Version %1$s addressed some security issues and fixed %2$s bug.', + 'Version %1$s addressed some security issues and fixed %2$s bugs.', 17 ), '4.4.2', number_format_i18n( 17 ) ); ?> + the release notes.' ), 'https://codex.wordpress.org/Version_4.4.2' ); ?> +

Version %1$s addressed some security issues and fixed %2$s bug.', 'Version %1$s addressed some security issues and fixed %2$s bugs.', 52 ), '4.4.1', number_format_i18n( 52 ) ); ?> the release notes.' ), 'https://codex.wordpress.org/Version_4.4.1' ); ?> diff --git a/wp-admin/includes/image.php b/wp-admin/includes/image.php index 139d4050..2faccfe7 100644 --- a/wp-admin/includes/image.php +++ b/wp-admin/includes/image.php @@ -408,12 +408,14 @@ function wp_read_image_metadata( $file ) { } } - foreach ( $meta as &$value ) { - if ( is_string( $value ) ) { - $value = wp_kses_post( $value ); + foreach ( $meta['keywords'] as $key => $keyword ) { + if ( ! seems_utf8( $keyword ) ) { + $meta['keywords'][ $key ] = utf8_encode( $keyword ); } } + $meta = wp_kses_post_deep( $meta ); + /** * Filter the array of meta data read from an image's exif data. * diff --git a/wp-admin/js/inline-edit-tax.js b/wp-admin/js/inline-edit-tax.js index a05dc095..b1090de4 100644 --- a/wp-admin/js/inline-edit-tax.js +++ b/wp-admin/js/inline-edit-tax.js @@ -137,6 +137,8 @@ inlineEditTax = { } } ); + // Prevent submitting the form when pressing Enter on a focused field. + return false; }, revert : function() { diff --git a/wp-admin/js/inline-edit-tax.min.js b/wp-admin/js/inline-edit-tax.min.js index 14b3b8a7..c99a76b8 100644 --- a/wp-admin/js/inline-edit-tax.min.js +++ b/wp-admin/js/inline-edit-tax.min.js @@ -1 +1 @@ -window.wp=window.wp||{};var inlineEditTax;!function(a,b){inlineEditTax={init:function(){var b=this,c=a("#inline-edit");b.type=a("#the-list").attr("data-wp-lists").substr(5),b.what="#"+b.type+"-",a("#the-list").on("click","a.editinline",function(){return inlineEditTax.edit(this),!1}),c.keyup(function(a){return 27===a.which?inlineEditTax.revert():void 0}),a(".cancel",c).click(function(){return inlineEditTax.revert()}),a(".save",c).click(function(){return inlineEditTax.save(this)}),a("input, select",c).keydown(function(a){return 13===a.which?inlineEditTax.save(this):void 0}),a('#posts-filter input[type="submit"]').mousedown(function(){b.revert()})},toggle:function(b){var c=this;"none"===a(c.what+c.getId(b)).css("display")?c.revert():c.edit(b)},edit:function(b){var c,d,e,f=this;return f.revert(),"object"==typeof b&&(b=f.getId(b)),c=a("#inline-edit").clone(!0),d=a("#inline_"+b),a("td",c).attr("colspan",a("th:visible, td:visible",".widefat:first thead").length),a(f.what+b).hide().after(c).after(''),e=a(".name",d),e.find("img").replaceWith(function(){return this.alt}),e=e.text(),a(':input[name="name"]',c).val(e),e=a(".slug",d),e.find("img").replaceWith(function(){return this.alt}),e=e.text(),a(':input[name="slug"]',c).val(e),a(c).attr("id","edit-"+b).addClass("inline-editor").show(),a(".ptitle",c).eq(0).focus(),!1},save:function(c){var d,e,f=a('input[name="taxonomy"]').val()||"";"object"==typeof c&&(c=this.getId(c)),a("table.widefat .spinner").addClass("is-active"),d={action:"inline-save-tax",tax_type:this.type,tax_ID:c,taxonomy:f},e=a("#edit-"+c).find(":input").serialize(),d=e+"&"+a.param(d),a.post(ajaxurl,d,function(d){var e,f,g,h=a("#edit-"+c+" .inline-edit-save .error");a("table.widefat .spinner").removeClass("is-active"),d?-1!