mirror_php/wordpress
1
0
Fork 0
mirror of git://develop.git.wordpress.org/ synced 2025-01-17 04:48:25 +01:00
Code Issues Actions 98 Packages Projects Releases Wiki Activity

Grouped Backports to the 5.9 branch.

Browse Source 
- Editor: Fix Path Traversal issue on Windows in Template-Part Block.
- Editor: Sanitize Template Part HTML tag on save.

Merges [58470], [58471], [58472] and [58473] to the 5.9 branch.
Props xknown, peterwilsoncc, jorbin, bernhard-reiter, azaozz.




git-svn-id: https://develop.svn.wordpress.org/branches/5.9@58483 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Jb Audras 2024-06-24 15:23:25 +00:00
parent bf285e8f9a
commit 81d6e9e5f7
6 changed files with 105 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

122
package-lock.json generated
View File

@ -2959,7 +2959,7 @@
"@types/json5": {
"version": "0.0.29",
"resolved": "https://registry.npmjs.org/@types/json5/-/json5-0.0.29.tgz",
"integrity": "sha1-7ihweulOEdK4J7y+UnC86n8+ce4=",
"integrity": "sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==",
"dev": true
},
"@types/lodash": {
@ -3723,9 +3723,9 @@
}
},
"@wordpress/block-directory": {
"version": "3.0.30",
"resolved": "https://registry.npmjs.org/@wordpress/block-directory/-/block-directory-3.0.30.tgz",
"integrity": "sha512-SYSR7LHYZq1sTSKQh2xv6Z6g7DEAMzfNqjpUPnm5s2UkA59RKR7+J3cVTYcSAs/7WNl/QH91B345YUORe/Y7DQ==",
"version": "3.0.32",
"resolved": "https://registry.npmjs.org/@wordpress/block-directory/-/block-directory-3.0.32.tgz",
"integrity": "sha512-T5rNgTfzWRknbh3ENAwXYKImrhnuwys8vI1QEaMgkYlkTVsYbKX/+lX3Vypq3NGVhKKDbhATLQGTbxQRc/IdGg==",
"requires": {
"@babel/runtime": "^7.16.0",
"@wordpress/a11y": "^3.2.4",
@ -3736,7 +3736,7 @@
"@wordpress/compose": "^5.0.7",
"@wordpress/core-data": "^4.0.11",
"@wordpress/data": "^6.1.5",
"@wordpress/edit-post": "^5.0.30",
"@wordpress/edit-post": "^5.0.32",
"@wordpress/editor": "^12.0.22",
"@wordpress/element": "^4.0.4",
"@wordpress/hooks": "^3.2.2",
@ -3797,9 +3797,9 @@
}
},
"@wordpress/block-library": {
"version": "6.0.30",
"resolved": "https://registry.npmjs.org/@wordpress/block-library/-/block-library-6.0.30.tgz",
"integrity": "sha512-mXG4a5kH9mHQ9JtkbSyOABdK0KfbNCs+s2HzlAQ82DqSNnwKuYqQKYjpBgdD3cyLk7CIZTjz02wxMAc+p/qqNw==",
"version": "6.0.31",
"resolved": "https://registry.npmjs.org/@wordpress/block-library/-/block-library-6.0.31.tgz",
"integrity": "sha512-gA1Um2sfAN1lV+dZ7w0QkK0/L3RxBQe+wUJw82Mrryswou4k3izXqhgZaOaOOjPivuvgmxu9K3RyTAqf62FZtg==",
"requires": {
"@babel/runtime": "^7.16.0",
"@wordpress/a11y": "^3.2.4",
@ -3978,14 +3978,14 @@
}
},
"@wordpress/customize-widgets": {
"version": "2.0.31",
"resolved": "https://registry.npmjs.org/@wordpress/customize-widgets/-/customize-widgets-2.0.31.tgz",
"integrity": "sha512-VkJww51L5NI3qjrw7p+pcUWKWie3Z7sNfyGMBUUuCDZxMHJMl8fb5k5IFJxFgV0nyesG8EVEexpiI7xqIlQ/lw==",
"version": "2.0.32",
"resolved": "https://registry.npmjs.org/@wordpress/customize-widgets/-/customize-widgets-2.0.32.tgz",
