- Update `lodash` to the latest version `4.17.21`.
- Disable some attributes for rich text.
- Use hashed/deterministic moduleIDs in webpack config.
Props ellatrix, peterwilsoncc, get_dave, mcsf, talldanwp, youknowriad, desrosj, nerrad, gziolo.
Merges [50940-50941,50984-50985,51426] to the 5.0 branch.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@51758 602fd350-edb4-49c9-b593-d223f7449a82
* REST API: Allow authors to read their own password protected posts.
* About page update.
Merges [50717] to the 5.0 branch.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@50731 602fd350-edb4-49c9-b593-d223f7449a82
This backports several build and test tool improvements to the 5.0 branch. Most notably, this includes:
- The changes required to allow each workflow to be triggered by the `workflow_dispatch` event so that tests can be run on a schedule [50590].
- Splitting single site and multisite tests into parallel jobs [50379].
- Split slow tests into separate, parallel jobs for PHP <= 5.6 [50444].
- Better branch and path scoping for GitHub Action workflows when running on `pull_request` [50432,50479].
- Several `devDependency` updates.
Merges [45317,50267,50379,50387,50413,50416,50432,50435-50436,50444,50446,50473-50474,50476,50479,50485-50487,50545,50579,50590,50598] to the 5.0 branch.
See #50401, #51801, #51802, #52548, #52608, #52612, #52624, #52625, #52645, #52653, #52658, #52660, #52667.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@50624 602fd350-edb4-49c9-b593-d223f7449a82
This commit merges the workflow files required to run automated testing on GitHub Actions.
In addition, [49836] and [50285] have been included in order to keep the local Docker environment consistent across all branches.
Merges [49162,49168-49169,49175,49204,49227-49228,49244,49369,49371,49548,49781-49784,49786,49836,49938,50268,50285,50298] to the 5.0 branch.
See #50401.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@50307 602fd350-edb4-49c9-b593-d223f7449a82
This updates the 5.0 branch to support the latest LTS version of NodeJS (currently 14.x), allowing the same version to be used across all WordPress branches that receive security updates as a courtesy.
In addition to backporting the package updates that happened after branching 5.0, dependencies that were removed in future releases have also been updated to their latest versions.
Props desrosj, dd32, netweb, jorbin.
Merges [44233,44728,45321,45765,45826,46403-46404,46408,46409,47404,47867-47869,47872-47873,48705,49636,49933,49937,49939,49940,49983,49989,50017,50126,50176,50185,50192] to the 5.0 branch.
See #52341.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@50201 602fd350-edb4-49c9-b593-d223f7449a82
Move `skipTestOnTimeout()` to `WP_UnitTestCase_Base` to avoid duplication.
Merges [46682] and [46996] to the 5.0 branch.
See #51669.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@50095 602fd350-edb4-49c9-b593-d223f7449a82
In [49162], GitHub Action workflow configuration files were introduced to run all of Core’s automated testing with the intent to fully transition after some time was allowed for testing.
After two full months of testing, the time to finish this transition has come.
We thank TravisCI for testing the codebase through nearly 20 major and many more minor releases.
Merges [49876] to the 5.0 branch.
See #52161. See #50401.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@49883 602fd350-edb4-49c9-b593-d223f7449a82
This commit introduces the Docker-based local WordPress development environment to the 5.0 branch and converts the Travis test jobs to utilize this environment for easier and more consistent testing.
Until existing blockers with the PHP 5.2 Docker container can be solved, the PHP 5.2 test job will remain using the Travis `precise` image.
Merges [45745,45762,45783-45784,45800,45819,45885,46320,46999,47225,47912,48121,49335,49358,49360,49362] to the 5.0 branch.
See #48301, #47767.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@49529 602fd350-edb4-49c9-b593-d223f7449a82
Fix off-by-one error in pixel color checks for rotate and flip image tests. Change to using PNG with single pixel to ensure that errors are caught in the future, rather than lost in JPEG noise.
Props Fuegas, mikeschroder.
Merges [45067] to the 5.0 branch.
See #46073, #48301.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@49518 602fd350-edb4-49c9-b593-d223f7449a82
* XML-RPC: Improve error messages for unprivileged users.