==d.indexOf("'),e=a(".name",d),e.find("img").replaceWith(function(){return this.alt}),e=e.text(),a(':input[name="name"]',c).val(e),e=a(".slug",d),e.find("img").replaceWith(function(){return this.alt}),e=e.text(),a(':input[name="slug"]',c).val(e),a(c).attr("id","edit-"+b).addClass("inline-editor").show(),a(".ptitle",c).eq(0).focus(),!1},save:function(c){var d,e,f=a('input[name="taxonomy"]').val()||"";return"object"==typeof c&&(c=this.getId(c)),a("table.widefat .spinner").addClass("is-active"),d={action:"inline-save-tax",tax_type:this.type,tax_ID:c,taxonomy:f},e=a("#edit-"+c).find(":input").serialize(),d=e+"&"+a.param(d),a.post(ajaxurl,d,function(d){var e,f,g,h=a("#edit-"+c+" .inline-edit-save .error");a("table.widefat .spinner").removeClass("is-active"),d?-1!==d.indexOf(" $registered_sidebar ) { if ( !empty( $registered_sidebar['class'] ) ) $wrap_class .= ' ' . $registered_sidebar['class']; + $is_inactive_widgets = 'wp_inactive_widgets' == $registered_sidebar['id']; ?>

'', ); + /** + * SQL WHERE clause. + * + * Stored after the 'comments_clauses' filter is run on the compiled WHERE sub-clauses. + * + * @since 4.4.2 + * @access protected + * @var string + */ + protected $filtered_where_clause; + /** * Date query container * @@ -747,7 +758,7 @@ class WP_Comment_Query { foreach ( $post_fields as $field_name => $field_value ) { // $field_value may be an array. $esses = array_fill( 0, count( (array) $field_value ), '%s' ); - $this->sql_clauses['where']['post_fields'] = $wpdb->prepare( " {$wpdb->posts}.{$field_name} IN (" . implode( ',', $esses ) . ')', $field_value ); + $this->sql_clauses['where'][ $field_name ] = $wpdb->prepare( " {$wpdb->posts}.{$field_name} IN (" . implode( ',', $esses ) . ')', $field_value ); } } @@ -816,6 +827,8 @@ class WP_Comment_Query { $limits = isset( $clauses[ 'limits' ] ) ? $clauses[ 'limits' ] : ''; $groupby = isset( $clauses[ 'groupby' ] ) ? $clauses[ 'groupby' ] : ''; + $this->filtered_where_clause = $where; + if ( $where ) { $where = 'WHERE ' . $where; } @@ -867,12 +880,27 @@ class WP_Comment_Query { 0 => wp_list_pluck( $comments, 'comment_ID' ), ); - $where_clauses = $this->sql_clauses['where']; - unset( - $where_clauses['parent'], - $where_clauses['parent__in'], - $where_clauses['parent__not_in'] - ); + /* + * The WHERE clause for the descendant query is the same as for the top-level + * query, minus the `parent`, `parent__in`, and `parent__not_in` sub-clauses. + */ + $_where = $this->filtered_where_clause; + $exclude_keys = array( 'parent', 'parent__in', 'parent__not_in' ); + foreach ( $exclude_keys as $exclude_key ) { + if ( isset( $this->sql_clauses['where'][ $exclude_key ] ) ) { + $clause = $this->sql_clauses['where'][ $exclude_key ]; + + // Strip the clause as well as any adjacent ANDs. + $pattern = '|(?:AND)?\s*' . $clause . '\s*(?:AND)?|'; + $_where_parts = preg_split( $pattern, $_where ); + + // Remove empties. + $_where_parts = array_filter( array_map( 'trim', $_where_parts ) ); + + // Reassemble with an AND. + $_where = implode( ' AND ', $_where_parts ); + } + } // Fetch an entire level of the descendant tree at a time. $level = 0; @@ -882,7 +910,7 @@ class WP_Comment_Query { break; } - $where = 'WHERE ' . implode( ' AND ', $where_clauses ) . ' AND comment_parent IN (' . implode( ',', array_map( 'intval', $parent_ids ) ) . ')'; + $where = 'WHERE ' . $_where . ' AND comment_parent IN (' . implode( ',', array_map( 'intval', $parent_ids ) ) . ')'; $comment_ids = $wpdb->get_col( "{$this->sql_clauses['select']} {$this->sql_clauses['from']} {$where} {$this->sql_clauses['groupby']} ORDER