Skip to content

Commit 5bce1e6

Browse files
SergeyBiryukovSergeyBiryukov
committed
Grouped backports to the 4.7 branch.
- Posts, Post types: Apply KSES to post-by-email content, - General: Validate host on "Are you sure?" screen, - Posts, Post types: Remove emails from post-by-email logs, - Media: Refactor search by filename within the admin, - Pings/trackbacks: Apply KSES to all trackbacks, - Comments: Apply kses when editing comments, - Customize: Escape blogname option in underscores templates, - REST API: Lockdown post parameter of the terms endpoint, - Mail: Reset PHPMailer properties between use, - Query: Validate relation in `WP_Date_Query`, - Widgets: Escape RSS error messages for display. Merges [54521], [54522], [54523], [54524], [54525], [54526], [54527], [54528], [54529], [54530], [54541] to the 4.7 branch. Props voldemortensen, johnbillion, paulkevan, peterwilsoncc, xknown, dd32, audrasjb, martinkrcho, vortfu, davidbaumwald, tykoted, timothyblynjacobs, johnjamesjacoby, ehtis, matveb, talldanwp. git-svn-id: https://develop.svn.wordpress.org/branches/4.7@54566 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 83b0cc9 commit 5bce1e6

19 files changed

+299
-68
lines changed

‎src/wp-admin/includes/ajax-actions.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2409,7 +2409,7 @@ function wp_ajax_query_attachments() {
24092409

24102410
// Filter query clauses to include filenames.
24112411
if ( isset( $query['s'] ) ) {
2412-
add_filter( 'posts_clauses', '_filter_query_attachment_filenames' );
2412+
add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' );
24132413
}
24142414

24152415
/**

‎src/wp-admin/includes/post.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1169,7 +1169,7 @@ function wp_edit_attachments_query_vars( $q = false ) {
11691169

11701170
// Filter query clauses to include filenames.
11711171
if ( isset( $q['s'] ) ) {
1172-
add_filter( 'posts_clauses', '_filter_query_attachment_filenames' );
1172+
add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' );
11731173
}
11741174

11751175
return $q;

‎src/wp-includes/class-wp-query.php‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -486,6 +486,13 @@ class WP_Query {
486486

487487
private $compat_methods = array( 'init_query_flags', 'parse_tax_query' );
488488

489+
/**
490+
* Controls whether an attachment query should include filenames or not.
491+
*
492+
* @since 6.0.3
493+
* @var bool
494+
*/
495+
protected $allow_query_attachment_by_filename = false;
489496
/**
490497
* Resets query flags to false.
491498
*
@@ -1344,7 +1351,12 @@ protected function parse_search( &$q ) {
13441351
}
13451352

13461353
$like = $n . $wpdb->esc_like( $term ) . $n;
1347-
$search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s))", $like, $like, $like );
1354+
1355+
if ( ! empty( $this->allow_query_attachment_by_filename ) ) {
1356+
$search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s) $andor_op (sq1.meta_value $like_op %s))", $like, $like, $like, $like );
1357+
} else {
1358+
$search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s))", $like, $like, $like );
1359+
}
13481360
$searchand = ' AND ';
13491361
}
13501362

@@ -1681,6 +1693,16 @@ public function get_posts() {
16811693
// Fill again in case pre_get_posts unset some vars.
16821694
$q = $this->fill_query_vars($q);
16831695

1696+
/**
1697+
* Filters whether an attachment query should include filenames or not.
1698+
*
1699+
* @since 6.0.3
1700+
*
1701+
* @param bool $allow_query_attachment_by_filename Whether or not to include filenames.
1702+
*/
1703+
$this->allow_query_attachment_by_filename = apply_filters( 'wp_allow_query_attachment_by_filename', false );
1704+
remove_all_filters( 'wp_allow_query_attachment_by_filename' );
1705+
16841706
// Parse meta query
16851707
$this->meta_query = new WP_Meta_Query();
16861708
$this->meta_query->parse_query_vars( $q );
@@ -2077,7 +2099,7 @@ public function get_posts() {
20772099
}
20782100
}
20792101

