From febc815b2c9d85be5717da9e8d164bd2daa97e31 Mon Sep 17 00:00:00 2001 From: "Edward Z. Yang" Date: Thu, 26 Jan 2017 15:07:44 -0800 Subject: [PATCH] WordPress 4.6.3 Signed-off-by: Edward Z. Yang --- readme.html | 2 +- wp-admin/about.php | 3 + .../includes/class-wp-posts-list-table.php | 2 +- wp-admin/includes/class-wp-press-this.php | 98 +++++++++++++------ wp-includes/query.php | 11 ++- wp-includes/version.php | 2 +- 6 files changed, 80 insertions(+), 38 deletions(-) diff --git a/readme.html b/readme.html index b3ef5008..c4dee181 100644 --- a/readme.html +++ b/readme.html @@ -9,7 +9,7 @@

WordPress -
Version 4.6.2 +
Version 4.6.3

Semantic Personal Publishing Platform

diff --git a/wp-admin/about.php b/wp-admin/about.php index f43006c7..5cb979df 100644 --- a/wp-admin/about.php +++ b/wp-admin/about.php @@ -60,6 +60,9 @@ include( ABSPATH . 'wp-admin/admin-header.php' );

+

Version %s addressed some security issues.' ), '4.6.3' ); ?> + the release notes.' ), 'https://codex.wordpress.org/Version_4.6.3' ); ?> +

Version %s addressed some security issues.' ), '4.6.2' ); ?> the release notes.' ), 'https://codex.wordpress.org/Version_4.6.2' ); ?>

diff --git a/wp-admin/includes/class-wp-posts-list-table.php b/wp-admin/includes/class-wp-posts-list-table.php index 7ef790e3..39c2d682 100644 --- a/wp-admin/includes/class-wp-posts-list-table.php +++ b/wp-admin/includes/class-wp-posts-list-table.php @@ -939,7 +939,7 @@ class WP_Posts_List_Table extends WP_List_Table { } if ( ! is_post_type_hierarchical( $this->screen->post_type ) && 'excerpt' === $mode && current_user_can( 'read_post', $post->ID ) ) { - the_excerpt(); + echo esc_html( get_the_excerpt() ); } get_inline_data( $post ); diff --git a/wp-admin/includes/class-wp-press-this.php b/wp-admin/includes/class-wp-press-this.php index a00bbaa4..e4e03c7c 100644 --- a/wp-admin/includes/class-wp-press-this.php +++ b/wp-admin/includes/class-wp-press-this.php @@ -119,10 +119,28 @@ class WP_Press_This { 'post_type' => 'post', 'post_status' => 'draft', 'post_format' => ( ! empty( $_POST['post_format'] ) ) ? sanitize_text_field( $_POST['post_format'] ) : '', - 'tax_input' => ( ! empty( $_POST['tax_input'] ) ) ? $_POST['tax_input'] : array(), - 'post_category' => ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array(), ); + // Only accept categories if the user actually can assign + $category_tax = get_taxonomy( 'category' ); + if ( current_user_can( $category_tax->cap->assign_terms ) ) { + $post_data['post_category'] = ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array(); + } + + // Only accept taxonomies if the user can actually assign + if ( ! empty( $_POST['tax_input'] ) ) { + $tax_input = $_POST['tax_input']; + foreach ( $tax_input as $tax => $_ti ) { + $tax_object = get_taxonomy( $tax ); + if ( ! $tax_object || ! current_user_can( $tax_object->cap->assign_terms ) ) { + unset( $tax_input[ $tax ] ); + } + } + + $post_data['tax_input'] = $tax_input; + } + + // Toggle status to pending if user cannot actually publish if ( ! empty( $_POST['post_status'] ) && 'publish' === $_POST['post_status'] ) { if ( current_user_can( 'publish_posts' ) ) { $post_data['post_status'] = 'publish'; @@ -455,7 +473,7 @@ class WP_Press_This { * @since 4.2.0 * * @param string $src Embed source URL. - * @return string If not from a supported provider, an empty string. Otherwise, a reformattd embed URL. + * @return string If not from a supported provider, an empty string. Otherwise, a reformatted embed URL. */ private function _limit_embed( $src ) { $src = $this->_limit_url( $src ); @@ -856,6 +874,12 @@ class WP_Press_This { public function categories_html( $post ) { $taxonomy = get_taxonomy( 'category' ); + // Bail if user cannot assign terms + if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) { + return; + } + + // Only show "add" if user can edit terms if ( current_user_can( $taxonomy->cap->edit_terms ) ) { ?> - - - + + + + + + +
@@ -1449,23 +1483,27 @@ class WP_Press_This { - + + + - + + + diff --git a/wp-includes/query.php b/wp-includes/query.php index c5c1ae65..053bd4ca 100644 --- a/wp-includes/query.php +++ b/wp-includes/query.php @@ -3069,14 +3069,15 @@ class WP_Query { if ( 'any' == $post_type ) { $in_search_post_types = get_post_types( array('exclude_from_search' => false) ); - if ( empty( $in_search_post_types ) ) + if ( empty( $in_search_post_types ) ) { $where .= ' AND 1=0 '; - else - $where .= " AND $wpdb->posts.post_type IN ('" . join("', '", $in_search_post_types ) . "')"; + } else { + $where .= " AND {$wpdb->posts}.post_type IN ('" . join( "', '", array_map( 'esc_sql', $in_search_post_types ) ) . "')"; + } } elseif ( !empty( $post_type ) && is_array( $post_type ) ) { - $where .= " AND $wpdb->posts.post_type IN ('" . join("', '", $post_type) . "')"; + $where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", esc_sql( $post_type ) ) . "')"; } elseif ( ! empty( $post_type ) ) { - $where .= " AND $wpdb->posts.post_type = '$post_type'"; + $where .= $wpdb->prepare( " AND {$wpdb->posts}.post_type = %s", $post_type ); $post_type_object = get_post_type_object ( $post_type ); } elseif ( $this->is_attachment ) { $where .= " AND $wpdb->posts.post_type = 'attachment'"; diff --git a/wp-includes/version.php b/wp-includes/version.php index 8c11d3ea..cf059184 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.6.2'; +$wp_version = '4.6.3'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. -- 2.44.0