"integrity": "sha512-CRjEiai7ryBs7E3IEciFk/N5Xz/B+hON68TYzzFzyjFfltIh6M8eNCevgFIG0itp63yfaV5qmM1ifVhkrkkBcA==",
"requires": {
"@babel/runtime": "^7.16.0",
"@wordpress/a11y": "^3.2.4",
"@wordpress/block-editor": "^8.0.18",
"@wordpress/block-library": "^6.0.30",
"@wordpress/block-library": "^6.0.31",
"@wordpress/blocks": "^11.1.5",
"@wordpress/components": "^19.2.3",
"@wordpress/compose": "^5.0.7",
@ -4130,15 +4130,15 @@
}
},
"@wordpress/edit-post": {
"version": "5.0.31",
"resolved": "https://registry.npmjs.org/@wordpress/edit-post/-/edit-post-5.0.31.tgz",
"integrity": "sha512-/FJ8OytoFoQBvIciLjL6SH31dE/nV5ir3FFrlaDu/+SMV8nKBH2gGS0BD7bTjqyhRXz9wQ0M+ivNPgVBsj2HGw==",
"version": "5.0.32",
"resolved": "https://registry.npmjs.org/@wordpress/edit-post/-/edit-post-5.0.32.tgz",
"integrity": "sha512-qQ6/yOHqz/NwjkwYy6AD9IhM416LoU7FZ+Nf+Elooy/kl+QUZajcngMz5FXXVJgEZ94+5tAcTQdMc9u+dExMQA==",
"requires": {
"@babel/runtime": "^7.16.0",
"@wordpress/a11y": "^3.2.4",
"@wordpress/api-fetch": "^5.2.7",
"@wordpress/block-editor": "^8.0.18",
"@wordpress/block-library": "^6.0.30",
"@wordpress/block-library": "^6.0.31",
"@wordpress/blocks": "^11.1.5",
"@wordpress/components": "^19.2.3",
"@wordpress/compose": "^5.0.7",
@ -4175,15 +4175,15 @@
}
},
"@wordpress/edit-site": {
"version": "3.0.31",
"resolved": "https://registry.npmjs.org/@wordpress/edit-site/-/edit-site-3.0.31.tgz",
"integrity": "sha512-BQw1vlrvhlfn4quTu3F208U8a4rWjW/+TqrRe41N31TmrCrQZgqgPJRBKvE3ypYncTd9zL6zKunmXy7XC5Yzdw==",
"version": "3.0.32",
"resolved": "https://registry.npmjs.org/@wordpress/edit-site/-/edit-site-3.0.32.tgz",
"integrity": "sha512-dpDgJeWxqCGO6Un7UrhnF7geBDGtyXQ1TIA4aehRIQobvrnaCUyOyRc+R5i6uJQ+1P+YO7zgmCJtW5SCxPl01Q==",
"requires": {
"@babel/runtime": "^7.16.0",
"@wordpress/a11y": "^3.2.4",
"@wordpress/api-fetch": "^5.2.7",
"@wordpress/block-editor": "^8.0.18",
"@wordpress/block-library": "^6.0.30",
"@wordpress/block-library": "^6.0.31",
"@wordpress/blocks": "^11.1.5",
"@wordpress/components": "^19.2.3",
"@wordpress/compose": "^5.0.7",
@ -4216,15 +4216,15 @@
}
},
"@wordpress/edit-widgets": {
"version": "3.1.26",
"resolved": "https://registry.npmjs.org/@wordpress/edit-widgets/-/edit-widgets-3.1.26.tgz",
"integrity": "sha512-rdYG1kprYZqxlSle2Wd8FE/+XxqQWm1PfLYGAuXTHG2ywtb6yU9D+T+VdDJPiOGc51moogFD+vbCLnHpXrLYUw==",
"version": "3.1.27",
"resolved": "https://registry.npmjs.org/@wordpress/edit-widgets/-/edit-widgets-3.1.27.tgz",
"integrity": "sha512-qkbrvmuVw+SRAoQkosufvcg/JNCKrWXXds2V4U2Z9neQ0eshpFETawdqsrAVvyK4sTvy2nzcgB9NpWl/GoX8Bw==",
"requires": {
"@babel/runtime": "^7.16.0",
"@wordpress/a11y": "^3.2.4",
"@wordpress/api-fetch": "^5.2.7",
"@wordpress/block-editor": "^8.0.18",
"@wordpress/block-library": "^6.0.30",
"@wordpress/block-library": "^6.0.31",
"@wordpress/blocks": "^11.1.5",
"@wordpress/components": "^19.2.3",
"@wordpress/compose": "^5.0.7",
@ -8652,7 +8652,7 @@
"clone-deep": {
"version": "0.2.4",
"resolved": "https://registry.npmjs.org/clone-deep/-/clone-deep-0.2.4.tgz",
