-controls', 'wp-date', 'wp-deprecated', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-media-utils', 'wp-notices', 'wp-polyfill', 'wp-primitives', 'wp-reusable-blocks', 'wp-rich-text', 'wp-server-side-render', 'wp-url', 'wp-viewport', 'wp-wordcount'), 'version' => 'ec8a27ad08bb39c13a28ad254f4ac316'), 'element.js' => array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-escape-html', 'wp-polyfill'), 'version' => '2484bb1f7768590fd1dfb077e0385200'), 'escape-html.js' => array('dependencies' => array('wp-polyfill'), 'version' => '11a9ed20aa0e5b49a24e416455d2311e'), 'format-library.js' => array('dependencies' => array('lodash', 'wp-block-editor', 'wp-components', 'wp-data', 'wp-dom', 'wp-element', 'wp-html-entities', 'wp-i18n', 'wp-keycodes', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-url'), 'version' => '667d82cc8bcf9a37fe5a94ec7629630d'), 'hooks.js' => array('dependencies' => array('wp-polyfill'), 'version' => '76a5722c079a12ec8a42dcb3874d9d66'), 'html-entities.js' => array('dependencies' => array('wp-polyfill'), 'version' => '5f0f2fc8f6cde41ab343549aa0b50183'), 'i18n.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'd3a3d3210bfb2ca7ef6bdba31c413250'), 'is-shallow-equal.js' => array('dependencies' => array('wp-polyfill'), 'version' => 'b2327d0572e72da49f9e26cc3a53de34'), 'keyboard-shortcuts.js' => array('dependencies' => array('lodash', 'wp-compose', 'wp-data', 'wp-keycodes', 'wp-polyfill'), 'version' => '8b3c847079e8b235728aa35e166fea56'), 'keycodes.js' => array('dependencies' => array('lodash', 'wp-i18n', 'wp-polyfill'), 'version' => '3b63bf025b7879801d724528993b5e26'), 'list-reusable-blocks.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-element', 'wp-i18n', 'wp-polyfill'), 'version' => '4e8778ead4480c03445841853d780e5f'), 'media-utils.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-blob', 'wp-element', 'wp-i18n', 'wp-polyfill'), 'version' => 'f28e88248b4b5e2a19d86ea66f404f23'), 'notices.js' => array('dependencies' => array('lodash', 'wp-data', 'wp-polyfill'), 'version' => '690f3b4a52a09f1f621918c762a10272'), 'nux.js' => array('dependencies' => array('lodash', 'wp-components', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-primitives'), 'version' => '10dc58ff29dacce89f56870934a48659'), 'plugins.js' => array('dependencies' => array('lodash', 'wp-compose', 'wp-element', 'wp-hooks', 'wp-polyfill', 'wp-primitives'), 'version' => 'b26cb9a7d97012f662da22943ee99c1d'), 'primitives.js' => array('dependencies' => array('wp-element', 'wp-polyfill'), 'version' => '893b0eee5573b5b435e1065d3b3aa11d'), 'priority-queue.js' => array('dependencies' => array('wp-polyfill'), 'version' => '61fc9b8c45afe763799612e733d04e5d'), 'redux-routine.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => 'caae3879a1870fe55d4d6c91882b4aec'), 'reusable-blocks.js' => array('dependencies' => array('wp-block-editor', 'wp-blocks', 'wp-components', 'wp-core-data', 'wp-data', 'wp-element', 'wp-i18n', 'wp-notices', 'wp-polyfill', 'wp-primitives'), 'version' => '903185c108d2d75af4a1ff4d4aa5f6a0'), 'rich-text.js' => array('dependencies' => array('lodash', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-escape-html', 'wp-keycodes', 'wp-polyfill'), 'version' => '2e8ab5d07ffe7a8dca38935914cd1fb4'), 'server-side-render.js' => array('dependencies' => array('lodash', 'wp-api-fetch', 'wp-components', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-i18n', 'wp-polyfill', 'wp-url'), 'version' => '5b41896d723f96d6f10f75440d86378a'), 'shortcode.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '0f4a8551daa990e80114889793034ff6'), 'token-list.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '8c1de0af2850ea512bf7ee4ea8a6af09'), 'url.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '5cfad922551470f0d04552a83d5e7eb4'), 'viewport.js' => array('dependencies' => array('lodash', 'wp-compose', 'wp-data', 'wp-element', 'wp-polyfill'), 'version' => '7fa6a8ee86592080d7dc3c2319c0aa82'), 'warning.js' => array('dependencies' => array('wp-polyfill'), 'version' => '202ac16e99afe7c33c257b248625a947'), 'wordcount.js' => array('dependencies' => array('lodash', 'wp-polyfill'), 'version' => '8134af8a132c0ab063d74d2151f21e31'));

  • branches/5.6/src/wp-includes/class-wp-block-parser.php

    r49135 r64925  
    411411                 */
    412412                $has_match = preg_match(
    413                         '/<!--\s+(?P<closer>\/)?wp:(?P<namespace>[a-z][a-z0-9_-]*\/)?(?P<name>[a-z][a-z0-9_-]*)\s+(?P<attrs>{(?:(?:[^}]+|}+(?=})|(?!}\s+\/?-->).)*+)?}\s+)?(?P<void>\/)?-->/s',
     413                        '/<!--[ \t\f\r\n]+(?P<closer>\/)?wp:(?P<namespace>[a-z][a-z0-9_-]*\/)?(?P<name>[a-z][a-z0-9_-]*)[ \t\f\r\n]+(?P<attrs>{(?:(?:[^}]+|}+(?=})|(?!}[ \t\f\r\n]+\/?-->).)*+)?}[ \t\f\r\n]+)?(?P<void>\/)?-->/s',
    414414                        $this->document,
    415415                        $matches,

  • branches/5.6/src/wp-includes/class-wp-customize-manager.php

    r49732 r64925  
    616616                        $changeset_uuid = null;
    617617
    618                         if ( ! $this->branching() && $this->is_theme_active() ) {
     618                        /**
     619                         * Only users who can customize may have the latest unpublished changeset auto-loaded. Otherwise, an
     620                         * unauthenticated preview request lacking a UUID could adopt another user's unpublished changeset and
     621                         * disclose its state, since the UUID serves as the secret key for previewing. Unauthorized requests
     622                         * get a fresh UUID instead, which matches no changeset and is rejected in {@see self::setup_theme()}.
     623                         */
     624                        if ( ! $this->branching() && $this->is_theme_active() && current_user_can( 'customize' ) ) {
    619625                                $unpublished_changeset_posts = $this->get_changeset_posts(
    620626                                        array(

  • branches/5.6/src/wp-signup.php

    r63106 r64925  
    534534                        ),
    535535                        esc_url( $login_url ),
    536                         $user_name
     536                        esc_html( $user_name )
    537537                );
    538538                ?>
Note: See TracChangeset for help on using the changeset viewer.