Skip to content

Commit 59dcd56

Browse files
audrasjbaudrasjb
committed
Grouped backports to the 5.1 branch.
- Media: Refactor search by filename within the admin, - REST API: Lockdown post parameter of the terms endpoint, - Customize: Escape blogname option in underscores templates, - Query: Validate relation in `WP_Date_Query`, - Posts, Post types: Apply KSES to post-by-email content, - General: Validate host on "Are you sure?" screen, - Posts, Post types: Remove emails from post-by-email logs, - Pings/trackbacks: Apply KSES to all trackbacks, - Mail: Reset PHPMailer properties between use, - Widgets: Escape RSS error messages for display. Merges [54521-54530] to the 5.1 branch. Props voldemortensen, johnbillion, paulkevan, peterwilsoncc, xknown, dd32, audrasjb, martinkrcho, vortfu, davidbaumwald, tykoted, timothyblynjacobs, johnjamesjacoby, ehtis, matveb, talldanwp. git-svn-id: https://develop.svn.wordpress.org/branches/5.1@54570 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 9b6770b commit 59dcd56

19 files changed

+296
-68
lines changed

‎src/wp-admin/includes/ajax-actions.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2746,7 +2746,7 @@ function wp_ajax_query_attachments() {
27462746

27472747
// Filter query clauses to include filenames.
27482748
if ( isset( $query['s'] ) ) {
2749-
add_filter( 'posts_clauses', '_filter_query_attachment_filenames' );
2749+
add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' );
27502750
}
27512751

27522752
/**

‎src/wp-admin/includes/post.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1254,7 +1254,7 @@ function wp_edit_attachments_query_vars( $q = false ) {
12541254

12551255
// Filter query clauses to include filenames.
12561256
if ( isset( $q['s'] ) ) {
1257-
add_filter( 'posts_clauses', '_filter_query_attachment_filenames' );
1257+
add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' );
12581258
}
12591259

12601260
return $q;

‎src/wp-includes/class-wp-query.php‎

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -425,6 +425,13 @@ class WP_Query {
425425
*/
426426
public $thumbnails_cached = false;
427427

428+
/**
429+
* Controls whether an attachment query should include filenames or not.
430+
*
431+
* @since 6.0.3
432+
* @var bool
433+
*/
434+
protected $allow_query_attachment_by_filename = false;
428435
/**
429436
* Cached list of search stopwords.
430437
*
@@ -1352,8 +1359,13 @@ protected function parse_search( &$q ) {
13521359
$q['search_orderby_title'][] = $wpdb->prepare( "{$wpdb->posts}.post_title LIKE %s", $like );
13531360
}
13541361

1355-
$like = $n . $wpdb->esc_like( $term ) . $n;
1356-
$search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s))", $like, $like, $like );
1362+
$like = $n . $wpdb->esc_like( $term ) . $n;
1363+
1364+
if ( ! empty( $this->allow_query_attachment_by_filename ) ) {
1365+
$search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s) $andor_op (sq1.meta_value $like_op %s))", $like, $like, $like, $like );
1366+
} else {
1367+
$search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s))", $like, $like, $like );
1368+
}
13571369
$searchand = ' AND ';
13581370
}
13591371

@@ -1736,6 +1748,16 @@ public function get_posts() {
17361748
// Fill again in case pre_get_posts unset some vars.
17371749
$q = $this->fill_query_vars( $q );
17381750

1751+
/**
1752+
* Filters whether an attachment query should include filenames or not.
1753+
*
1754+
* @since 6.0.3
1755+
*
1756+
* @param bool $allow_query_attachment_by_filename Whether or not to include filenames.
1757+
*/
1758+
$this->allow_query_attachment_by_filename = apply_filters( 'wp_allow_query_attachment_by_filename', false );
1759+
remove_all_filters( 'wp_allow_query_attachment_by_filename' );
1760+
17391761
// Parse meta query
17401762
$this->meta_query = new WP_Meta_Query();
17411763
$this->meta_query->parse_query_vars( $q );
@@ -2166,7 +2188,7 @@ public function get_posts() {
21662188
}
21672189
}
21682190