"integrity": "sha1-TnPdCen7lxzDhnDF3O2cGJZIHMY=",
"integrity": "sha512-we+NuQo2DHhSl+DP6jlUiAhyAjBQrYnpOk15rN6c6JSPScjiCLh8IbSU+VTcph6YS3o7mASE8a0+gbZ7ChLpgg==",
"dev": true,
"requires": {
"for-own": "^0.1.3",
@ -8684,7 +8684,7 @@
"co": {
"version": "4.6.0",
"resolved": "https://registry.npmjs.org/co/-/co-4.6.0.tgz",
"integrity": "sha1-bqa989hTrlTMuOR7+gvz+QMfsYQ=",
"integrity": "sha512-QVb0dM5HvG+uaxitm8wONl7jltx8dqhfU33DcqtOZcLSVIKSDDLDi7+0LbAKiyI8hD9u42m2YxXSkMGWThaecQ==",
"dev": true
},
"coa": {
@ -8876,7 +8876,7 @@
"computed-style": {
"version": "0.1.4",
"resolved": "https://registry.npmjs.org/computed-style/-/computed-style-0.1.4.tgz",
"integrity": "sha1-fzRP2FhLLkJb7cpKGvwOMAuwXXQ="
"integrity": "sha512-WpAmaKbMNmS3OProfHIdJiNleNJdgUrJfbKArXua28QF7+0CoZjlLn0lp6vlc+dl5r2/X9GQiQRQQU4BzSa69w=="
},
"concat-map": {
"version": "0.0.1",
@ -9653,7 +9653,7 @@
"cwd": {
"version": "0.10.0",
"resolved": "https://registry.npmjs.org/cwd/-/cwd-0.10.0.tgz",
"integrity": "sha1-FyQAaUBXwioTsM8WFix+S3p/5Wc=",
"integrity": "sha512-YGZxdTTL9lmLkCUTpg4j0zQ7IhRB5ZmqNBbGCl3Tg6MP/d5/6sY7L5mmTjzbc6JKgVZYiqTQTNhPFsbXNGlRaA==",
"dev": true,
"requires": {
"find-pkg": "^0.1.2",
@ -11899,7 +11899,7 @@
"expand-tilde": {
"version": "1.2.2",
"resolved": "https://registry.npmjs.org/expand-tilde/-/expand-tilde-1.2.2.tgz",
"integrity": "sha1-C4HrqJflo9MdHD0QL48BRB5VlEk=",
"integrity": "sha512-rtmc+cjLZqnu9dSYosX9EWmSJhTwpACgJQTfj4hgg2JjOD/6SIQalZrt4a3aQeh++oNxkazcaxrhPUj6+g5G/Q==",
"dev": true,
"requires": {
"os-homedir": "^1.0.1"
@ -12277,7 +12277,7 @@
"fast-levenshtein": {
"version": "2.0.6",
"resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
"integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
"integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
"dev": true
},
"fast-memoize": {
@ -12480,7 +12480,7 @@
"find-file-up": {
"version": "0.1.3",
"resolved": "https://registry.npmjs.org/find-file-up/-/find-file-up-0.1.3.tgz",
"integrity": "sha1-z2gJG8+fMApA2kEbN9pczlovvqA=",
"integrity": "sha512-mBxmNbVyjg1LQIIpgO8hN+ybWBgDQK8qjht+EbrTCGmmPV/sc7RF1i9stPTD6bpvXZywBdrwRYxhSdJv867L6A==",
"dev": true,
"requires": {
"fs-exists-sync": "^0.1.0",
@ -12496,7 +12496,7 @@
"find-pkg": {
"version": "0.1.2",
"resolved": "https://registry.npmjs.org/find-pkg/-/find-pkg-0.1.2.tgz",
"integrity": "sha1-G9wiwG42NlUy4qJIBGhUuXiNpVc=",
"integrity": "sha512-0rnQWcFwZr7eO0513HahrWafsc3CTFioEB7DRiEYCUM/70QXSY8f3mCST17HXLcPvEhzH/Ty/Bxd72ZZsr/yvw==",
"dev": true,
"requires": {
"find-file-up": "^0.1.2"
@ -12633,7 +12633,7 @@
"for-own": {
"version": "0.1.5",
"resolved": "https://registry.npmjs.org/for-own/-/for-own-0.1.5.tgz",
"integrity": "sha1-UmXGgaTylNq78XyVCbZ2OqhFEM4=",
"integrity": "sha512-SKmowqGTJoPzLO1T0BBJpkfp3EMacCMOuH40hOUbrbzElVktk4DioXVM99QkLCyKoiuOmyjgcWMpVz2xjE7LZw==",
"dev": true,
"requires": {
"for-in": "^1.0.1"
@ -12756,7 +12756,7 @@
"fs-exists-sync": {
"version": "0.1.0",
"resolved": "https://registry.npmjs.org/fs-exists-sync/-/fs-exists-sync-0.1.0.tgz",
