diff --git a/readme.html b/readme.html index faad3e9..914fb2a 100644 --- a/readme.html +++ b/readme.html @@ -9,7 +9,7 @@

WordPress -
Version 3.9.1 +
Version 3.9.2

Semantic Personal Publishing Platform

diff --git a/wp-admin/about.php b/wp-admin/about.php index 0a4344b..f5c7860 100644 --- a/wp-admin/about.php +++ b/wp-admin/about.php @@ -39,7 +39,11 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
-

+

+

Version %1$s addressed a security issue.', + 'Version %1$s addressed some security issues.', 6 ), '3.9.2', number_format_i18n( 6 ) ); ?> + the release notes.' ), 'http://codex.wordpress.org/Version_3.9.2' ); ?> +

Version %1$s addressed %2$s bug.', 'Version %1$s addressed %2$s bugs.', 34 ), '3.9.1', number_format_i18n( 34 ) ); ?> the release notes.' ), 'http://codex.wordpress.org/Version_3.9.1' ); ?> diff --git a/wp-content/languages/admin-nb_NO.mo b/wp-content/languages/admin-nb_NO.mo index 0356c56..589dccf 100644 Binary files a/wp-content/languages/admin-nb_NO.mo and b/wp-content/languages/admin-nb_NO.mo differ diff --git a/wp-content/languages/admin-nb_NO.po b/wp-content/languages/admin-nb_NO.po index 66282c0..5835578 100644 --- a/wp-content/languages/admin-nb_NO.po +++ b/wp-content/languages/admin-nb_NO.po @@ -2,7 +2,7 @@ # This file is distributed under the same license as the Administration package. msgid "" msgstr "" -"PO-Revision-Date: 2014-04-16 13:08:40+0000\n" +"PO-Revision-Date: 2014-07-22 09:45:21+0000\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -651,7 +651,7 @@ msgstr "Legg til nytt" #: wp-admin/themes.php:227 wp-admin/themes.php:304 wp-admin/themes.php:334 msgid "Update Available" -msgstr "Oppdater tilgjengelige" +msgstr "Oppdatering tilgjengelig" #: wp-admin/themes.php:314 msgid "Close overlay" @@ -6493,11 +6493,11 @@ msgstr "Siste" #: wp-admin/includes/update.php:433 msgid "An automated WordPress update has failed to complete - please attempt the update again now." -msgstr "En automatisert WordPress-oppdatering feilet—vennligst prøv igjen nå." +msgstr "En automatisk WordPress-oppdatering feilet—vennligst prøv igjen nå." #: wp-admin/includes/update.php:435 msgid "An automated WordPress update has failed to complete! Please notify the site administrator." -msgstr "En automatisert WordPress-oppdatering feilet! Vennligst si ifra til nettstedets administrator." +msgstr "En automatisk WordPress-oppdatering feilet! Vennligst si ifra til nettstedets administrator." #: wp-admin/includes/upgrade.php:66 msgid "Note that password carefully! It is a random password that was generated just for you." diff --git a/wp-content/languages/themes/twentyfourteen-nb_NO.mo b/wp-content/languages/themes/twentyfourteen-nb_NO.mo index 2804490..f6e328d 100644 Binary files a/wp-content/languages/themes/twentyfourteen-nb_NO.mo and b/wp-content/languages/themes/twentyfourteen-nb_NO.mo differ diff --git a/wp-content/languages/themes/twentyfourteen-nb_NO.po b/wp-content/languages/themes/twentyfourteen-nb_NO.po index ad1840b..ec0fbe3 100644 --- a/wp-content/languages/themes/twentyfourteen-nb_NO.po +++ b/wp-content/languages/themes/twentyfourteen-nb_NO.po @@ -2,7 +2,7 @@ # This file is distributed under the same license as the Twenty Fourteen package. msgid "" msgstr "" -"PO-Revision-Date: 2014-04-07 15:34:54+0000\n" +"PO-Revision-Date: 2014-07-22 09:46:59+0000\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -91,7 +91,7 @@ msgstr "Stikkord" #: inc/featured-content.php:436 msgid "Don’t display tag on front end." -msgstr "Ikke vis slagord på forsiden." +msgstr "Ikke vis dette stikkordet på fremsidene." msgid "In 2014, our default theme lets you create