BY comment_date_gmt ASC, comment_ID ASC" ); $level++; diff --git a/wp-includes/class-wp-customize-manager.php b/wp-includes/class-wp-customize-manager.php index 9f15d31f..b7895563 100644 --- a/wp-includes/class-wp-customize-manager.php +++ b/wp-includes/class-wp-customize-manager.php @@ -1535,9 +1535,11 @@ final class WP_Customize_Manager { */ public function get_return_url() { $referer = wp_get_referer(); + $excluded_referer_basenames = array( 'customize.php', 'wp-login.php' ); + if ( $this->return_url ) { $return_url = $this->return_url; - } else if ( $referer && 'customize.php' !== basename( parse_url( $referer, PHP_URL_PATH ) ) ) { + } else if ( $referer && ! in_array( basename( parse_url( $referer, PHP_URL_PATH ) ), $excluded_referer_basenames, true ) ) { $return_url = $referer; } else if ( $this->preview_url ) { $return_url = $this->preview_url; diff --git a/wp-includes/comment-template.php b/wp-includes/comment-template.php index 4ef67dd7..ad5b9caf 100644 --- a/wp-includes/comment-template.php +++ b/wp-includes/comment-template.php @@ -1285,11 +1285,16 @@ function comments_template( $file = '/comments.php', $separate_comments = false 'order' => 'ASC', 'status' => 'approve', 'post_id' => $post->ID, - 'hierarchical' => 'threaded', 'no_found_rows' => false, 'update_comment_meta_cache' => false, // We lazy-load comment meta for performance. ); + if ( get_option('thread_comments') ) { + $comment_args['hierarchical'] = 'threaded'; + } else { + $comment_args['hierarchical'] = false; + } + if ( $user_ID ) { $comment_args['include_unapproved'] = array( $user_ID ); } elseif ( ! empty( $comment_author_email ) ) { @@ -1317,10 +1322,13 @@ function comments_template( $file = '/comments.php', $separate_comments = false 'count' => true, 'orderby' => false, 'post_id' => $post->ID, - 'parent' => 0, 'status' => 'approve', ); + if ( $comment_args['hierarchical'] ) { + $top_level_args['parent'] = 0; + } + if ( isset( $comment_args['include_unapproved'] ) ) { $top_level_args['include_unapproved'] = $comment_args['include_unapproved']; } @@ -1335,18 +1343,22 @@ function comments_template( $file = '/comments.php', $separate_comments = false $_comments = $comment_query->comments; // Trees must be flattened before they're passed to the walker. - $comments_flat = array(); - foreach ( $_comments as $_comment ) { - $comments_flat[] = $_comment; - $comment_children = $_comment->get_children( array( - 'format' => 'flat', - 'status' => $comment_args['status'], - 'orderby' => $comment_args['orderby'] - ) ); - - foreach ( $comment_children as $comment_child ) { - $comments_flat[] = $comment_child; + if ( $comment_args['hierarchical'] ) { + $comments_flat = array(); + foreach ( $_comments as $_comment ) { + $comments_flat[] = $_comment; + $comment_children = $_comment->get_children( array( + 'format' => 'flat', + 'status' => $comment_args['status'], + 'orderby' => $comment_args['orderby'] + ) ); + + foreach ( $comment_children as $comment_child ) { + $comments_flat[] = $comment_child; + } } + } else { + $comments_flat = $_comments; } /** @@ -1925,27 +1937,6 @@ function wp_list_comments( $args = array(), $comments = null ) { */ $r = apply_filters( 'wp_list_comments_args', $r ); - /* - * If 'page' or 'per_page' has been passed, and does not match what's in $wp_query, - * perform a separate comment query and allow Walker_Comment to paginate. - */ - if ( is_singular() && ( $r['page'] || $r['per_page'] ) ) { - $current_cpage = get_query_var( 'cpage' ); - if ( ! $current_cpage ) { - $current_cpage = 'newest' === get_option( 'default_comments_page' ) ? 