Skip to content

Commit d75cbbb

Browse files
audrasjbaudrasjb
committed
Grouped backports to the 5.5 branch.
- Editor: Bump @WordPress packages for the branch, - Media: Refactor search by filename within the admin, - REST API: Lockdown post parameter of the terms endpoint, - Customize: Escape blogname option in underscores templates, - Query: Validate relation in `WP_Date_Query`, - Posts, Post types: Apply KSES to post-by-email content, - General: Validate host on "Are you sure?" screen, - Posts, Post types: Remove emails from post-by-email logs, - Pings/trackbacks: Apply KSES to all trackbacks, - Mail: Reset PHPMailer properties between use, - Comments: Apply kses when editing comments, - Widgets: Escape RSS error messages for display. Merges [54521-54530] to the 5.5 branch. Props audrasjb, costdev, cu121, dd32, davidbaumwald, ehtis, johnbillion, johnjamesjacoby, martinkrcho, matveb, oztaser, paulkevan, peterwilsoncc, ravipatel, SergeyBiryukov, talldanwp, timothyblynjacobs, tykoted, voldemortensen, vortfu, xknown. git-svn-id: https://develop.svn.wordpress.org/branches/5.5@54556 602fd350-edb4-49c9-b593-d223f7449a82
1 parent a3ef7aa commit d75cbbb

19 files changed

+285
-64
lines changed

‎src/wp-admin/includes/ajax-actions.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2975,7 +2975,7 @@ function wp_ajax_query_attachments() {
29752975

29762976
// Filter query clauses to include filenames.
29772977
if ( isset( $query['s'] ) ) {
2978-
add_filter( 'posts_clauses', '_filter_query_attachment_filenames' );
2978+
add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' );
29792979
}
29802980

29812981
/**

‎src/wp-admin/includes/post.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1266,7 +1266,7 @@ function wp_edit_attachments_query_vars( $q = false ) {
12661266

12671267
// Filter query clauses to include filenames.
12681268
if ( isset( $q['s'] ) ) {
1269-
add_filter( 'posts_clauses', '_filter_query_attachment_filenames' );
1269+
add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' );
12701270
}
12711271

12721272
return $q;

‎src/wp-includes/class-wp-date-query.php‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,8 @@ public function __construct( $date_query, $default_column = 'post_date' ) {
149149
return;
150150
}
151151

152-
if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] ) ) {
153-
$this->relation = 'OR';
152+
if ( isset( $date_query['relation'] ) ) {
153+
$this->relation = $this->sanitize_relation( $date_query['relation'] );
154154
} else {
155155
$this->relation = 'AND';
156156
}
@@ -219,6 +219,9 @@ public function sanitize_query( $queries, $parent_query = null ) {
219219
$this->validate_date_values( $queries );
220220
}
221221

222+
// Sanitize the relation parameter.
223+
$queries['relation'] = $this->sanitize_relation( $queries['relation'] );
224+
222225
foreach ( $queries as $key => $q ) {
223226
if ( ! is_array( $q ) || in_array( $key, $this->time_keys, true ) ) {
224227
// This is a first-order query. Trust the values and sanitize when building SQL.
@@ -1039,4 +1042,20 @@ public function build_time_query( $column, $compare, $hour = null, $minute = nul
10391042

10401043
return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time );
10411044
}
1045+
1046+
/**
1047+
* Sanitizes a 'relation' operator.
1048+
*
1049+
* @since 6.0.3
1050+
*
1051+
* @param string $relation Raw relation key from the query argument.
1052+
* @return string Sanitized relation ('AND' or 'OR').
1053+
*/
1054+
public function sanitize_relation( $relation ) {
1055+
if ( 'OR' === strtoupper( $relation ) ) {
1056+
return 'OR';
1057+
} else {
1058+
return 'AND';
1059+
}
1060+
}
10421061
}

‎src/wp-includes/class-wp-query.php‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -441,6 +441,13 @@ class WP_Query {
441441
*/
442442
public $thumbnails_cached = false;
443443

