Merge remote-tracking branch 'upstream/4.6-branch' into 4.6-branch

voceconnect · Oct 11, 2016 · 42e6e0f · 42e6e0f
2 parents 96a453b + 4d089ce
commit 42e6e0f
Show file tree

Hide file tree

Showing 28 changed files with 173 additions and 99 deletions.
diff --git a/readme.html b/readme.html
@@ -9,7 +9,7 @@
 <body>
 <h1 id="logo">
 	<a href="https://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
-	<br /> Version 4.6.1
+	<br /> Version 4.6.2
 </h1>
 <p style="text-align: center">Semantic Personal Publishing Platform</p>
 

diff --git a/wp-admin/about.php b/wp-admin/about.php
@@ -58,6 +58,14 @@ function _wp_override_admin_video_width_limit( $output ) {
 			<a href="freedoms.php" class="nav-tab"><?php _e( 'Freedoms' ); ?></a>
 		</h2>
 
+		<div class="changelog point-releases">
+			<h3><?php _e( 'Maintenance and Security Release' ); ?></h3>
+			<p><?php printf( _n( '<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
+				'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.', 15 ), '4.6.1', number_format_i18n( 15 ) ); ?>
+				<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_4.6.1' ); ?>
+			</p>
+		</div>
+
 		<div class="headline-feature feature-video">
 			<iframe width="1050" height="591" src="<?php echo esc_url( $video_url ); ?>" frameborder="0" allowfullscreen></iframe>
 			<script src="https://videopress.com/videopress-iframe.js"></script>

diff --git a/wp-admin/includes/class-file-upload-upgrader.php b/wp-admin/includes/class-file-upload-upgrader.php
@@ -100,8 +100,12 @@ public function __construct( $form, $urlholder ) {
 			if ( ! ( ( $uploads = wp_upload_dir() ) && false === $uploads['error'] ) )
 				wp_die( $uploads['error'] );
 
-			$this->filename = $_GET[$urlholder];
+			$this->filename = sanitize_file_name( $_GET[ $urlholder ] );
 			$this->package = $uploads['basedir'] . '/' . $this->filename;
+
+			if ( 0 !== strpos( realpath( $this->package ), realpath( $uploads['basedir'] ) ) ) {
+				wp_die( __( 'Please select a file' ) );
+			}
 		}
 	}
 

diff --git a/wp-admin/includes/class-language-pack-upgrader.php b/wp-admin/includes/class-language-pack-upgrader.php
@@ -282,9 +282,9 @@ public function bulk_upgrade( $language_updates = array(), $args = array() ) {
 
 		// Re-add upgrade hooks.
 		add_action( 'upgrader_process_complete', array( 'Language_Pack_Upgrader', 'async_upgrade' ), 20 );
-		add_action( 'upgrader_process_complete', 'wp_version_check' );
-		add_action( 'upgrader_process_complete', 'wp_update_plugins' );
-		add_action( 'upgrader_process_complete', 'wp_update_themes' );
+		add_action( 'upgrader_process_complete', 'wp_version_check', 10, 0 );
+		add_action( 'upgrader_process_complete', 'wp_update_plugins', 10, 0 );
+		add_action( 'upgrader_process_complete', 'wp_update_themes', 10, 0 );
 
 		$this->skin->bulk_footer();
 

diff --git a/wp-admin/includes/media.php b/wp-admin/includes/media.php
@@ -290,7 +290,7 @@ function media_handle_upload($file_id, $post_id, $post_data = array(), $override
 	$url = $file['url'];
 	$type = $file['type'];
 	$file = $file['file'];
-	$title = $name;
+	$title = sanitize_text_field( $name );
 	$content = '';
 	$excerpt = '';
 

diff --git a/wp-admin/js/editor-expand.js b/wp-admin/js/editor-expand.js
@@ -53,6 +53,47 @@
 				sideSortablesHeight: 0
 			};
 