1 : $wp_query->max_num_comment_pages; - } - - $current_per_page = get_query_var( 'comments_per_page' ); - if ( $r['page'] != $current_cpage || $r['per_page'] != $current_per_page ) { - $comments = get_comments( array( - 'post_id' => get_queried_object_id(), - 'orderby' => 'comment_date_gmt', - 'order' => 'ASC', - 'status' => 'all', - ) ); - } - } - // Figure out what comments we'll be looping through ($_comments) if ( null !== $comments ) { $comments = (array) $comments; @@ -1960,34 +1951,71 @@ function wp_list_comments( $args = array(), $comments = null ) { $_comments = $comments; } } else { - if ( empty($wp_query->comments) ) - return; - if ( 'all' != $r['type'] ) { - if ( empty($wp_query->comments_by_type) ) - $wp_query->comments_by_type = separate_comments($wp_query->comments); - if ( empty($wp_query->comments_by_type[$r['type']]) ) - return; - $_comments = $wp_query->comments_by_type[$r['type']]; - } else { - $_comments = $wp_query->comments; - } + /* + * If 'page' or 'per_page' has been passed, and does not match what's in $wp_query, + * perform a separate comment query and allow Walker_Comment to paginate. + */ + if ( $r['page'] || $r['per_page'] ) { + $current_cpage = get_query_var( 'cpage' ); + if ( ! $current_cpage ) { + $current_cpage = 'newest' === get_option( 'default_comments_page' ) ? 1 : $wp_query->max_num_comment_pages; + } + + $current_per_page = get_query_var( 'comments_per_page' ); + if ( $r['page'] != $current_cpage || $r['per_page'] != $current_per_page ) { + + $comments = get_comments( array( + 'post_id' => get_the_ID(), + 'orderby' => 'comment_date_gmt', + 'order' => 'ASC', + 'status' => 'all', + ) ); - // Pagination is already handled by `WP_Comment_Query`, so we tell Walker not to bother. - if ( $wp_query->max_num_comment_pages ) { - $default_comments_page = get_option( 'default_comments_page' ); - $cpage = get_query_var( 'cpage' ); - if ( 'newest' === $default_comments_page ) { - $r['cpage'] = $cpage; + if ( 'all' != $r['type'] ) { + $comments_by_type = separate_comments( $comments ); + if ( empty( $comments_by_type[ $r['type'] ] ) ) { + return; + } + + $_comments = $comments_by_type[ $r['type'] ]; + } else { + $_comments = $comments; + } + } - // When first page shows oldest comments, post permalink is the same as the comment permalink. - } elseif ( $cpage == 1 ) { - $r['cpage'] = ''; + // Otherwise, fall back on the comments from `$wp_query->comments`. + } else { + if ( empty($wp_query->comments) ) + return; + if ( 'all' != $r['type'] ) { + if ( empty($wp_query->comments_by_type) ) + $wp_query->comments_by_type = separate_comments($wp_query->comments); + if ( empty($wp_query->comments_by_type[$r['type']]) ) + return; + $_comments = $wp_query->comments_by_type[$r['type']]; } else { - $r['cpage'] = $cpage; + $_comments = $wp_query->comments; } - $r['page'] = 0; - $r['per_page'] = 0; + if ( $wp_query->max_num_comment_pages ) { + $default_comments_page = get_option( 'default_comments_page' ); + $cpage = get_query_var( 'cpage' ); + if ( 'newest' === $default_comments_page ) { + $r['cpage'] = $cpage; + + /* + * When first page shows oldest comments, post permalink is the same as + * the comment permalink. + */ + } elseif ( $cpage == 1 ) { + $r['cpage'] = ''; + } else { + $r['cpage'] = $cpage; + } + + $r['page'] = 0; + $r['per_page'] = 0; + } } } diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php index 1f4a8638..65758680 100644 --- a/wp-includes/formatting.php +++ b/wp-includes/formatting.php @@ -4534,7 +4534,7 @@ function print_emoji_detection_script() { * * @param string The emoji base URL. */ - 'baseUrl' => apply_filters( 'emoji_url', set_url_scheme( '//s.w.org/images/core/emoji/72x72/' ) ), + 'baseUrl' => apply_filters( 'emoji_url', 'https://s.w.org/images/core/emoji/72x72/' ), /** * Filter the extension of the emoji files. @@ -4581,7 +4581,7 @@ function print_emoji_detection_script() { ?> = $parts[1] ) || ( 192 === $parts[0] && 168 === $parts[1] ) ) { diff --git a/wp-includes/js/wp-emoji-loader.js b/wp-includes/js/wp-emoji-loader.js index 327f66a1..83f431cc 100644 --- a/wp-includes/js/wp-emoji-loader.js +++ b/wp-includes/js/wp-emoji-loader.js @@ -13,6 +13,7 @@ function browserSupportsEmoji( type ) { var canvas = document.createElement( 'canvas' ), context = canvas.getContext && canvas.getContext( '2d' ), + stringFromCharCode = String.fromCharCode, tone; if ( ! context || ! context.fillText ) { @@ -37,7 +38,7 @@ * The first two will encode to small images (1-2KB data URLs), the third will encode * to a larger image (4-5KB data URL). */ - context.fillText( String.fromCharCode( 55356, 56806, 55356, 56826 ), 0, 0 ); + context.fillText( stringFromCharCode( 55356, 56806, 55356, 56826 ), 0, 0 ); return canvas.toDataURL().length > 3000; } else if ( 'diversity' === type ) { /* @@ -45,9 +46,9 @@ * emoji with no skin tone specified (in this case, Santa). It then adds a skin tone, and * compares if the emoji rendering has changed. */ - context.fillText( String.fromCharCode( 55356, 57221 ), 0, 0 ); + context.fillText( stringFromCharCode( 55356, 57221 ), 0, 0 ); tone = context.getImageData( 16, 16, 1, 1 ).data.toString(); - context.fillText( String.fromCharCode( 55356, 57221, 55356, 57343 ), 0, 0 ); + context.fillText( stringFromCharCode( 55356, 57221, 55356, 57343 ), 0, 0 ); // Chrome has issues comparing arrays, so we compare it as a string, instead. return tone !== context.getImageData( 16, 16, 1, 1 ).data.toString(); } else { @@ -57,13 +58,13 @@ * center pixel. In browsers that don't support emoji, the character will be rendered * as an empty square, so the center pixel will be blank. */ - context.fillText( String.fromCharCode( 55357, 56835 ), 0, 0 ); + context.fillText( stringFromCharCode( 55357, 56835 ), 0, 0 ); } else { /* * To check for Unicode 8 support, let's try rendering the most important advancement * that the Unicode Consortium have made in years: the burrito. */ - context.fillText( String.fromCharCode( 55356, 57135 ), 0, 0 ); + context.fillText( stringFromCharCode( 55356, 57135 ), 0, 0 ); } return context.getImageData( 16, 16, 1, 1 ).data[0] !== 0; } diff --git a/wp-includes/js/wp-emoji-loader.min.js b/wp-includes/js/wp-emoji-loader.min.js index fb5d949c..9579e8f9 100644 --- a/wp-includes/js/wp-emoji-loader.min.js +++ b/wp-includes/js/wp-emoji-loader.min.js @@ -1 +1 @@ -!function(a,b,c){function d(a){var c,d=b.createElement("canvas"),e=d.getContext&&d.getContext("2d");return e&&e.fillText?(e.textBaseline="top",e.font="600 32px Arial","flag"===a?(e.fillText(String.fromCharCode(55356,56806,55356,56826),0,0),d.toDataURL().length>3e3):"diversity"===a?(e.fillText(String.fromCharCode(55356,57221),0,0),c=e.getImageData(16,16,1,1).data.toString(),e.fillText(String.fromCharCode(55356,57221,55356,57343),0,0),c!