a responsive magazine website with a sleek, modern design. Feature your favorite homepage content in either a grid or a slider. Use the three widget areas to customize your website, and change your content's layout with a full-width page template and a contributor page to show off your authors. Creating a magazine website with WordPress has never been easier." msgstr "I 2014 gjør vårt standardtema deg i stand til å lage et responsivt magasinnettsted med et moderne design. Fremhev ditt favorittinnhold i et rutenett eller en slider. Bruk de tre widgetområdene for å tilpasse nettstedet og endre layouten med fullbreddeformat og bidragsytersider for å fremheve dine ulike forfattere. Å lage et magasinnettsted med WordPress har aldri vært enklere." diff --git a/wp-content/plugins/user-role-editor/includes/class-ure-lib.php b/wp-content/plugins/user-role-editor/includes/class-ure-lib.php index 508cbc7..ff0bfb0 100644 --- a/wp-content/plugins/user-role-editor/includes/class-ure-lib.php +++ b/wp-content/plugins/user-role-editor/includes/class-ure-lib.php @@ -883,7 +883,8 @@ class Ure_Lib extends Garvs_WP_Lib { $caps['delete_users'] = 1; $caps['create_users'] = 1; if ($this->multisite) { - $caps['manage_network'] = 1; + $caps['manage_network'] = 1; + $caps['manage_sites'] = 1; $caps['manage_network_users'] = 1; $caps['manage_network_themes'] = 1; $caps['manage_network_plugins'] = 1; diff --git a/wp-content/plugins/user-role-editor/lang/ure-ru_RU.mo b/wp-content/plugins/user-role-editor/lang/ure-ru_RU.mo index 1da1f6a..790046f 100644 Binary files a/wp-content/plugins/user-role-editor/lang/ure-ru_RU.mo and b/wp-content/plugins/user-role-editor/lang/ure-ru_RU.mo differ diff --git a/wp-content/plugins/user-role-editor/lang/ure-ru_RU.po b/wp-content/plugins/user-role-editor/lang/ure-ru_RU.po index 3577205..73c54a7 100644 --- a/wp-content/plugins/user-role-editor/lang/ure-ru_RU.po +++ b/wp-content/plugins/user-role-editor/lang/ure-ru_RU.po @@ -278,7 +278,7 @@ msgstr "Другие роли" #: ../includes/class-user-role-editor.php:904 msgid "Edit" -msgstr "Редактор" +msgstr "Изменить" #: ../includes/ure-role-edit.php:17 msgid "Select Role and change its capabilities:" diff --git a/wp-content/plugins/user-role-editor/readme.txt b/wp-content/plugins/user-role-editor/readme.txt index e61ac08..8ba81fc 100644 --- a/wp-content/plugins/user-role-editor/readme.txt +++ b/wp-content/plugins/user-role-editor/readme.txt @@ -83,6 +83,11 @@ Share with me new ideas about plugin further development and link to your site w == Changelog == += 4.14.4 = +* 08.08.2014 +* Missed "manage_sites" user capability was added to the list of built-in WordPress capabilities managed by User Role Editor. +* Russian translation was updated. + = 4.14.3 = * 25.07.2014 * Integer "1" as default capability value for new added empty role was excluded for the better compatibility with WordPress core. Boolean "true" is used instead as WordPress itself does. diff --git a/wp-content/plugins/user-role-editor/user-role-editor.php b/wp-content/plugins/user-role-editor/user-role-editor.php index 94af799..9c1e168 100644 --- a/wp-content/plugins/user-role-editor/user-role-editor.php +++ b/wp-content/plugins/user-role-editor/user-role-editor.php @@ -3,7 +3,7 @@ Plugin Name: User Role Editor Plugin URI: http://role-editor.com Description: Change/add/delete WordPress user roles and capabilities. -Version: 4.14.3 +Version: 4.14.4 Author: Vladimir Garagulya Author URI: http://www.shinephp.com Text Domain: ure @@ -23,7 +23,7 @@ if (defined('URE_PLUGIN_URL')) { wp_die('It seems that other version of User Role Editor is active. Please