Merge remote-tracking branch 'origin/master' into latest

README.md

@@ -1,7 +1,7 @@
 Project Nami
 ===============
 
-###Version: `0.9.11`###
+###Version: `0.9.12`###
 
 ###Description:###
 

wp-admin/about.php

@@ -39,7 +39,11 @@
 </h2>
 
 <div class="changelog point-releases">
-	<h3><?php echo _n( 'Maintenance Release', 'Maintenance Releases', 1 ); ?></h3>
+	<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 2 ); ?></h3>
+	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
+         '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 9 ), '3.8.2', number_format_i18n( 9 ) ); ?>
+		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.8.2' ); ?>
+ 	</p>
 	<p><?php printf( _n( '<strong>Version %1$s</strong> addressed %2$s bug.',
 		'<strong>Version %1$s</strong> addressed %2$s bugs.', 31 ), '3.8.1', number_format_i18n( 31 ) ); ?>
 		<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.8.1' ); ?>

wp-admin/includes/class-wp-posts-list-table.php

@@ -839,7 +839,7 @@ function inline_edit() {
 	<?php if ( !$bulk ) echo $authors_dropdown;
 	endif; // post_type_supports author
 
-	if ( !$bulk ) :
+	if ( !$bulk && $can_publish ) :
 	?>
 
 			<div class="inline-edit-group">

wp-admin/includes/class-wp-upgrader.php

@@ -1871,18 +1871,21 @@ public function update( $type, $item ) {
 		if ( ! $this->should_update( $type, $item, $context ) )
 			return false;
 
+		$upgrader_item = $item;
 		switch ( $type ) {
 			case 'core':
 				$skin->feedback( __( 'Updating to WordPress %s' ), $item->version );
 				$item_name = sprintf( __( 'WordPress %s' ), $item->version );
 				break;
 			case 'theme':
-				$theme = wp_get_theme( $item );
+				$upgrader_item = $item->theme;
+				$theme = wp_get_theme( $upgrader_item );
 				$item_name = $theme->Get( 'Name' );
 				$skin->feedback( __( 'Updating theme: %s' ), $item_name );
 				break;
 			case 'plugin':
-				$plugin_data = get_plugin_data( $context . '/' . $item );
+				$upgrader_item = $item->plugin;
+				$plugin_data = get_plugin_data( $context . '/' . $upgrader_item );
 				$item_name = $plugin_data['Name'];
 				$skin->feedback( __( 'Updating plugin: %s' ), $item_name );
 				break;
@@ -1894,7 +1897,7 @@ public function update( $type, $item ) {
 		}
 
 		// Boom, This sites about to get a whole new splash of paint!
-		$upgrade_result = $upgrader->upgrade( $item, array(
+		$upgrade_result = $upgrader->upgrade( $upgrader_item, array(
 			'clear_update_cache' => false,
 			'pre_check_md5'      => false, /* always use partial builds if possible for core updates */
 			'attempt_rollback'   => true, /* only available for core updates */
@@ -1968,7 +1971,7 @@ public function run() {
 		wp_update_plugins(); // Check for Plugin updates
 		$plugin_updates = get_site_transient( 'update_plugins' );
 		if ( $plugin_updates && !empty( $plugin_updates->response ) ) {
-			foreach ( array_keys( $plugin_updates->response ) as $plugin ) {
+			foreach ( $plugin_updates->response as $plugin ) {
 				$this->update( 'plugin', $plugin );
 			}
 			// Force refresh of plugin update information
@@ -1979,8 +1982,8 @@ public function run() {
 		wp_update_themes();  // Check for Theme updates
 		$theme_updates = get_site_transient( 'update_themes' );
 		if ( $theme_updates && !empty( $theme_updates->response ) ) {
-			foreach ( array_keys( $theme_updates->response ) as $theme ) {
-				$this->update( 'theme', $theme );
+			foreach ( $theme_updates->response as $theme ) {
+				$this->update( 'theme', (object) $theme );
 			}
 			// Force refresh of theme update information
 			wp_clean_themes_cache();
@@ -1995,8 +1998,21 @@ public function run() {
 