==e.getImageData(16,16,1,1).data.toString()):("simple"===a?e.fillText(String.fromCharCode(55357,56835),0,0):e.fillText(String.fromCharCode(55356,57135),0,0),0!==e.getImageData(16,16,1,1).data[0])):!1}function e(a){var c=b.createElement("script");c.src=a,c.type="text/javascript",b.getElementsByTagName("head")[0].appendChild(c)}var f,g;c.supports={simple:d("simple"),flag:d("flag"),unicode8:d("unicode8"),diversity:d("diversity")},c.DOMReady=!1,c.readyCallback=function(){c.DOMReady=!0},c.supports.simple&&c.supports.flag&&c.supports.unicode8&&c.supports.diversity||(g=function(){c.readyCallback()},b.addEventListener?(b.addEventListener("DOMContentLoaded",g,!1),a.addEventListener("load",g,!1)):(a.attachEvent("onload",g),b.attachEvent("onreadystatechange",function(){"complete"===b.readyState&&c.readyCallback()})),f=c.source||{},f.concatemoji?e(f.concatemoji):f.wpemoji&&f.twemoji&&(e(f.twemoji),e(f.wpemoji)))}(window,document,window._wpemojiSettings); \ No newline at end of file +!function(a,b,c){function d(a){var c,d=b.createElement("canvas"),e=d.getContext&&d.getContext("2d"),f=String.fromCharCode;return e&&e.fillText?(e.textBaseline="top",e.font="600 32px Arial","flag"===a?(e.fillText(f(55356,56806,55356,56826),0,0),d.toDataURL().length>3e3):"diversity"===a?(e.fillText(f(55356,57221),0,0),c=e.getImageData(16,16,1,1).data.toString(),e.fillText(f(55356,57221,55356,57343),0,0),c!==e.getImageData(16,16,1,1).data.toString()):("simple"===a?e.fillText(f(55357,56835),0,0):e.fillText(f(55356,57135),0,0),0!==e.getImageData(16,16,1,1).data[0])):!1}function e(a){var c=b.createElement("script");c.src=a,c.type="text/javascript",b.getElementsByTagName("head")[0].appendChild(c)}var f,g;c.supports={simple:d("simple"),flag:d("flag"),unicode8:d("unicode8"),diversity:d("diversity")},c.DOMReady=!1,c.readyCallback=function(){c.DOMReady=!0},c.supports.simple&&c.supports.flag&&c.supports.unicode8&&c.supports.diversity||(g=function(){c.readyCallback()},b.addEventListener?(b.addEventListener("DOMContentLoaded",g,!1),a.addEventListener("load",g,!1)):(a.attachEvent("onload",g),b.attachEvent("onreadystatechange",function(){"complete"===b.readyState&&c.readyCallback()})),f=c.source||{},f.concatemoji?e(f.concatemoji):f.wpemoji&&f.twemoji&&(e(f.twemoji),e(f.wpemoji)))}(window,document,window._wpemojiSettings); \ No newline at end of file diff --git a/wp-includes/kses.php b/wp-includes/kses.php index d34608b8..4827b0de 100644 --- a/wp-includes/kses.php +++ b/wp-includes/kses.php @@ -1580,6 +1580,19 @@ function wp_kses_post( $data ) { return wp_kses( $data, 'post' ); } +/** + * Navigates through an array, object, or scalar, and sanitizes content for + * allowed HTML tags for post content. + * + * @since 4.4.2 + * + * @param mixed $value The array or string to filter. + * @return mixed $value The filtered content. + */ +function wp_kses_post_deep( $data ) { + return map_deep( $data, 'wp_kses_post' ); +} + /** * Strips all of the HTML in the content. * diff --git a/wp-includes/load.php b/wp-includes/load.php index 9d247baa..d6345c76 100644 --- a/wp-includes/load.php +++ b/wp-includes/load.php @@ -473,7 +473,7 @@ function wp_start_object_cache() { wp_cache_init(); if ( function_exists( 'wp_cache_add_global_groups' ) ) { - wp_cache_add_global_groups( array( 'users', 'userlogins', 'usermeta', 'user_meta', 'useremail', 'userslugs', 'site-transient', 'site-options', 'site-lookup', 'blog-lookup', 'blog-details', 'rss', 'global-posts', 'blog-id-cache' ) ); + wp_cache_add_global_groups( array( 