deactivate it before use this version'); } -define('URE_VERSION', '4.14.3'); +define('URE_VERSION', '4.14.4'); define('URE_PLUGIN_URL', plugin_dir_url(__FILE__)); define('URE_PLUGIN_DIR', plugin_dir_path(__FILE__)); define('URE_PLUGIN_FILE', basename(__FILE__)); diff --git a/wp-includes/ID3/getid3.lib.php b/wp-includes/ID3/getid3.lib.php index f8df233..a7282c7 100644 --- a/wp-includes/ID3/getid3.lib.php +++ b/wp-includes/ID3/getid3.lib.php @@ -519,11 +519,12 @@ class getid3_lib } public static function XML2array($XMLstring) { - if (function_exists('simplexml_load_string')) { - if (function_exists('get_object_vars')) { - $XMLobject = simplexml_load_string($XMLstring); - return self::SimpleXMLelement2array($XMLobject); - } + if ( function_exists( 'simplexml_load_string' ) && function_exists( 'libxml_disable_entity_loader' ) ) { + $loader = libxml_disable_entity_loader( true ); + $XMLobject = simplexml_load_string( $XMLstring, 'SimpleXMLElement', LIBXML_NOENT ); + $return = self::SimpleXMLelement2array( $XMLobject ); + libxml_disable_entity_loader( $loader ); + return $return; } return false; } diff --git a/wp-includes/class-IXR.php b/wp-includes/class-IXR.php index 7264db6..f576719 100644 --- a/wp-includes/class-IXR.php +++ b/wp-includes/class-IXR.php @@ -203,11 +203,37 @@ class IXR_Message { // first remove the XML declaration // merged from WP #10698 - this method avoids the RAM usage of preg_replace on very large messages - $header = preg_replace( '/<\?xml.*?\?'.'>/', '', substr($this->message, 0, 100), 1); - $this->message = substr_replace($this->message, $header, 0, 100); - if (trim($this->message) == '') { + $header = preg_replace( '/<\?xml.*?\?'.'>/s', '', substr( $this->message, 0, 100 ), 1 ); + $this->message = trim( substr_replace( $this->message, $header, 0, 100 ) ); + if ( '' == $this->message ) { return false; } + + // Then remove the DOCTYPE + $header = preg_replace( '/^]*+>/i', '', substr( $this->message, 0, 200 ), 1 ); + $this->message = trim( substr_replace( $this->message, $header, 0, 200 ) ); + if ( '' == $this->message ) { + return false; + } + + // Check that the root tag is valid + $root_tag = substr( $this->message, 0, strcspn( substr( $this->message, 0, 20 ), "> \t\r\n" ) ); + if ( 'message, '<' ) ) { + return false; + } + $this->_parser = xml_parser_create(); // Set XML parser to take the case of tags in to account xml_parser_set_option($this->_parser, XML_OPTION_CASE_FOLDING, false); diff --git a/wp-includes/class-wp-customize-widgets.php b/wp-includes/class-wp-customize-widgets.php index 8efead2..40663f2 100644 --- a/wp-includes/class-wp-customize-widgets.php +++ b/wp-includes/class-wp-customize-widgets.php @@ -1119,22 +1119,19 @@ final class WP_Customize_Widgets { } /** - * Get a widget instance's hash key. + * Get MAC for a serialized widget instance string. * - * Serialize an instance and hash it with the AUTH_KEY; when a JS value is - * posted back to save, this instance hash key is used to ensure that the - * serialized_instance was not tampered with, but that it had originated - * from WordPress and so is sanitized. + * Allows values posted back from JS to be rejected if any tampering of the + * data has occurred. * * @since 3.9.0 * @access protected * - * @param array $instance Widget instance. - * @return string Widget instance's hash key. + * @param string $serialized_instance Widget instance. + * @return string MAC for serialized widget instance. */ - protected function get_instance_hash_key( $instance ) { - $hash = md5( AUTH_KEY . serialize( $instance ) ); - return $hash; + protected function get_instance_hash_key( $serialized_instance ) { + return wp_hash( $serialized_instance ); } /** @@ -1162,18 +1159,19 @@ final class WP_Customize_Widgets { } $decoded = base64_decode( $value['encoded_serialized_instance'], true ); - if ( false === $decoded ) { return null; } - $instance = unserialize( $decoded ); + if ( $this->get_instance_hash_key( $decoded ) !