2080-
if ( !empty( $this->tax_query->queries ) || !empty( $this->meta_query->queries ) ) {
2102+
if ( ! empty( $this->tax_query->queries ) || ! empty( $this->meta_query->queries ) || ! empty( $this->allow_query_attachment_by_filename ) ) {
20812103
$groupby = "{$wpdb->posts}.ID";
20822104
}
20832105

@@ -2126,6 +2148,10 @@ public function get_posts() {
21262148
}
21272149
$where .= $search . $whichauthor . $whichmimetype;
21282150

2151+
if ( ! empty( $this->allow_query_attachment_by_filename ) ) {
2152+
$join .= " LEFT JOIN {$wpdb->postmeta} AS sq1 ON ( {$wpdb->posts}.ID = sq1.post_id AND sq1.meta_key = '_wp_attached_file' )";
2153+
}
2154+
21292155
if ( ! empty( $this->meta_query->queries ) ) {
21302156
$clauses = $this->meta_query->get_sql( 'post', $wpdb->posts, 'ID', $this );
21312157
$join .= $clauses['join'];

‎src/wp-includes/comment.php‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2146,6 +2146,15 @@ function wp_update_comment($commentarr) {
21462146
return 0;
21472147
}
21482148

2149+
$filter_comment = false;
2150+
if ( ! has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) {
2151+
$filter_comment = ! user_can( isset( $comment['user_id'] ) ? $comment['user_id'] : 0, 'unfiltered_html' );
2152+
}
2153+
2154+
if ( $filter_comment ) {
2155+
add_filter( 'pre_comment_content', 'wp_filter_kses' );
2156+
}
2157+
21492158
// Escape data pulled from DB.
21502159
$comment = wp_slash($comment);
21512160

@@ -2156,6 +2165,10 @@ function wp_update_comment($commentarr) {
21562165

21572166
$commentarr = wp_filter_comment( $commentarr );
21582167

2168+
if ( $filter_comment ) {
2169+
remove_filter( 'pre_comment_content', 'wp_filter_kses' );
2170+
}
2171+
21592172
// Now extract the merged array.
21602173
$data = wp_unslash( $commentarr );
21612174

‎src/wp-includes/customize/class-wp-customize-header-image-control.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -103,10 +103,10 @@ public function print_header_image_template() {
103103
<# } else { #>
104104

105105
<button type="button" class="choice thumbnail"
106-
data-customize-image-value="{{{data.header.url}}}"
106+
data-customize-image-value="{{data.header.url}}"
107107
data-customize-header-image-data="{{JSON.stringify(data.header)}}">
108108
<span class="screen-reader-text"><?php _e( 'Set image' ); ?></span>
109-
<img src="{{{data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}">
109+
<img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" />
110110
</button>
111111

112112
<# if ( data.type === 'uploaded' ) { #>

‎src/wp-includes/customize/class-wp-customize-site-icon-control.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ public function content_template() {
6969
<div class="favicon">
7070
<img src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>"/>
7171
</div>
72-
<span class="browser-title" aria-hidden="true"><?php bloginfo( 'name' ); ?></span>
72+
<span class="browser-title" aria-hidden="true"><?php echo esc_js( get_bloginfo( 'name' ) ); ?></span>
7373
</div>
7474
<img class="app-icon-preview" src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as an app icon' ); ?>"/>
7575
</div>

‎src/wp-includes/date.php‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -151,8 +151,8 @@ class WP_Date_Query {
151151
* 'comment_date', 'comment_date_gmt'.
152152
*/
153153
public function __construct( $date_query, $default_column = 'post_date' ) {
154-
if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] ) ) {
155-
$this->relation = 'OR';
154+
if ( isset( $date_query['relation'] ) ) {
155+
$this->relation = $this->sanitize_relation( $date_query['relation'] );
156156
} else {
157157
$this->relation = 'AND';
158158
}
@@ -232,6 +232,9 @@ public function sanitize_query( $queries, $parent_query = null ) {
232232
$this->validate_date_values( $queries );
233233
}
234234