 		// Clean up, and check for any pending translations
 		// (Core_Upgrader checks for core updates)
-		wp_update_themes();  // Check for Theme updates
-		wp_update_plugins(); // Check for Plugin updates
+		$theme_stats = array();
+		if ( isset( $this->update_results['theme'] ) ) {
+			foreach ( $this->update_results['theme'] as $upgrade ) {
+				$theme_stats[ $upgrade->item->theme ] = ( true === $upgrade->result );
+			}
+		}
+		wp_update_themes( $theme_stats );  // Check for Theme updates
+
+		$plugin_stats = array();
+		if ( isset( $this->update_results['plugin'] ) ) {
+			foreach ( $this->update_results['plugin'] as $upgrade ) {
+				$plugin_stats[ $upgrade->item->plugin ] = ( true === $upgrade->result );
+			}
+		}
+		wp_update_plugins( $plugin_stats ); // Check for Plugin updates
 
 		// Finally, Process any new translations
 		$language_updates = wp_get_translation_updates();

wp-admin/includes/ms.php

@@ -101,7 +101,7 @@ function wpmu_delete_blog( $blog_id, $drop = false ) {
 		$drop_tables = apply_filters( 'wpmu_drop_tables', $tables, $blog_id );
 
 		foreach ( (array) $drop_tables as $table ) {
-			$wpdb->query( $wpdb->prepare( "IF EXISTS (SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = '%s') DROP TABLE [%s]", $table, $table ) );
+			$wpdb->query( "IF EXISTS (SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = '" . $table . "') DROP TABLE [" . $table . "]" );
 		}
 
 		$wpdb->delete( $wpdb->blogs, array( 'blog_id' => $blog_id ) );

wp-admin/includes/post.php

@@ -100,6 +100,10 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
 		$post_id = false;
 	$previous_status = $post_id ? get_post_field( 'post_status', $post_id ) : false;
 
+	if ( isset( $post_data['post_status'] ) && 'private' == $post_data['post_status'] && ! current_user_can( $ptype->cap->publish_posts ) ) {
+		$post_data['post_status'] = $previous_status ? $previous_status : 'pending';
+	}
+
 	$published_statuses = array( 'publish', 'future' );
 
 	// Posts 'submitted for approval' present are submitted to $_POST the same as if they were being published.
@@ -111,6 +115,10 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
 	if ( ! isset($post_data['post_status']) )
 		$post_data['post_status'] = $previous_status;
 
+	if ( isset( $post_data['post_password'] ) && ! current_user_can( $ptype->cap->publish_posts ) ) {
+		unset( $post_data['post_password'] );
+	}
+
 	if (!isset( $post_data['comment_status'] ))
 		$post_data['comment_status'] = 'closed';
 
@@ -170,6 +178,14 @@ function edit_post( $post_data = null ) {
 	$post_data['post_type'] = $post->post_type;
 	$post_data['post_mime_type'] = $post->post_mime_type;
 
+	if ( ! empty( $post_data['post_status'] ) ) {
+		$post_data['post_status'] = sanitize_key( $post_data['post_status'] );
+
+		if ( 'inherit' == $post_data['post_status'] ) {
+			unset( $post_data['post_status'] );
+		}
+	}
+
 	$ptype = get_post_type_object($post_data['post_type']);
 	if ( !current_user_can( 'edit_post', $post_ID ) ) {
 		if ( 'page' == $post_data['post_type'] )
@@ -187,9 +203,6 @@ function edit_post( $post_data = null ) {
 			_wp_upgrade_revisions_of_post( $post, wp_get_post_revisions( $post_ID ) );
 	}
 