* External Libraries: Disable deserialization in Requests_Utility_FilteredIterator
* Embeds: Disable embeds on deactivated Multisite sites.
* Coding standards: Modify escaping functions to avoid potential false positives.
* XML-RPC: Return error message if attachment ID is incorrect.
* Upgrade/install: Improve logic check when determining installation status.
* Meta: Sanitize meta key before checking protection status.
* Themes: Ensure that only privileged users can set a background image when a theme is using the deprecated custom background page.
Brings the changes from [49380,49382-49388] to the 5.0 branch.
Props xknown, zieladam, peterwilsoncc, whyisjake, desrosj, dd32.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@49396 602fd350-edb4-49c9-b593-d223f7449a82
This restores the ability to run NodeJS related tasks when using `nvm install` or `nvm use`.
The alias `lts/*` currently resolves to NodeJS 12.x (and will continue to change as newer versions are released). The 10.x version of NodeJS is the highest version supported in the 5.0 branch.
This also removes the explicit version when running `nvm install` during automated testing. The command will now fall back to the version in the `.nvmrc` file.
See #51603.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@49277 602fd350-edb4-49c9-b593-d223f7449a82
Rename the `$keep` parameter of both filters to `$screen_option` for clarity, update the documentation to better reflect its purpose.
Follow-up to [47951].
Props Chouby, sswells, SergeyBiryukov.
Merges [48241] to the 5.0 branch.
Fixes#50392.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@48248 602fd350-edb4-49c9-b593-d223f7449a82
- Embeds: Ensure that the title attribute is set correctly on embeds.
- Editor: Prevent HTML decoding on by setting the proper editor context.
- Formatting: Ensure that `wp_validate_redirect()` sanitizes a wider variety of characters.
- Themes: Ensure a broken theme name is returned properly.
- Administration: Add a new filter to extend set-screen-option.
Merges [47947-47951] to the 5.0 branch.
Props xknown, sstoqnov, vortfu, SergeyBiryukov, whyisjake.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@47964 602fd350-edb4-49c9-b593-d223f7449a82
User: Invalidate `user_activation_key` on password update.
Query: Ensure that only a single post can be returned on date/time based queries.
Cache API: Ensure proper escaping around the stats method in the cache API.
Formatting: Expand `sanitize_file_name` to have better support for utf8 characters.
Brings the changes in [47633], [47634], [47635], [47636], [47637], and [47638] to the 5.0 branch.
Props: aduth, batmoo, ehti, ellatrix, jorgefilipecosta, nickdaugherty, noisysocks, pento, peterwilsoncc, sergeybiryukov, sstoqnov, talldanwp, westi, westonruter, whyisjake, whyisjake, xknown.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@47647 602fd350-edb4-49c9-b593-d223f7449a82
Props: danielbachhuber, whyisjake, peterwilson, xknown.
Prevent stored XSS through wp_targeted_link_rel().
Props: vortfu, whyisjake, peterwilsoncc, xknown, SergeyBiryukov, flaviozavan.
Update wp_kses_bad_protocol() to recognize : on uri attributes,
wp_kses_bad_protocol() makes sure to validate that uri attributes don't contain invalid/or not allowed protocols. While this works fine in most cases, there's a risk that by using the colon html5 named entity, one is able to bypass this function.
Brings r46895 to the 5.3 branch.
Props: xknown, nickdaugherty, peterwilsoncc.
Prevent stored XSS in the block editor.
Brings r46896 to the 5.3 branch.
Prevent escaped unicode characters become unescaped in unsafe HTML during JSON decoding.
Props: aduth, epiqueras.
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@46915 602fd350-edb4-49c9-b593-d223f7449a82
This removes the PHP 5.6 job which runs without an object cache in place as the likelihood of a change being backported that only breaks 5.6 environments without an object cache is small.
See #42387
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@45005 602fd350-edb4-49c9-b593-d223f7449a82
This switches to caching npm's local cache instead of `node_modules` in order to prevent issues caused by modules compiled using a different version of node.
Merges [44993] into the 5.0 branch.
See #46632
git-svn-id: https://develop.svn.wordpress.org/branches/5.0@44995 602fd350-edb4-49c9-b593-d223f7449a82