"integrity": "sha1-mC1ok6+RjnLQjeyehnP/K1qNat0=",
"integrity": "sha512-cR/vflFyPZtrN6b38ZyWxpWdhlXrzZEBawlpBQMq7033xVY7/kg0GDMBK5jg8lDYQckdJ5x/YC88lM3C7VMsLg==",
"dev": true
},
"fs-extra": {
@ -13099,7 +13099,7 @@
"global-modules": {
"version": "0.2.3",
"resolved": "https://registry.npmjs.org/global-modules/-/global-modules-0.2.3.tgz",
"integrity": "sha1-6lo77ULG1s6ZWk+KEmm12uIjgo0=",
"integrity": "sha512-JeXuCbvYzYXcwE6acL9V2bAOeSIGl4dD+iwLY9iUx2VBJJ80R18HCn+JCwHM9Oegdfya3lEkGCdaRkSyc10hDA==",
"dev": true,
"requires": {
"global-prefix": "^0.1.4",
@ -13109,7 +13109,7 @@
"is-windows": {
"version": "0.2.0",
"resolved": "https://registry.npmjs.org/is-windows/-/is-windows-0.2.0.tgz",
"integrity": "sha1-3hqm1j6indJIc3tp8f+LgALSEIw=",
"integrity": "sha512-n67eJYmXbniZB7RF4I/FTjK1s6RPOCTxhYrVYLRaCt3lF0mpWZPKr3T2LSZAqyjQsxR2qMmGYXXzK0YWwcPM1Q==",
"dev": true
}
}
@ -13117,7 +13117,7 @@
"global-prefix": {
"version": "0.1.5",
"resolved": "https://registry.npmjs.org/global-prefix/-/global-prefix-0.1.5.tgz",
"integrity": "sha1-jTvGuNo8qBEqFg2NSW/wRiv+948=",
"integrity": "sha512-gOPiyxcD9dJGCEArAhF4Hd0BAqvAe/JzERP7tYumE4yIkmIedPUVXcJFWbV3/p/ovIIvKjkrTk+f1UVkq7vvbw==",
"dev": true,
"requires": {
"homedir-polyfill": "^1.0.0",
@ -13129,7 +13129,7 @@
"is-windows": {
"version": "0.2.0",
"resolved": "https://registry.npmjs.org/is-windows/-/is-windows-0.2.0.tgz",
"integrity": "sha1-3hqm1j6indJIc3tp8f+LgALSEIw=",
"integrity": "sha512-n67eJYmXbniZB7RF4I/FTjK1s6RPOCTxhYrVYLRaCt3lF0mpWZPKr3T2LSZAqyjQsxR2qMmGYXXzK0YWwcPM1Q==",
"dev": true
},
"which": {
@ -13179,7 +13179,7 @@
"globjoin": {
"version": "0.1.4",
"resolved": "https://registry.npmjs.org/globjoin/-/globjoin-0.1.4.tgz",
"integrity": "sha1-L0SUrIkZ43Z8XLtpHp9GMyQoXUM=",
"integrity": "sha512-xYfnw62CKG8nLkZBfWbhWwDw02CHty86jfPcc2cr3ZfeuK9ysoVPPEUxf21bAD/rWAgk52SuBrLJlefNy8mvFg==",
"dev": true
},
"globrex": {
@ -13262,7 +13262,7 @@
"gradient-parser": {
"version": "0.1.5",
"resolved": "https://registry.npmjs.org/gradient-parser/-/gradient-parser-0.1.5.tgz",
"integrity": "sha1-DH4heVWeXOfY1x9EI6+TcQCyJIw="
"integrity": "sha512-+uPlcVbjrKOnTzvz0MjTj7BfACj8OmxIa1moIjJV7btvhUMSJk0D47RfDCgDrZE3dYMz9Cf5xKJwnrKLjUq0KQ=="
},
"growly": {
"version": "1.3.0",
@ -17186,7 +17186,7 @@
"json-stable-stringify-without-jsonify": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
"integrity": "sha1-nbe1lJatPzz+8wp1FC0tkwrXJlE=",
"integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
"dev": true
},
"json-stringify-safe": {
@ -17689,7 +17689,7 @@
"line-height": {
"version": "0.3.1",
"resolved": "https://registry.npmjs.org/line-height/-/line-height-0.3.1.tgz",
"integrity": "sha1-SxIF7d4YKHKl76PI9iCzGHqcVMk=",
"integrity": "sha512-YExecgqPwnp5gplD2+Y8e8A5+jKpr25+DzMbFdI1/1UAr0FJrTFv4VkHLf8/6B590i1wUPJWMKKldkd/bdQ//w==",
"requires": {
"computed-style": "~0.1.3"
}
@ -17787,7 +17787,7 @@
"lodash.debounce": {
"version": "4.0.8",
"resolved": "https://registry.npmjs.org/lodash.debounce/-/lodash.debounce-4.0.8.tgz",