-	$post_data = _wp_translate_postdata( true, $post_data );
-	if ( is_wp_error($post_data) )
-		wp_die( $post_data->get_error_message() );
 	if ( ( empty( $post_data['action'] ) || 'autosave' != $post_data['action'] ) && 'auto-draft' == $post_data['post_status'] ) {
 		$post_data['post_status'] = 'draft';
 	}
@@ -210,6 +223,10 @@ function edit_post( $post_data = null ) {
 		}
 	}
 
+	$post_data = _wp_translate_postdata( true, $post_data );
+	if ( is_wp_error($post_data) )
+		wp_die( $post_data->get_error_message() );
+
 	// Post Formats
 	if ( isset( $post_data['post_format'] ) )
 		set_post_format( $post_ID, $post_data['post_format'] );
@@ -332,6 +349,14 @@ function bulk_edit_posts( $post_data = null ) {
 	}
 	unset($post_data['_status']);
 
+	if ( ! empty( $post_data['post_status'] ) ) {
+		$post_data['post_status'] = sanitize_key( $post_data['post_status'] );
+
+		if ( 'inherit' == $post_data['post_status'] ) {
+			unset( $post_data['post_status'] );
+		}
+	}
+
 	$post_IDs = array_map( 'intval', (array) $post_data['post'] );
 
 	$reset = array(
@@ -422,11 +447,26 @@ function bulk_edit_posts( $post_data = null ) {
 			unset( $post_data['tax_input']['category'] );
 		}
 
+		$post_data['post_type'] = $post->post_type;
 		$post_data['post_mime_type'] = $post->post_mime_type;
 		$post_data['guid'] = $post->guid;
 
+		foreach ( array( 'comment_status', 'ping_status', 'post_author' ) as $field ) {
+			if ( ! isset( $post_data[ $field ] ) ) {
+				$post_data[ $field ] = $post->$field;
+			}
+		}
+
 		$post_data['ID'] = $post_ID;
-		$updated[] = wp_update_post( $post_data );
+		$post_data['post_ID'] = $post_ID;
+
+		$translated_post_data = _wp_translate_postdata( true, $post_data );
+		if ( is_wp_error( $translated_post_data ) ) {
+			$skipped[] = $post_ID;
+			continue;
+		}
+
+		$updated[] = wp_update_post( $translated_post_data );
 
 		if ( isset( $post_data['sticky'] ) && current_user_can( $ptype->cap->edit_others_posts ) ) {
 			if ( 'sticky' == $post_data['sticky'] )
@@ -569,10 +609,6 @@ function wp_write_post() {
 	if ( isset( $_POST['post_ID'] ) )
 		return edit_post();
 
-	$translated = _wp_translate_postdata( false );
-	if ( is_wp_error($translated) )
-		return $translated;
-
 	if ( isset($_POST['visibility']) ) {
 		switch ( $_POST['visibility'] ) {
 			case 'public' :
@@ -589,6 +625,10 @@ function wp_write_post() {
 		}
 	}
 
+	$translated = _wp_translate_postdata( false );
+	if ( is_wp_error($translated) )
+		return $translated;
+
 	// Create the post.
 	$post_ID = wp_insert_post( $_POST );
 	if ( is_wp_error( $post_ID ) )

wp-admin/includes/schema.php

@@ -1024,8 +1024,10 @@ function populate_network( $network_id = 1, $domain = '', $email = '', $site_nam
 		$current_site->domain = $domain;
 		$current_site->path = $path;
 		$current_site->site_name = ucfirst( $domain );
+		sqlsrv_query( $wpdb->dbh, "SET IDENTITY_INSERT $wpdb->blogs ON" );
 		$wpdb->insert( $wpdb->blogs, array( 'site_id' => $network_id, 'blog_id' => 1, 'domain' => $domain, 'path' => $path, 'registered' => current_time( 'mysql' ) ) );
 		$current_site->blog_id = $blog_id = $wpdb->insert_id;
+		sqlsrv_query( $wpdb->dbh, "SET IDENTITY_INSERT $wpdb->blogs OFF" );
 		update_user_meta( $site_user->ID, 'source_domain', $domain );
 		update_user_meta( $site_user->ID, 'primary_blog', $blog_id );
 