+		var shrinkTextarea = window._.throttle( function() {
+			var x = window.scrollX || document.documentElement.scrollLeft;
+			var y = window.scrollY || document.documentElement.scrollTop;
+			var height = parseInt( textEditor.style.height, 10 );
+
+			textEditor.style.height = autoresizeMinHeight + 'px';
+
+			if ( textEditor.scrollHeight > autoresizeMinHeight ) {
+				textEditor.style.height = textEditor.scrollHeight + 'px';
+			}
+
+			if ( typeof x !== 'undefined' ) {
+				window.scrollTo( x, y );
+			}
+
+			if ( textEditor.scrollHeight < height ) {
+				adjust();
+			}
+		}, 300 );
+
+		function textEditorResize() {
+			var length = textEditor.value.length;
+
+			if ( mceEditor && ! mceEditor.isHidden() ) {
+				return;
+			}
+
+			if ( ! mceEditor && initialMode === 'tinymce' ) {
+				return;
+			}
+
+			if ( length < oldTextLength ) {
+				shrinkTextarea();
+			} else if ( parseInt( textEditor.style.height, 10 ) < textEditor.scrollHeight ) {
+				textEditor.style.height = Math.ceil( textEditor.scrollHeight ) + 'px';
+				adjust();
+			}
+
+			oldTextLength = length;
+		}
+
 		function getHeights() {
 			var windowWidth = $window.width();
 
@@ -75,43 +116,6 @@
 			}
 		}
 
-		function textEditorResize() {
-			if ( mceEditor && ! mceEditor.isHidden() ) {
-				return;
-			}
-
-			if ( ! mceEditor && initialMode === 'tinymce' ) {
-				return;
-			}
-
-			var length = textEditor.value.length;
-			var height = parseInt( textEditor.style.height, 10 );
-			var top = window.scrollTop;
-
-			if ( length < oldTextLength ) {
-				// textEditor.scrollHeight is not adjusted until the next line.
-				textEditor.style.height = 'auto';
-
-				if ( textEditor.scrollHeight > autoresizeMinHeight ) {
-					textEditor.style.height = textEditor.scrollHeight + 'px';
-				} else {
-					textEditor.style.height = autoresizeMinHeight + 'px';
-				}
-
-				// Prevent scroll-jumping in Firefox and IE.
-				window.scrollTop = top;
-
-				if ( textEditor.scrollHeight < height ) {
-					adjust();
-				}
-			} else if ( height < textEditor.scrollHeight ) {
-				textEditor.style.height = textEditor.scrollHeight + 'px';
-				adjust();
-			}
-
-			oldTextLength = length;
-		}
-
 		// We need to wait for TinyMCE to initialize.
 		$document.on( 'tinymce-editor-init.editor-expand', function( event, editor ) {
 			var VK = window.tinymce.util.VK,

diff --git a/wp-admin/js/editor-expand.min.js b/wp-admin/js/editor-expand.min.js
diff --git a/wp-includes/Requests/IRI.php b/wp-includes/Requests/IRI.php
@@ -688,10 +688,7 @@ public function is_valid() {
 		$isauthority = $this->iuserinfo !== null || $this->ihost !== null || $this->port !== null;
 		if ($this->ipath !== '' &&
 			(
-				$isauthority && (
-					$this->ipath[0] !== '/' ||
-					substr($this->ipath, 0, 2) === '//'
-				) ||
+				$isauthority && $this->ipath[0] !== '/' ||
 				(
 					$this->scheme === null &&
 					!$isauthority &&

diff --git a/wp-includes/Requests/Transport/cURL.php b/wp-includes/Requests/Transport/cURL.php
@@ -347,7 +347,7 @@ protected function setup_handle($url, $headers, $data, $options) {
 			default:
 				curl_setopt($this->handle, CURLOPT_CUSTOMREQUEST, $options['type']);
 				if (!empty($data)) {
-					curl_setopt( $this->handle, CURLOPT_POSTFIELDS, $data );
+					curl_setopt($this->handle, CURLOPT_POSTFIELDS, $data);
 				}
 		}
 
@@ -375,8 +375,9 @@ protected function setup_handle($url, $headers, $data, $options) {
 		curl_setopt($this->handle, CURLOPT_URL, $url);
 		curl_setopt($this->handle, CURLOPT_REFERER, $url);
 		curl_setopt($this->handle, CURLOPT_USERAGENT, $options['useragent']);
-		curl_setopt($this->handle, CURLOPT_HTTPHEADER, $headers);
-
+		if (!empty($headers)) {
+			curl_setopt($this->handle, CURLOPT_HTTPHEADER, $headers);
+		}
 		if ($options['protocol_version'] === 1.1) {
 			curl_setopt($this->handle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
 		}
@@ -458,7 +459,7 @@ public function stream_headers($handle, $headers) {
 	 * @param string $data Body data
 	 * @return integer Length of provided data
 	 */
-	protected function stream_body($handle, $data) {
+	public function stream_body($handle, $data) {
 		$this->hooks->dispatch('request.progress', array($data, $this->response_bytes, $this->response_byte_limit));
 		$data_length = strlen($data);
 