444+
/**
445+
* Controls whether an attachment query should include filenames or not.
446+
*
447+
* @since 6.0.3
448+
* @var bool
449+
*/
450+
protected $allow_query_attachment_by_filename = false;
444451
/**
445452
* Cached list of search stopwords.
446453
*
@@ -1391,7 +1398,12 @@ protected function parse_search( &$q ) {
13911398
}
13921399

13931400
$like = $n . $wpdb->esc_like( $term ) . $n;
1394-
$search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s))", $like, $like, $like );
1401+
1402+
if ( ! empty( $this->allow_query_attachment_by_filename ) ) {
1403+
$search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s) $andor_op (sq1.meta_value $like_op %s))", $like, $like, $like, $like );
1404+
} else {
1405+
$search .= $wpdb->prepare( "{$searchand}(({$wpdb->posts}.post_title $like_op %s) $andor_op ({$wpdb->posts}.post_excerpt $like_op %s) $andor_op ({$wpdb->posts}.post_content $like_op %s))", $like, $like, $like );
1406+
}
13951407
$searchand = ' AND ';
13961408
}
13971409

@@ -1784,6 +1796,16 @@ public function get_posts() {
17841796
// Fill again in case 'pre_get_posts' unset some vars.
17851797
$q = $this->fill_query_vars( $q );
17861798

1799+
/**
1800+
* Filters whether an attachment query should include filenames or not.
1801+
*
1802+
* @since 6.0.3
1803+
*
1804+
* @param bool $allow_query_attachment_by_filename Whether or not to include filenames.
1805+
*/
1806+
$this->allow_query_attachment_by_filename = apply_filters( 'wp_allow_query_attachment_by_filename', false );
1807+
remove_all_filters( 'wp_allow_query_attachment_by_filename' );
1808+
17871809
// Parse meta query.
17881810
$this->meta_query = new WP_Meta_Query();
17891811
$this->meta_query->parse_query_vars( $q );
@@ -2215,7 +2237,7 @@ public function get_posts() {
22152237
}
22162238
}
22172239

2218-
if ( ! empty( $this->tax_query->queries ) || ! empty( $this->meta_query->queries ) ) {
2240+
if ( ! empty( $this->tax_query->queries ) || ! empty( $this->meta_query->queries ) || ! empty( $this->allow_query_attachment_by_filename ) ) {
22192241
$groupby = "{$wpdb->posts}.ID";
22202242
}
22212243

@@ -2292,6 +2314,10 @@ public function get_posts() {
22922314
}
22932315
$where .= $search . $whichauthor . $whichmimetype;
22942316

2317+
if ( ! empty( $this->allow_query_attachment_by_filename ) ) {
2318+
$join .= " LEFT JOIN {$wpdb->postmeta} AS sq1 ON ( {$wpdb->posts}.ID = sq1.post_id AND sq1.meta_key = '_wp_attached_file' )";
2319+
}
2320+
22952321
if ( ! empty( $this->meta_query->queries ) ) {
22962322
$clauses = $this->meta_query->get_sql( 'post', $wpdb->posts, 'ID', $this );
22972323
$join .= $clauses['join'];

‎src/wp-includes/comment.php‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2456,6 +2456,15 @@ function wp_update_comment( $commentarr, $wp_error = false ) {
24562456
}
24572457
}
24582458

2459+
$filter_comment = false;
2460+
if ( ! has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) {
2461+
$filter_comment = ! user_can( isset( $comment['user_id'] ) ? $comment['user_id'] : 0, 'unfiltered_html' );
2462+
}
2463+
2464+
if ( $filter_comment ) {
2465+
add_filter( 'pre_comment_content', 'wp_filter_kses' );
2466+
}
2467+
24592468
// Escape data pulled from DB.
24602469
$comment = wp_slash( $comment );
24612470

@@ -2466,6 +2475,10 @@ function wp_update_comment( $commentarr, $wp_error = false ) {
24662475

24672476
$commentarr = wp_filter_comment( $commentarr );
24682477

2478+
if ( $filter_comment ) {
2479+
remove_filter( 'pre_comment_content', 'wp_filter_kses' );
2480+
}
2481+
24692482
// Now extract the merged array.
24702483
$data = wp_unslash( $commentarr );
24712484