'users', 'userlogins', 'usermeta', 'user_meta', 'useremail', 'userslugs', 'site-transient', 'site-options', 'site-lookup', 'blog-lookup', 'blog-details', 'rss', 'global-posts', 'blog-id-cache', 'networks' ) ); wp_cache_add_non_persistent_groups( array( 'comment', 'counts', 'plugins' ) ); } } diff --git a/wp-includes/ms-blogs.php b/wp-includes/ms-blogs.php index 84f63ed7..0701f17f 100644 --- a/wp-includes/ms-blogs.php +++ b/wp-includes/ms-blogs.php @@ -654,7 +654,7 @@ function switch_to_blog( $new_blog, $deprecated = null ) { if ( is_array( $global_groups ) ) { wp_cache_add_global_groups( $global_groups ); } else { - wp_cache_add_global_groups( array( 'users', 'userlogins', 'usermeta', 'user_meta', 'useremail', 'userslugs', 'site-transient', 'site-options', 'site-lookup', 'blog-lookup', 'blog-details', 'rss', 'global-posts', 'blog-id-cache' ) ); + wp_cache_add_global_groups( array( 'users', 'userlogins', 'usermeta', 'user_meta', 'useremail', 'userslugs', 'site-transient', 'site-options', 'site-lookup', 'blog-lookup', 'blog-details', 'rss', 'global-posts', 'blog-id-cache', 'networks' ) ); } wp_cache_add_non_persistent_groups( array( 'comment', 'counts', 'plugins' ) ); } @@ -725,7 +725,7 @@ function restore_current_blog() { if ( is_array( $global_groups ) ) { wp_cache_add_global_groups( $global_groups ); } else { - wp_cache_add_global_groups( array( 'users', 'userlogins', 'usermeta', 'user_meta', 'useremail', 'userslugs', 'site-transient', 'site-options', 'site-lookup', 'blog-lookup', 'blog-details', 'rss', 'global-posts', 'blog-id-cache' ) ); + wp_cache_add_global_groups( array( 'users', 'userlogins', 'usermeta', 'user_meta', 'useremail', 'userslugs', 'site-transient', 'site-options', 'site-lookup', 'blog-lookup', 'blog-details', 'rss', 'global-posts', 'blog-id-cache', 'networks' ) ); } wp_cache_add_non_persistent_groups( array( 'comment', 'counts', 'plugins' ) ); } diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php index 88d14405..3159b37e 100644 --- a/wp-includes/pluggable.php +++ b/wp-includes/pluggable.php @@ -1333,7 +1333,8 @@ function wp_validate_redirect($location, $default = '') { // In php 5 parse_url may fail if the URL query part contains http://, bug #38143 $test = ( $cut = strpos($location, '?') ) ? substr( $location, 0, $cut ) : $location; - $lp = parse_url($test); + // @-operator is used to prevent possible warnings in PHP < 5.3.3. + $lp = @parse_url($test); // Give up if malformed URL if ( false === $lp ) @@ -1343,9 +1344,17 @@ function wp_validate_redirect($location, $default = '') { if ( isset($lp['scheme']) && !('http' == $lp['scheme'] || 'https' == $lp['scheme']) ) return $default; - // Reject if scheme is set but host is not. This catches urls like https:host.com for which parse_url does not set the host field. - if ( isset($lp['scheme']) && !isset($lp['host']) ) + // Reject if certain components are set but host is not. This catches urls like https:host.com for which parse_url does not set the host field. + if ( ! isset( $lp['host'] ) && ( isset( $lp['scheme'] ) || isset( $lp['user'] ) || isset( $lp['pass'] ) || isset( $lp['port'] ) ) ) { return $default; + } + + // Reject malformed components parse_url() can return on odd inputs + foreach ( array( 'user', 'pass', 'host' ) as $component ) { + if ( isset( $lp[ $component ] ) && strpbrk( $lp[ $component ], ':/?