2169-
if ( ! empty( $this->tax_query->queries ) || ! empty( $this->meta_query->queries ) ) {
2191+
if ( ! empty( $this->tax_query->queries ) || ! empty( $this->meta_query->queries ) || ! empty( $this->allow_query_attachment_by_filename ) ) {
21702192
$groupby = "{$wpdb->posts}.ID";
21712193
}
21722194

@@ -2243,6 +2265,10 @@ public function get_posts() {
22432265
}
22442266
$where .= $search . $whichauthor . $whichmimetype;
22452267

2268+
if ( ! empty( $this->allow_query_attachment_by_filename ) ) {
2269+
$join .= " LEFT JOIN {$wpdb->postmeta} AS sq1 ON ( {$wpdb->posts}.ID = sq1.post_id AND sq1.meta_key = '_wp_attached_file' )";
2270+
}
2271+
22462272
if ( ! empty( $this->meta_query->queries ) ) {
22472273
$clauses = $this->meta_query->get_sql( 'post', $wpdb->posts, 'ID', $this );
22482274
$join .= $clauses['join'];

‎src/wp-includes/comment.php‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2283,6 +2283,15 @@ function wp_update_comment( $commentarr ) {
22832283
return 0;
22842284
}
22852285

2286+
$filter_comment = false;
2287+
if ( ! has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) {
2288+
$filter_comment = ! user_can( isset( $comment['user_id'] ) ? $comment['user_id'] : 0, 'unfiltered_html' );
2289+
}
2290+
2291+
if ( $filter_comment ) {
2292+
add_filter( 'pre_comment_content', 'wp_filter_kses' );
2293+
}
2294+
22862295
// Escape data pulled from DB.
22872296
$comment = wp_slash( $comment );
22882297

@@ -2293,6 +2302,10 @@ function wp_update_comment( $commentarr ) {
22932302

22942303
$commentarr = wp_filter_comment( $commentarr );
22952304

2305+
if ( $filter_comment ) {
2306+
remove_filter( 'pre_comment_content', 'wp_filter_kses' );
2307+
}
2308+
22962309
// Now extract the merged array.
22972310
$data = wp_unslash( $commentarr );
22982311

‎src/wp-includes/customize/class-wp-customize-header-image-control.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,10 +130,10 @@ public function print_header_image_template() {
130130
<# } else { #>
131131

132132
<button type="button" class="choice thumbnail"
133-
data-customize-image-value="{{{data.header.url}}}"
133+
data-customize-image-value="{{data.header.url}}"
134134
data-customize-header-image-data="{{JSON.stringify(data.header)}}">
135135
<span class="screen-reader-text"><?php _e( 'Set image' ); ?></span>
136-
<img src="{{{data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}">
136+
<img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" />
137137
</button>
138138

139139
<# if ( data.type === 'uploaded' ) { #>

‎src/wp-includes/customize/class-wp-customize-site-icon-control.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ public function content_template() {
6666
<div class="favicon">
6767
<img src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>"/>
6868
</div>
69-
<span class="browser-title" aria-hidden="true"><?php bloginfo( 'name' ); ?></span>
69+
<span class="browser-title" aria-hidden="true"><?php echo esc_js( get_bloginfo( 'name' ) ); ?></span>
7070
</div>
7171
<img class="app-icon-preview" src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as an app icon' ); ?>"/>
7272
</div>