"integrity": "sha1-gteb/zCmfEAF/9XiUVMArZyk168=",
"integrity": "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==",
"dev": true
},
"lodash.differencewith": {
@ -17847,7 +17847,7 @@
"lodash.truncate": {
"version": "4.4.2",
"resolved": "https://registry.npmjs.org/lodash.truncate/-/lodash.truncate-4.4.2.tgz",
"integrity": "sha1-WjUNoLERO4N+z//VgSy+WNbq4ZM=",
"integrity": "sha512-jttmRe7bRse52OsWIMDLaXxWqRAmtIUccAQ3garviCqJjafXOfNMO0yMfNpdD6zbGaTU0P5Nz7e7gAT6cKmJRw==",
"dev": true
},
"lodash.uniq": {
@ -18711,7 +18711,7 @@
"mixin-object": {
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/mixin-object/-/mixin-object-2.0.1.tgz",
"integrity": "sha1-T7lJRB2rGCVA8f4DW6YOGUel5X4=",
"integrity": "sha512-ALGF1Jt9ouehcaXaHhn6t1yGWRqGaHkPFndtFVHfZXOvkIZ/yoGaSi0AHVTafb3ZBGg4dr/bDwnaEKqCXzchMA==",
"dev": true,
"requires": {
"for-in": "^0.1.3",
@ -18721,7 +18721,7 @@
"for-in": {
"version": "0.1.8",
"resolved": "https://registry.npmjs.org/for-in/-/for-in-0.1.8.tgz",
"integrity": "sha1-2Hc5COMSVhCZUrH9ubP6hn0ndeE=",
"integrity": "sha512-F0to7vbBSHP8E3l6dCjxNOLuSFAACIxFy3UehTUlG7svlXi37HHsDkyVcHo0Pq8QwrE+pXvWSVX3ZT1T9wAZ9g==",
"dev": true
}
}
@ -18868,7 +18868,7 @@
"natural-compare": {
"version": "1.4.0",
"resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
"integrity": "sha1-Sr6/7tdUHywnrPspvbvRXI1bpPc=",
"integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
"dev": true
},
"nearley": {
@ -18968,7 +18968,7 @@
"node-int64": {
"version": "0.4.0",
"resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
"integrity": "sha1-h6kGXNs1XTGC2PlM4RGIuCXGijs=",
"integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
"dev": true
},
"node-libs-browser": {
@ -19115,7 +19115,7 @@
"normalize-wheel": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/normalize-wheel/-/normalize-wheel-1.0.1.tgz",
"integrity": "sha1-rsiGr/2wRQcNhWRH32Ls+GFG7EU="
"integrity": "sha512-1OnlAPZ3zgrk8B91HyRj+eVv+kS5u+Z0SCsak6Xil/kmgEia50ga7zfkumayonZrImffAxPU/5WcyGhzetHNPA=="
},
"npm-conf": {
"version": "1.1.3",
@ -20791,7 +20791,7 @@
"postcss-media-query-parser": {
"version": "0.2.3",
"resolved": "https://registry.npmjs.org/postcss-media-query-parser/-/postcss-media-query-parser-0.2.3.tgz",
"integrity": "sha1-J7Ocb02U+Bsac7j3Y1HGCeXO8kQ=",
"integrity": "sha512-3sOlxmbKcSHMjlUXQZKQ06jOswE7oVkXPxmZdoB1r5l0q6gTFTQSHxNxOrCccElbW7dxNytifNEo8qidX2Vsig==",
"dev": true
},
"postcss-merge-longhand": {
@ -21082,7 +21082,7 @@
"postcss-resolve-nested-selector": {
"version": "0.1.1",
"resolved": "https://registry.npmjs.org/postcss-resolve-nested-selector/-/postcss-resolve-nested-selector-0.1.1.tgz",
"integrity": "sha1-Kcy8fDfe36wwTp//C/FZaz9qDk4=",
"integrity": "sha512-HvExULSwLqHLgUy1rl3ANIqCsvMS0WHss2UOsXhXnQaZ9VCc2oBvIpXrl00IUFT5ZDITME0o6oiXeiHr2SAIfw==",
"dev": true
},
"postcss-safe-parser": {
@ -22544,7 +22544,7 @@
"resolve-dir": {
"version": "0.1.1",
"resolved": "https://registry.npmjs.org/resolve-dir/-/resolve-dir-0.1.1.tgz",