@@ -524,7 +525,7 @@ protected static function format_get($url, $data) {
 	 * @return boolean True if the transport is valid, false otherwise.
 	 */
 	public static function test($capabilities = array()) {
-		if (!function_exists('curl_init') && !function_exists('curl_exec')) {
+		if (!function_exists('curl_init') || !function_exists('curl_exec')) {
 			return false;
 		}
 

diff --git a/wp-includes/Requests/Transport/fsockopen.php b/wp-includes/Requests/Transport/fsockopen.php
@@ -70,7 +70,9 @@ public function request($url, $headers = array(), $data = array(), $options = ar
 		// HTTPS support
 		if (isset($url_parts['scheme']) && strtolower($url_parts['scheme']) === 'https') {
 			$remote_socket = 'ssl://' . $host;
-			$url_parts['port'] = 443;
+			if (!isset($url_parts['port'])) {
+				$url_parts['port'] = 443;
+			}
 
 			$context_options = array(
 				'verify_peer' => true,
@@ -97,6 +99,7 @@ public function request($url, $headers = array(), $data = array(), $options = ar
 			}
 
 			if (isset($options['verifyname']) && $options['verifyname'] === false) {
+				$context_options['verify_peer_name'] = false;
 				$verifyname = false;
 			}
 
@@ -171,7 +174,7 @@ public function request($url, $headers = array(), $data = array(), $options = ar
 		if (!isset($case_insensitive_headers['Host'])) {
 			$out .= sprintf('Host: %s', $url_parts['host']);
 
-			if ($url_parts['port'] !== 80) {
+			if (( 'http' === strtolower($url_parts['scheme']) && $url_parts['port'] !== 80 ) || ( 'https' === strtolower($url_parts['scheme']) && $url_parts['port'] !== 443 )) {
 				$out .= ':' . $url_parts['port'];
 			}
 			$out .= "\r\n";

diff --git a/wp-includes/class-http.php b/wp-includes/class-http.php
@@ -332,6 +332,7 @@ public function request( $url, $args = array() ) {
 		// SSL certificate handling
 		if ( ! $r['sslverify'] ) {
 			$options['verify'] = false;
+			$options['verifyname'] = false;
 		} else {
 			$options['verify'] = $r['sslcertificates'];
 		}
@@ -433,7 +434,7 @@ public static function normalize_cookies( $cookies ) {
 		foreach ( $cookies as $name => $value ) {
 			if ( $value instanceof WP_Http_Cookie ) {
 				$cookie_jar[ $value->name ] = new Requests_Cookie( $value->name, $value->value, $value->get_attributes() );
-			} elseif ( is_string( $value ) ) {
+			} elseif ( is_scalar( $value ) ) {
 				$cookie_jar[ $name ] = new Requests_Cookie( $name, $value );
 			}
 		}

diff --git a/wp-includes/class-requests.php b/wp-includes/class-requests.php
@@ -749,15 +749,17 @@ public static function parse_multiple(&$response, $request) {
 	 * @return string Decoded body
 	 */
 	protected static function decode_chunked($data) {
-		if (!preg_match('/^([0-9a-f]+)[^\r\n]*\r\n/i', trim($data))) {
+		if (!preg_match('/^([0-9a-f]+)(?:;(?:[\w-]*)(?:=(?:(?:[\w-]*)*|"(?:[^\r\n])*"))?)*\r\n/i', trim($data))) {
 			return $data;
 		}
 
+
+
 		$decoded = '';
 		$encoded = $data;
 
 		while (true) {
-			$is_chunked = (bool) preg_match('/^([0-9a-f]+)[^\r\n]*\r\n/i', $encoded, $matches);
+			$is_chunked = (bool) preg_match('/^([0-9a-f]+)(?:;(?:[\w-]*)(?:=(?:(?:[\w-]*)*|"(?:[^\r\n])*"))?)*\r\n/i', $encoded, $matches);
 			if (!$is_chunked) {
 				// Looks like it's not chunked after all
 				return $data;

diff --git a/wp-includes/class-wp-editor.php b/wp-includes/class-wp-editor.php
@@ -1259,6 +1259,14 @@ public static function editor_js() {
 			var init, id, $wrap;
 