#@' ) ) { + return $default; + } + } $wpp = parse_url(home_url()); diff --git a/wp-includes/query.php b/wp-includes/query.php index 9460d324..b4aae270 100644 --- a/wp-includes/query.php +++ b/wp-includes/query.php @@ -2300,7 +2300,7 @@ class WP_Query { $like = '%' . $wpdb->esc_like( $q['s'] ) . '%'; } - $search_orderby = '(CASE '; + $search_orderby = ''; // sentence match in 'post_title' if ( $like ) { @@ -2321,7 +2321,10 @@ class WP_Query { if ( $like ) { $search_orderby .= $wpdb->prepare( "WHEN $wpdb->posts.post_content LIKE %s THEN 4 ", $like ); } - $search_orderby .= 'ELSE 5 END)'; + + if ( $search_orderby ) { + $search_orderby = '(CASE ' . $search_orderby . 'ELSE 5 END)'; + } } else { // single word or sentence search $search_orderby = reset( $q['search_orderby_title'] ) . ' DESC'; @@ -4981,16 +4984,11 @@ class WP_Query { * * @global WP_Query $wp_query Global WP_Query instance. * @global wpdb $wpdb WordPress database abstraction object. - * @global WP_Rewrite $wp_rewrite WordPress rewrite component. */ function wp_old_slug_redirect() { - global $wp_query, $wp_rewrite; - - if ( get_queried_object() ) { - return; - } + global $wp_query; - if ( '' !== $wp_query->query_vars['name'] ) : + if ( is_404() && '' !== $wp_query->query_vars['name'] ) : global $wpdb; // Guess the current post_type based on the query vars. @@ -5032,19 +5030,10 @@ function wp_old_slug_redirect() { $link = get_permalink( $id ); - if ( is_feed() ) { - $link = user_trailingslashit( trailingslashit( $link ) . 'feed' ); - } elseif ( isset( $GLOBALS['wp_query']->query_vars['paged'] ) && $GLOBALS['wp_query']->query_vars['paged'] > 1 ) { + if ( isset( $GLOBALS['wp_query']->query_vars['paged'] ) && $GLOBALS['wp_query']->query_vars['paged'] > 1 ) { $link = user_trailingslashit( trailingslashit( $link ) . 'page/' . $GLOBALS['wp_query']->query_vars['paged'] ); } elseif( is_embed() ) { $link = user_trailingslashit( trailingslashit( $link ) . 'embed' ); - } elseif ( is_404() ) { - // Add rewrite endpoints if necessary. - foreach ( $wp_rewrite->endpoints as $endpoint ) { - if ( $endpoint[2] && false !== get_query_var( $endpoint[2], false ) ) { - $link = user_trailingslashit( trailingslashit( $link ) . $endpoint[1] ); - } - } } /** diff --git a/wp-includes/random_compat/random.php b/wp-includes/random_compat/random.php index 8898a35b..f6ffc54f 100644 --- a/wp-includes/random_compat/random.php +++ b/wp-includes/random_compat/random.php @@ -56,7 +56,7 @@ if (PHP_VERSION_ID < 70000) { * * See ERRATA.md for our reasoning behind this particular order */ - if (extension_loaded('libsodium')) { + if (PHP_VERSION_ID >= 50300 && extension_loaded('libsodium') && function_exists('\\Sodium\\randombytes_buf')) { // See random_bytes_libsodium.php require_once $RandomCompatDIR.'/random_bytes_libsodium.php'; } diff --git a/wp-includes/taxonomy.php b/wp-includes/taxonomy.php index 6c2a29ce..c6d3b6e2 100644 --- a/wp-includes/taxonomy.php +++ b/wp-includes/taxonomy.php @@ -3646,7 +3646,7 @@ function update_object_term_cache($object_ids, $object_type) { function update_term_cache( $terms, $taxonomy = '' ) { foreach ( (array) $terms as $term ) { // Create a copy in case the array was passed by reference. - $_term = $term; + $_term = clone $term; // Object ID should not be cached. unset( $_term->object_id ); diff --git a/wp-includes/version.php b/wp-includes/version.php index 93741f09..97ffadc2 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.4.1'; +$wp_version = '4.4.2'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

- Version 4.4.1 + Version 4.4.2

-
Version 4.4.1 +
Version 4.4.2