From 5ffc4825833a026cd021ffa70dcdcdef100d5ad5 Mon Sep 17 00:00:00 2001 From: patrickebates Date: Thu, 17 Oct 2019 22:21:57 -0500 Subject: [PATCH] Initial merge with WP 5.2.4 --- README.md | 2 +- wp-admin/about.php | 26 +++++++++++++++++++++++--- wp-includes/class-wp-query.php | 3 +-- wp-includes/class-wp.php | 2 +- wp-includes/functions.php | 5 +++++ wp-includes/http.php | 2 +- wp-includes/pluggable.php | 5 +++-- wp-includes/pn-version.php | 2 +- wp-includes/rest-api.php | 2 ++ wp-includes/script-loader.php | 2 -- wp-includes/version.php | 2 +- 11 files changed, 39 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index 6ad1ba2cf..c33e86f2e 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ Project Nami =============== -### Version: `2.2.3` ### +### Version: `2.2.4` ### ### Description: ### [![Deploy to Azure](http://azuredeploy.net/deploybutton.png)](https://deploy.azure.com/?repository=https://github.com/ProjectNami/projectnami/tree/latest) diff --git a/wp-admin/about.php b/wp-admin/about.php index fb56d79fa..a09e58b5b 100644 --- a/wp-admin/about.php +++ b/wp-admin/about.php @@ -53,7 +53,27 @@

Version %s addressed some security issues.' ), + '5.2.4' + ); + ?> + the release notes.' ), + sprintf( + /* translators: %s: WordPress version */ + esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ), + sanitize_title( '5.2.4' ) + ) + ); + ?> +

+

+ Version %1$s addressed some security issues and fixed %2$s bug.', 'Version %1$s addressed some security issues and fixed %2$s bugs.', @@ -65,10 +85,10 @@ ?> the release notes.' ), sprintf( - /* translators: %s: WordPress version */ + /* translators: %s: WordPress version */ esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ), sanitize_title( '5.2.3' ) ) diff --git a/wp-includes/class-wp-query.php b/wp-includes/class-wp-query.php index 6e66cef73..cf431ef5a 100644 --- a/wp-includes/class-wp-query.php +++ b/wp-includes/class-wp-query.php @@ -538,7 +538,6 @@ public function fill_query_vars( $array ) { 'attachment', 'attachment_id', 'name', - 'static', 'pagename', 'page_id', 'second', @@ -802,7 +801,7 @@ public function parse_query( $query = '' ) { // If year, month, day, hour, minute, and second are set, a single // post is being queried. $this->is_single = true; - } elseif ( '' != $qv['static'] || '' != $qv['pagename'] || ! empty( $qv['page_id'] ) ) { + } elseif ( '' != $qv['pagename'] || ! empty( $qv['page_id'] ) ) { $this->is_page = true; $this->is_single = false; } else { diff --git a/wp-includes/class-wp.php b/wp-includes/class-wp.php index c1389be79..5824463a1 100644 --- a/wp-includes/class-wp.php +++ b/wp-includes/class-wp.php @@ -14,7 +14,7 @@ class WP { * @since 2.0.0 * @var string[] */ - public $public_query_vars = array('m', 'p', 'posts', 'w', 'cat', 'withcomments', 'withoutcomments', 's', 'search', 'exact', 'sentence', 'calendar', 'page', 'paged', 'more', 'tb', 'pb', 'author', 'order', 'orderby', 'year', 'monthnum', 'day', 'hour', 'minute', 'second', 'name', 'category_name', 'tag', 'feed', 'author_name', 'static', 'pagename', 'page_id', 'error', 'comments_popup', 'attachment', 'attachment_id', 'subpost', 'subpost_id', 'preview', 'robots', 'taxonomy', 'term', 'cpage', 'post_type', 'embed' ); + public $public_query_vars = array( 'm', 'p', 'posts', 'w', 'cat', 'withcomments', 'withoutcomments', 's', 'search', 'exact', 'sentence', 'calendar', 'page', 'paged', 'more', 'tb', 'pb', 'author', 'order', 'orderby', 'year', 'monthnum', 'day', 'hour', 'minute', 'second', 'name', 'category_name', 'tag', 'feed', 'author_name', 'pagename', 'page_id', 'error', 'attachment', 'attachment_id', 'subpost', 'subpost_id', 'preview', 'robots', 'taxonomy', 'term', 'cpage', 'post_type', 'embed' ); /** * Private query variables. diff --git a/wp-includes/functions.php b/wp-includes/functions.php index 89d39373a..7cfbcebd9 100644 --- a/wp-includes/functions.php +++ b/wp-includes/functions.php @@ -1799,6 +1799,11 @@ function wp_mkdir_p( $target ) { return @is_dir( $target ); } + // Do not allow path traversals. + if ( false !== strpos( $target, '../' ) || false !== strpos( $target, '..' . DIRECTORY_SEPARATOR ) ) { + return false; + } + // We need to find the permissions of the parent folder that exists and inherit that. $target_parent = dirname( $target ); while ( '.' != $target_parent && ! is_dir( $target_parent ) && dirname( $target_parent ) !== $target_parent ) { diff --git a/wp-includes/http.php b/wp-includes/http.php index f9d521a31..7cb187344 100644 --- a/wp-includes/http.php +++ b/wp-includes/http.php @@ -555,7 +555,7 @@ function wp_http_validate_url( $url ) { } else { $ip = gethostbyname( $host ); if ( $ip === $host ) { // Error condition for gethostbyname() - $ip = false; + return false; } } if ( $ip ) { diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php index 2f302539e..8ae489455 100644 --- a/wp-includes/pluggable.php +++ b/wp-includes/pluggable.php @@ -1092,7 +1092,7 @@ function auth_redirect() { * 0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago. */ function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) { - if ( -1 == $action ) { + if ( -1 === $action ) { _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2.0' ); } @@ -1111,7 +1111,7 @@ function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) { */ do_action( 'check_admin_referer', $action, $result ); - if ( ! $result && ! ( -1 == $action && strpos( $referer, $adminurl ) === 0 ) ) { + if ( ! $result && ! ( -1 === $action && strpos( $referer, $adminurl ) === 0 ) ) { wp_nonce_ays( $action ); die(); } @@ -1400,6 +1400,7 @@ function wp_validate_redirect( $location, $default = '' ) { $path = ''; if ( ! empty( $_SERVER['REQUEST_URI'] ) ) { $path = dirname( parse_url( 'http://placeholder' . $_SERVER['REQUEST_URI'], PHP_URL_PATH ) . '?' ); + $path = wp_normalize_path( $path ); } $location = '/' . ltrim( $path . '/', '/' ) . $location; } diff --git a/wp-includes/pn-version.php b/wp-includes/pn-version.php index f80911b95..010946644 100644 --- a/wp-includes/pn-version.php +++ b/wp-includes/pn-version.php @@ -1,3 +1,3 @@ add( 'wp-sanitize', "/wp-includes/js/wp-sanitize$suffix.js", array( 'jquery' ), false, 1 ); - $scripts->add( 'wp-backbone', "/wp-includes/js/wp-backbone$suffix.js", array( 'backbone', 'wp-util' ), false, 1 ); $scripts->add( 'revisions', "/wp-admin/js/revisions$suffix.js", array( 'wp-backbone', 'jquery-ui-slider', 'hoverIntent' ), false, 1 ); diff --git a/wp-includes/version.php b/wp-includes/version.php index 30e839f3a..c9d31fa88 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -13,7 +13,7 @@ * * @global string $wp_version */ -$wp_version = '5.2.3'; +$wp_version = '5.2.4'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.