wp-admin/themes.php

@@ -142,7 +142,7 @@
 $ct = wp_get_theme();
 
 if ( $ct->errors() && ( ! is_multisite() || current_user_can( 'manage_network_themes' ) ) ) {
-	echo '<p class="error-message">' . sprintf( __( 'ERROR: %s' ), $ct->errors()->get_error_message() ) . '</p>';
+	echo '<div class="error"><p>' . sprintf( __( 'ERROR: %s' ), $ct->errors()->get_error_message() ) . '</p></div>';
 }
 
 /*
@@ -312,9 +312,9 @@
 	<div class="theme-backdrop"></div>
 	<div class="theme-wrap">
 		<div class="theme-header">
-			<button alt="<?php _e( 'Show previous theme' ); ?>" class="left dashicons dashicons-no"></button>
-			<button alt="<?php _e( 'Show next theme' ); ?>" class="right dashicons dashicons-no"></button>
-			<button alt="<?php _e( 'Close overlay' ); ?>" class="close dashicons dashicons-no"></button>
+			<button class="left dashicons dashicons-no"><span class="screen-reader-text"><?php _e( 'Show previous theme' ); ?></span></button>
+			<button class="right dashicons dashicons-no"><span class="screen-reader-text"><?php _e( 'Show next theme' ); ?></span></button>
+			<button class="close dashicons dashicons-no"><span class="screen-reader-text"><?php _e( 'Close overlay' ); ?></span></button>
 		</div>
 		<div class="theme-about">
 			<div class="theme-screenshots">

wp-content/themes/twentyfourteen/languages/twentyfourteen.pot

@@ -1,14 +1,14 @@
-# Copyright (C) 2013 the WordPress team
+# Copyright (C) 2014 the WordPress team
 # This file is distributed under the GNU General Public License v2 or later.
 msgid ""
 msgstr ""
 "Project-Id-Version: Twenty Fourteen 1.0\n"
 "Report-Msgid-Bugs-To: http://wordpress.org/tags/twentyfourteen\n"
-"POT-Creation-Date: 2013-12-12 05:25:07+00:00\n"
+"POT-Creation-Date: 2014-03-18 19:16:26+00:00\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"PO-Revision-Date: 2013-MO-DA HO:MI+ZONE\n"
+"PO-Revision-Date: 2014-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <[email protected]>\n"
 

wp-content/themes/twentythirteen/languages/twentythirteen.pot

@@ -1,14 +1,14 @@
-# Copyright (C) 2013 the WordPress team
+# Copyright (C) 2014 the WordPress team
 # This file is distributed under the GNU General Public License v2 or later.
 msgid ""
 msgstr ""
 "Project-Id-Version: Twenty Thirteen 1.1\n"
 "Report-Msgid-Bugs-To: http://wordpress.org/tags/twentythirteen\n"
-"POT-Creation-Date: 2013-10-24 20:32:06+00:00\n"
+"POT-Creation-Date: 2014-03-18 19:16:26+00:00\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"PO-Revision-Date: 2013-MO-DA HO:MI+ZONE\n"
+"PO-Revision-Date: 2014-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <[email protected]>\n"
 

wp-includes/bookmark.php

@@ -226,8 +226,8 @@ function get_bookmarks($args = '') {
 		$join = " INNER JOIN $wpdb->term_relationships AS tr ON ($wpdb->links.link_id = tr.object_id) INNER JOIN $wpdb->term_taxonomy as tt ON tt.term_taxonomy_id = tr.term_taxonomy_id";
 	}
 