‎src/wp-includes/customize/class-wp-customize-header-image-control.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,10 +130,10 @@ public function print_header_image_template() {
130130
<# } else { #>
131131

132132
<button type="button" class="choice thumbnail"
133-
data-customize-image-value="{{{data.header.url}}}"
133+
data-customize-image-value="{{data.header.url}}"
134134
data-customize-header-image-data="{{JSON.stringify(data.header)}}">
135135
<span class="screen-reader-text"><?php _e( 'Set image' ); ?></span>
136-
<img src="{{{data.header.thumbnail_url}}}" alt="{{{data.header.alt_text || data.header.description}}}">
136+
<img src="{{data.header.thumbnail_url}}" alt="{{data.header.alt_text || data.header.description}}" />
137137
</button>
138138

139139
<# if ( data.type === 'uploaded' ) { #>

‎src/wp-includes/customize/class-wp-customize-site-icon-control.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ public function content_template() {
6868
<div class="favicon">
6969
<img src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>"/>
7070
</div>
71-
<span class="browser-title" aria-hidden="true"><# print( '<?php bloginfo( 'name' ); ?>' ) #></span>
71+
<span class="browser-title" aria-hidden="true"><# print( '<?php echo esc_js( get_bloginfo( 'name' ) ); ?>' ) #></span>
7272
</div>
7373
<img class="app-icon-preview" src="{{ data.attachment.sizes.full ? data.attachment.sizes.full.url : data.attachment.url }}" alt="<?php esc_attr_e( 'Preview as an app icon' ); ?>"/>
7474
</div>

‎src/wp-includes/deprecated.php‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4100,3 +4100,21 @@ function remove_option_whitelist( $del_options, $options = '' ) {
41004100

41014101
return remove_allowed_options( $del_options, $options );
41024102
}
4103+
4104+
/**
4105+
* Filter the SQL clauses of an attachment query to include filenames.
4106+
*
4107+
* @since 4.7.0
4108+
* @deprecated 6.0.3
4109+
* @access private
4110+
*
4111+
* @param array $clauses An array including WHERE, GROUP BY, JOIN, ORDER BY,
4112+
* DISTINCT, fields (SELECT), and LIMITS clauses.
4113+
* @return array The unmodified clauses.
4114+
*/
4115+
function _filter_query_attachment_filenames( $clauses ) {
4116+
_deprecated_function( __FUNCTION__, '6.0.3', 'add_filter( "wp_allow_query_attachment_by_filename", "__return_true" )');
4117+
remove_filter( 'posts_clauses', __FUNCTION__ );
4118+
return $clauses;
4119+
}
4120+

‎src/wp-includes/functions.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3261,10 +3261,12 @@ function wp_nonce_ays( $action ) {
32613261
} else {
32623262
$html = __( 'The link you followed has expired.' );
32633263
if ( wp_get_referer() ) {
3264+
$wp_http_referer = remove_query_arg( 'updated', wp_get_referer() );
3265+
$wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) );
32643266
$html .= '</p><p>';
32653267
$html .= sprintf(
32663268
'<a href="%s">%s</a>',
3267-
esc_url( remove_query_arg( 'updated', wp_get_referer() ) ),
3269+
esc_url( $wp_http_referer ),
32683270
__( 'Please try again.' )
32693271
);
32703272
}

‎src/wp-includes/media-template.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1448,7 +1448,7 @@ function wp_print_media_templates() {
14481448
<div class="favicon">
14491449
<img id="preview-favicon" src="{{ data.url }}" alt="<?php esc_attr_e( 'Preview as a browser icon' ); ?>"/>
14501450
</div>
1451-
<span class="browser-title" aria-hidden="true"><# print( '<?php bloginfo( 'name' ); ?>' ) #></span>
1451+
<span class="browser-title" aria-hidden="true"><# print( '<?php echo esc_js( get_bloginfo( 'name' ) ); ?>' ) #></span>
14521452
</div>
14531453

14541454
<strong aria-hidden="true"><?php _e( 'As an app icon' ); ?></strong>

0 commit comments

Comments
 (0)