"integrity": "sha1-shklmlYC+sXFxJatiUpujMQwJh4=",
"integrity": "sha512-QxMPqI6le2u0dCLyiGzgy92kjkkL6zO0XyvHzjdTNH3zM6e5Hz3BwG6+aEyNgiQ5Xz6PwTwgQEj3U50dByPKIA==",
"dev": true,
"requires": {
"expand-tilde": "^1.2.2",
@ -22750,7 +22750,7 @@
"rungen": {
"version": "0.3.2",
"resolved": "https://registry.npmjs.org/rungen/-/rungen-0.3.2.tgz",
"integrity": "sha1-QAwJ6+kU57F+C27zJjQA/Cq8fLM="
"integrity": "sha512-zWl10xu2D7zoR8zSC2U6bg5bYF6T/Wk7rxwp8IPaJH7f0Ge21G03kNHVgHR7tyVkSSfAOG0Rqf/Cl38JftSmtw=="
},
"rxjs": {
"version": "5.5.12",
@ -23220,7 +23220,7 @@
"shallow-clone": {
"version": "0.1.2",
"resolved": "https://registry.npmjs.org/shallow-clone/-/shallow-clone-0.1.2.tgz",
"integrity": "sha1-WQnodLp3EG1zrEFM/sH/yofZcGA=",
"integrity": "sha512-J1zdXCky5GmNnuauESROVu31MQSnLoYvlyEn6j2Ztk6Q5EHFIhxkMhYcv6vuDzl2XEzoRr856QwzMgWM/TmZgw==",
"dev": true,
"requires": {
"is-extendable": "^0.1.1",
@ -23232,7 +23232,7 @@
"kind-of": {
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/kind-of/-/kind-of-2.0.1.tgz",
"integrity": "sha1-AY7HpM5+OobLkUG+UZ0kyPqpgbU=",
"integrity": "sha512-0u8i1NZ/mg0b+W3MGGw5I7+6Eib2nx72S/QvXa0hYjEkjTknYmEYQJwGu3mLC0BrhtJjtQafTkyRUQ75Kx0LVg==",
"dev": true,
"requires": {
"is-buffer": "^1.0.2"
@ -23241,7 +23241,7 @@
"lazy-cache": {
"version": "0.2.7",
"resolved": "https://registry.npmjs.org/lazy-cache/-/lazy-cache-0.2.7.tgz",
"integrity": "sha1-f+3fLctu23fRHvHRF6tf/fCrG2U=",
"integrity": "sha512-gkX52wvU/R8DVMMt78ATVPFMJqfW8FPz1GZ1sVHBVQHmu/WvhIWE4cE1GBzhJNFicDeYhnwp6Rl35BcAIM3YOQ==",
"dev": true
}
}
@ -24472,7 +24472,7 @@
"strip-bom": {
"version": "3.0.0",
"resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
"integrity": "sha1-IzTBjpx1n3vdVv3vfprj1YjmjtM=",
"integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
"dev": true
},
"strip-dirs": {
@ -24541,7 +24541,7 @@
"style-search": {
"version": "0.1.0",
"resolved": "https://registry.npmjs.org/style-search/-/style-search-0.1.0.tgz",
"integrity": "sha1-eVjHk+R+MuB9K1yv5cC/jhLneQI=",
"integrity": "sha512-Dj1Okke1C3uKKwQcetra4jSuk0DqbzbYtXipzFlFMZtowbF1x7BKJwB9AayVMyFARvU8EDrZdcax4At/452cAg==",
"dev": true
},
"style-value-types": {
@ -25110,7 +25110,7 @@
"svg-tags": {
"version": "1.0.0",
"resolved": "https://registry.npmjs.org/svg-tags/-/svg-tags-1.0.0.tgz",
"integrity": "sha1-WPcc7jvVGbWdSyqEO2x95krAR2Q=",
"integrity": "sha512-ovssysQTa+luh7A5Weu3Rta6FJlFBBbInjOh722LIt6klpU2/HtdUbszju/G4devcvk8PGt7FCLv5wftu3THUA==",
"dev": true
},
"svgo": {
@ -25377,7 +25377,7 @@
"text-table": {
"version": "0.2.0",
"resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
"integrity": "sha1-f17oI66AUgfACvLfSoTsP8+lcLQ=",
"integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw==",
"dev": true
},
"throat": {
@ -25501,7 +25501,7 @@
"to-fast-properties": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
"integrity": "sha1-3F5pjL0HkmW8c+A3doGk5Og/YW4="
"integrity": "sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog=="
},
"to-object-path": {
"version": "0.3.0",