-	if ( $show_updated && get_option('links_recently_updated_time') ) {
-		$recently_updated_test = ", IF (DATEADD(MINUTE, " . get_option('links_recently_updated_time') . ", link_updated) >= GETDATE(), 1,0) as recently_updated ";
+	if ( $show_updated ) {
+		$recently_updated_test = ", IF (DATEADD(MINUTE, 120, link_updated) >= GETDATE(), 1,0) as recently_updated ";
 	} else {
 		$recently_updated_test = '';
 	}

wp-includes/class-wp-xmlrpc-server.php

@@ -5390,11 +5390,18 @@ function pingback_ping($args) {
 		// very stupid, but gives time to the 'from' server to publish !
 		sleep(1);
 
+		$remote_ip = preg_replace( '/[^0-9a-fA-F:., ]/', '', $_SERVER['REMOTE_ADDR'] );
+		$user_agent = apply_filters( 'http_headers_useragent', 'WordPress/' . $GLOBALS['wp_version'] . '; ' . get_bloginfo( 'url' ) );
+
 		// Let's check the remote site
 		$http_api_args = array(
 			'timeout' => 10,
 			'redirection' => 0,
 			'limit_response_size' => 153600, // 150 KB
+			'user-agent' => "$user_agent; verifying pingback from $remote_ip",
+			'headers' => array(
+				'X-Pingback-Forwarded-For' => $remote_ip,
+			),
 		);
 		$linea = wp_remote_retrieve_body( wp_safe_remote_get( $pagelinkedfrom, $http_api_args ) );
 

wp-includes/pluggable.php

@@ -543,7 +543,7 @@ function wp_validate_auth_cookie($cookie = '', $scheme = '') {
 	$key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
 	$hash = hash_hmac('md5', $username . '|' . $expiration, $key);
 
-	if ( $hmac != $hash ) {
+	if ( hash_hmac( 'md5', $hmac, $key ) !== hash_hmac( 'md5', $hash, $key ) ) {
 		do_action('auth_cookie_bad_hash', $cookie_elements);
 		return false;
 	}

wp-includes/pn-version.php

@@ -1,5 +1,5 @@
 <?php
 
-$pn_version = '0.9.11';
+$pn_version = '0.9.12';
 
 ?>

wp-includes/post-template.php

@@ -1248,8 +1248,7 @@ function get_the_password_form( $post = 0 ) {
 	$label = 'pwbox-' . ( empty($post->ID) ? rand() : $post->ID );
 	$output = '<form action="' . esc_url( site_url( 'wp-login.php?action=postpass', 'login_post' ) ) . '" class="post-password-form" method="post">
 	<p>' . __( 'This content is password protected. To view it please enter your password below:' ) . '</p>
-	<p><label for="' . $label . '">' . __( 'Password:' ) . ' <input name="post_password" id="' . $label . '" type="password" size="20" /></label> <input type="submit" name="Submit" value="' . esc_attr__( 'Submit' ) . '" /></p>
-	</form>
+	<p><label for="' . $label . '">' . __( 'Password:' ) . ' <input name="post_password" id="' . $label . '" type="password" size="20" /></label> <input type="submit" name="Submit" value="' . esc_attr__( 'Submit' ) . '" /></p></form>
 	';
 	return apply_filters( 'the_password_form', $output );
 }
@@ -1443,3 +1442,22 @@ function wp_list_post_revisions( $post_id = 0, $type = 'all' ) {
 	echo $rows;
 	echo "</ul>";
 }
+
+/**
+ * Dashboard CSS fixes for 3.8.2.
+ *
+ * This function cheaply fixes #WP27082 and #WP26910 in lieu of
+ * changing the massive wp-admin.css file in a point release.
+ * This lucky includes file was already receiving an update.
+ *
+ * @since 3.8.2
+ * @access private
+ */
+function wp_382_css_hotfix() {
+	echo '<style type="text/css">
+#activity-widget #the-comment-list .comment-item { position: relative; }
+.tagsdiv .newtag { padding: 6px 10px; height: auto; }
+</style>
+';
+}
+add_action( 'admin_print_styles', 'wp_382_css_hotfix', 30 );