 			if ( typeof tinymce !== 'undefined' ) {
+				// Fix RTL
+				tinymce.on( 'addeditor', function( event ) {
+					event.editor.rtl = event.editor.settings.rtl_ui ||
+						( event.editor.editorManager &&
+						event.editor.editorManager.i18n &&
+						event.editor.editorManager.i18n.rtl );
+				}, true );
+
 				for ( id in tinyMCEPreInit.mceInit ) {
 					init = tinyMCEPreInit.mceInit[id];
 					$wrap = tinymce.$( '#wp-' + id + '-wrap' );

diff --git a/wp-includes/css/editor-rtl.css b/wp-includes/css/editor-rtl.css
@@ -392,6 +392,11 @@ div.mce-path {
 	cursor: pointer;
 }
 
+.mce-btn .mce-txt {
+	direction: inherit;
+	text-align: inherit;
+}
+
 .mce-toolbar .mce-btn-group .mce-btn,
 .qt-dfw {
 	border: 1px solid transparent;

diff --git a/wp-includes/css/editor-rtl.min.css b/wp-includes/css/editor-rtl.min.css
diff --git a/wp-includes/css/editor.css b/wp-includes/css/editor.css
@@ -392,6 +392,11 @@ div.mce-path {
 	cursor: pointer;
 }
 
+.mce-btn .mce-txt {
+	direction: inherit;
+	text-align: inherit;
+}
+
 .mce-toolbar .mce-btn-group .mce-btn,
 .qt-dfw {
 	border: 1px solid transparent;

diff --git a/wp-includes/css/editor.min.css b/wp-includes/css/editor.min.css
diff --git a/wp-includes/functions.php b/wp-includes/functions.php
@@ -3190,28 +3190,29 @@ function _config_wp_siteurl( $url = '' ) {
  * Fills in the 'directionality' setting, enables the 'directionality'
  * plugin, and adds the 'ltr' button to 'toolbar1', formerly
  * 'theme_advanced_buttons1' array keys. These keys are then returned
- * in the $input (TinyMCE settings) array.
+ * in the $mce_init (TinyMCE settings) array.
  *
  * @since 2.1.0
  * @access private
  *
- * @param array $input MCE settings array.
+ * @param array $mce_init MCE settings array.
  * @return array Direction set for 'rtl', if needed by locale.
  */
-function _mce_set_direction( $input ) {
+function _mce_set_direction( $mce_init ) {
 	if ( is_rtl() ) {
-		$input['directionality'] = 'rtl';
+		$mce_init['directionality'] = 'rtl';
+		$mce_init['rtl_ui'] = true;
 
-		if ( ! empty( $input['plugins'] ) && strpos( $input['plugins'], 'directionality' ) === false ) {
-			$input['plugins'] .= ',directionality';
+		if ( ! empty( $mce_init['plugins'] ) && strpos( $mce_init['plugins'], 'directionality' ) === false ) {
+			$mce_init['plugins'] .= ',directionality';
 		}
 
-		if ( ! empty( $input['toolbar1'] ) && ! preg_match( '/\bltr\b/', $input['toolbar1'] ) ) {
-			$input['toolbar1'] .= ',ltr';
+		if ( ! empty( $mce_init['toolbar1'] ) && ! preg_match( '/\bltr\b/', $mce_init['toolbar1'] ) ) {
+			$mce_init['toolbar1'] .= ',ltr';
 		}
 	}
 
-	return $input;
+	return $mce_init;
 }
 
 

diff --git a/wp-includes/general-template.php b/wp-includes/general-template.php
@@ -2853,7 +2853,7 @@ function wp_resource_hints() {
 		$urls = array_unique( $urls );
 
 		foreach ( $urls as $url ) {
-			printf( "<link rel='%s' href='%s'>\n", $relation_type, $url );
+			printf( "<link rel='%s' href='%s' />\n", $relation_type, $url );
 		}
 	}
 }

diff --git a/wp-includes/js/jquery/jquery.masonry.min.js b/wp-includes/js/jquery/jquery.masonry.min.js
diff --git a/wp-includes/js/tinymce/skins/wordpress/wp-content.css b/wp-includes/js/tinymce/skins/wordpress/wp-content.css
@@ -20,7 +20,8 @@ body.rtl {
 	font-family: Tahoma, "Times New Roman", "Bitstream Charter", Times, serif;
 }
 
-body.locale-he-il {
+body.locale-he-il,
+body.locale-vi {
 	font-family: Arial, "Times New Roman", "Bitstream Charter", Times, serif;
 }