12
package.json
View File

@ -82,24 +82,24 @@
"@wordpress/api-fetch": "5.2.7",
"@wordpress/autop": "3.2.3",
"@wordpress/blob": "3.2.2",
"@wordpress/block-directory": "3.0.30",
"@wordpress/block-directory": "3.0.32",
"@wordpress/block-editor": "8.0.18",
"@wordpress/block-library": "6.0.30",
"@wordpress/block-library": "6.0.31",
"@wordpress/block-serialization-default-parser": "4.2.3",
"@wordpress/blocks": "11.1.5",
"@wordpress/components": "19.2.3",
"@wordpress/compose": "5.0.7",
"@wordpress/core-data": "4.0.11",
"@wordpress/customize-widgets": "2.0.31",
"@wordpress/customize-widgets": "2.0.32",
"@wordpress/data": "6.1.5",
"@wordpress/data-controls": "2.2.9",
"@wordpress/date": "4.2.3",
"@wordpress/deprecated": "3.2.3",
"@wordpress/dom": "3.2.7",
"@wordpress/dom-ready": "3.2.3",
"@wordpress/edit-post": "5.0.31",
"@wordpress/edit-site": "3.0.31",
"@wordpress/edit-widgets": "3.1.26",
"@wordpress/edit-post": "5.0.32",
"@wordpress/edit-site": "3.0.32",
"@wordpress/edit-widgets": "3.1.27",
"@wordpress/editor": "12.0.22",
"@wordpress/element": "4.0.4",
"@wordpress/escape-html": "2.2.3",