235+
// Sanitize the relation parameter.
236+
$queries['relation'] = $this->sanitize_relation( $queries['relation'] );
237+
235238
foreach ( $queries as $key => $q ) {
236239
if ( ! is_array( $q ) || in_array( $key, $this->time_keys, true ) ) {
237240
// This is a first-order query. Trust the values and sanitize when building SQL.
@@ -1014,4 +1017,20 @@ public function build_time_query( $column, $compare, $hour = null, $minute = nul
10141017

10151018
return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time );
10161019
}
1020+
1021+
/**
1022+
* Sanitizes a 'relation' operator.
1023+
*
1024+
* @since 6.0.3
1025+
*
1026+
* @param string $relation Raw relation key from the query argument.
1027+
* @return string Sanitized relation ('AND' or 'OR').
1028+
*/
1029+
public function sanitize_relation( $relation ) {
1030+
if ( 'OR' === strtoupper( $relation ) ) {
1031+
return 'OR';
1032+
} else {
1033+
return 'AND';
1034+
}
1035+
}
10171036
}

‎src/wp-includes/deprecated.php‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3878,3 +3878,21 @@ function _sort_nav_menu_items( $a, $b ) {
38783878
else
38793879
return strcmp( $a->$_menu_item_sort_prop, $b->$_menu_item_sort_prop );
38803880
}
3881+
3882+
/**
3883+
* Filter the SQL clauses of an attachment query to include filenames.
3884+
*
3885+
* @since 4.7.0
3886+
* @deprecated 6.0.3
3887+
* @access private
3888+
*
3889+
* @param array $clauses An array including WHERE, GROUP BY, JOIN, ORDER BY,
3890+
* DISTINCT, fields (SELECT), and LIMITS clauses.
3891+
* @return array The unmodified clauses.
3892+
*/
3893+
function _filter_query_attachment_filenames( $clauses ) {
3894+
_deprecated_function( __FUNCTION__, '6.0.3', 'add_filter( "wp_allow_query_attachment_by_filename", "__return_true" )');
3895+
remove_filter( 'posts_clauses', __FUNCTION__ );
3896+
return $clauses;
3897+
}
3898+

‎src/wp-includes/functions.php‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2368,7 +2368,7 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {
23682368
} else {
23692369
if ( $type !== $real_mime ) {
23702370
/*
2371-
* Everything else including image/* and application/*:
2371+
* Everything else including image/* and application/*:
23722372
* If the real content type doesn't match the file extension, assume it's dangerous.
23732373
*/
23742374
$type = $ext = false;
@@ -2377,7 +2377,7 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {
23772377
}
23782378
}
23792379

2380-
// The mime type must be allowed
2380+
// The mime type must be allowed
23812381
if ( $type ) {
23822382
$allowed = get_allowed_mime_types();
23832383

@@ -2649,9 +2649,12 @@ function wp_nonce_ays( $action ) {
26492649
} else {
26502650
$html = __( 'Are you sure you want to do this?' );
26512651
if ( wp_get_referer() ) {
2652-
$html .= '</p><p>';
2653-
$html .= sprintf( '<a href="%s">%s</a>',
2654-
esc_url( remove_query_arg( 'updated', wp_get_referer() ) ),
2652+
$wp_http_referer = remove_query_arg( 'updated', wp_get_referer() );
2653+
$wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) );
2654+
$html .= '</p><p>';
2655+
$html .= sprintf(
2656+
'<a href="%s">%s</a>',
2657+
esc_url( $wp_http_referer ),
26552658
__( 'Please try again.' )
26562659
);
26572660
}

‎src/wp-includes/media-template.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1249,7 +1249,7 @@ function wp_print_media_templates() {
12491249
<div class="favicon">
12501250
<img id="preview-favicon" src="{{ data.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>"/>
12511251
</div>
1252-
<span class="browser-title" aria-hidden="true"><?php bloginfo( 'name' ); ?></span>
1252+
<span class="browser-title" aria-hidden="true"><?php echo esc_js( get_bloginfo( 'name' ) ); ?></span>
12531253
</div>
12541254

12551255
<strong aria-hidden="true"><?php _e( 'As an app icon' ); ?></strong>

0 commit comments

Comments
 (0)