‎src/wp-includes/date.php‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,8 +145,8 @@ class WP_Date_Query {
145145
* 'comment_date', 'comment_date_gmt'.
146146
*/
147147
public function __construct( $date_query, $default_column = 'post_date' ) {
148-
if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] ) ) {
149-
$this->relation = 'OR';
148+
if ( isset( $date_query['relation'] ) ) {
149+
$this->relation = $this->sanitize_relation( $date_query['relation'] );
150150
} else {
151151
$this->relation = 'AND';
152152
}
@@ -225,6 +225,9 @@ public function sanitize_query( $queries, $parent_query = null ) {
225225
$this->validate_date_values( $queries );
226226
}
227227

228+
// Sanitize the relation parameter.
229+
$queries['relation'] = $this->sanitize_relation( $queries['relation'] );
230+
228231
foreach ( $queries as $key => $q ) {
229232
if ( ! is_array( $q ) || in_array( $key, $this->time_keys, true ) ) {
230233
// This is a first-order query. Trust the values and sanitize when building SQL.
@@ -1020,4 +1023,20 @@ public function build_time_query( $column, $compare, $hour = null, $minute = nul
10201023

10211024
return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time );
10221025
}
1026+
1027+
/**
1028+
* Sanitizes a 'relation' operator.
1029+
*
1030+
* @since 6.0.3
1031+
*
1032+
* @param string $relation Raw relation key from the query argument.
1033+
* @return string Sanitized relation ('AND' or 'OR').
1034+
*/
1035+
public function sanitize_relation( $relation ) {
1036+
if ( 'OR' === strtoupper( $relation ) ) {
1037+
return 'OR';
1038+
} else {
1039+
return 'AND';
1040+
}
1041+
}
10231042
}

‎src/wp-includes/deprecated.php‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3952,3 +3952,21 @@ function wp_ajax_press_this_add_category() {
39523952
wp_send_json_error( array( 'errorMessage' => __( 'The Press This plugin is required.' ) ) );
39533953
}
39543954
}
3955+
3956+
/**
3957+
* Filter the SQL clauses of an attachment query to include filenames.
3958+
*
3959+
* @since 4.7.0
3960+
* @deprecated 6.0.3
3961+
* @access private
3962+
*
3963+
* @param array $clauses An array including WHERE, GROUP BY, JOIN, ORDER BY,
3964+
* DISTINCT, fields (SELECT), and LIMITS clauses.
3965+
* @return array The unmodified clauses.
3966+
*/
3967+
function _filter_query_attachment_filenames( $clauses ) {
3968+
_deprecated_function( __FUNCTION__, '6.0.3', 'add_filter( "wp_allow_query_attachment_by_filename", "__return_true" )');
3969+
remove_filter( 'posts_clauses', __FUNCTION__ );
3970+
return $clauses;
3971+
}
3972+

‎src/wp-includes/functions.php‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2917,10 +2917,12 @@ function wp_nonce_ays( $action ) {
29172917
} else {
29182918
$html = __( 'The link you followed has expired.' );
29192919
if ( wp_get_referer() ) {
2920-
$html .= '</p><p>';
2921-
$html .= sprintf(
2920+
$wp_http_referer = remove_query_arg( 'updated', wp_get_referer() );
2921+
$wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) );
2922+
$html .= '</p><p>';
2923+
$html .= sprintf(
29222924
'<a href="%s">%s</a>',
2923-
esc_url( remove_query_arg( 'updated', wp_get_referer() ) ),
2925+
esc_url( $wp_http_referer ),
29242926
__( 'Please try again.' )
29252927
);
29262928
}

‎src/wp-includes/media-template.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1312,7 +1312,7 @@ function wp_print_media_templates() {
13121312
<div class="favicon">
13131313
<img id="preview-favicon" src="{{ data.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>"/>
13141314
</div>
1315-
<span class="browser-title" aria-hidden="true"><?php bloginfo( 'name' ); ?></span>
1315+
<span class="browser-title" aria-hidden="true"><?php echo esc_js( get_bloginfo( 'name' ) ); ?></span>
13161316
</div>
13171317

13181318
<strong aria-hidden="true"><?php _e( 'As an app icon' ); ?></strong>

0 commit comments

Comments
 (0)