36
src/wp-includes/blocks.php
View File

@ -668,7 +668,7 @@ function _filter_block_content_callback( $matches ) {
* @return array The filtered and sanitized block object result.
*/
function filter_block_kses( $block, $allowed_html, $allowed_protocols = array() ) {
$block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols );
$block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols, $block );
if ( is_array( $block['innerBlocks'] ) ) {
foreach ( $block['innerBlocks'] as $i => $inner_block ) {
@ -684,19 +684,25 @@ function filter_block_kses( $block, $allowed_html, $allowed_protocols = array()
* HTML.
*
* @since 5.3.1
* @since 6.5.5 Added the `$block_context` parameter.
*
* @param string[]|string $value The attribute value to filter.
* @param array[]|string $allowed_html An array of allowed HTML elements
* and attributes, or a context name
* such as 'post'.
* @param string[] $allowed_protocols Array of allowed URL protocols.
* @param array $block_context Optional. The block the attribute belongs to, in parsed block array format.
* @return string[]|string The filtered and sanitized result.
*/
function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array() ) {
function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array(), $block_context = null ) {
if ( is_array( $value ) ) {
foreach ( $value as $key => $inner_value ) {
$filtered_key = filter_block_kses_value( $key, $allowed_html, $allowed_protocols );
$filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols );
$filtered_key = filter_block_kses_value( $key, $allowed_html, $allowed_protocols, $block_context );
$filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols, $block_context );
if ( isset( $block_context['blockName'] ) && 'core/template-part' === $block_context['blockName'] ) {
$filtered_value = filter_block_core_template_part_attributes( $filtered_value, $filtered_key, $allowed_html );
}
if ( $filtered_key !== $key ) {
unset( $value[ $key ] );
@ -711,6 +717,28 @@ function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = ar
return $value;
}
/**
* Sanitizes the value of the Template Part block's `tagName` attribute.
*
* @since 6.5.5
*
* @param string $attribute_value The attribute value to filter.
* @param string $attribute_name The attribute name.
* @param array[]|string $allowed_html An array of allowed HTML elements and attributes,
* or a context name such as 'post'. See wp_kses_allowed_html()
* for the list of accepted context names.
* @return string The sanitized attribute value.
*/
function filter_block_core_template_part_attributes( $attribute_value, $attribute_name, $allowed_html ) {
if ( empty( $attribute_value ) || 'tagName' !== $attribute_name ) {
return $attribute_value;
}
if ( ! is_array( $allowed_html ) ) {
$allowed_html = wp_kses_allowed_html( $allowed_html );
}
return isset( $allowed_html[ $attribute_value ] ) ? $attribute_value : '';
}
/**
* Parses blocks out of a content string, and renders those appropriate for the excerpt.
*

2
src/wp-includes/blocks/template-part.php
View File

@ -141,7 +141,7 @@ function render_block_core_template_part( $attributes ) {
global $wp_embed;
$content = $wp_embed->autoembed( $content );
if ( empty( $attributes['tagName'] ) ) {
if ( empty( $attributes['tagName'] ) || tag_escape( $attributes['tagName'] ) !== $attributes['tagName'] ) {
$defined_areas = get_allowed_block_template_part_areas();
$area_tag = 'div';
foreach ( $defined_areas as $defined_area ) {

3
src/wp-includes/formatting.php
View File

@ -4684,12 +4684,13 @@ EOF;
* Escape an HTML tag name.
*
* @since 2.5.0
* @since 6.5.5 Allow hyphens in tag names (i.e. custom elements).
*
* @param string $tag_name
* @return string
*/
function tag_escape( $tag_name ) {
$safe_tag = strtolower( preg_replace( '/[^a-zA-Z0-9_:]/', '', $tag_name ) );
$safe_tag = strtolower( preg_replace( '/[^a-zA-Z0-9-_:]/', '', $tag_name ) );
/**
* Filters a string cleaned and escaped for output as an HTML tag.
*

3
src/wp-includes/functions.php
View File

@ -5904,6 +5904,9 @@ function validate_file( $file, $allowed_files = array() ) {
return 0;
}
// Normalize path for Windows servers
$file = wp_normalize_path( $file );
// `../` on its own is not allowed:
if ( '../' === $file ) {
return 1;