== $value['instance_hash_key'] ) { + return null; + } + + $instance = unserialize( $decoded ); if ( false === $instance ) { return null; } - if ( $this->get_instance_hash_key( $instance ) !== $value['instance_hash_key'] ) { - return null; - } + return $instance; } @@ -1194,7 +1192,7 @@ final class WP_Customize_Widgets { 'encoded_serialized_instance' => base64_encode( $serialized ), 'title' => empty( $value['title'] ) ? '' : $value['title'], 'is_widget_customizer_js_value' => true, - 'instance_hash_key' => $this->get_instance_hash_key( $value ), + 'instance_hash_key' => $this->get_instance_hash_key( $serialized ), ); } return $value; diff --git a/wp-includes/compat.php b/wp-includes/compat.php index cb2a559..83a8c64 100644 --- a/wp-includes/compat.php +++ b/wp-includes/compat.php @@ -94,3 +94,32 @@ if ( !function_exists('json_decode') ) { return is_array($data) ? array_map(__FUNCTION__, $data) : $data; } } + +if ( ! function_exists( 'hash_equals' ) ) : +/** + * Compare two strings in constant time. + * + * This function was added in PHP 5.6. + * It can leak the length of a string. + * + * @since 3.9.2 + * + * @param string $a Expected string. + * @param string $b Actual string. + * @return bool Whether strings are equal. + */ +function hash_equals( $a, $b ) { + $a_length = strlen( $a ); + if ( $a_length !== strlen( $b ) ) { + return false; + } + $result = 0; + + // Do not attempt to "optimize" this. + for ( $i = 0; $i < $a_length; $i++ ) { + $result |= ord( $a[ $i ] ) ^ ord( $b[ $i ] ); + } + + return $result === 0; +} +endif; \ No newline at end of file diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php index ef2821f..dae13a4 100644 --- a/wp-includes/pluggable.php +++ b/wp-includes/pluggable.php @@ -647,7 +647,7 @@ function wp_validate_auth_cookie($cookie = '', $scheme = '') { $key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme); $hash = hash_hmac('md5', $username . '|' . $expiration, $key); - if ( hash_hmac( 'md5', $hmac, $key ) !== hash_hmac( 'md5', $hash, $key ) ) { + if ( ! hash_equals( $hash, $hmac ) ) { /** * Fires if a bad authentication cookie hash is encountered. * @@ -1658,11 +1658,17 @@ function wp_verify_nonce($nonce, $action = -1) { $i = wp_nonce_tick(); // Nonce generated 0-12 hours ago - if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) === $nonce ) + $expected = substr( wp_hash( $i . '|' . $action . '|' . $uid, 'nonce'), -12, 10 ); + if ( hash_equals( $expected, $nonce ) ) { return 1; + } + // Nonce generated 12-24 hours ago - if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) === $nonce ) + $expected = substr( wp_hash( ( $i - 1 ) . '|' . $action . '|' . $uid, 'nonce' ), -12, 10 ); + if ( hash_equals( $expected, $nonce ) ) { return 2; + } + // Invalid nonce return false; } @@ -1687,7 +1693,7 @@ function wp_create_nonce($action = -1) { $i = wp_nonce_tick(); - return substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10); + return substr(wp_hash($i . '|' . $action . '|' . $uid, 'nonce'), -12, 10); } endif; @@ -2107,7 +2113,8 @@ function get_avatar( $id_or_email, $size = '96', $default = '', $alt = false ) { $out = str_replace( '&', '&', esc_url( $out ) ); $avatar = "{$safe_alt}"; } else { - $avatar = "{$safe_alt}"; + $out = esc_url( $default ); + $avatar = "{$safe_alt}"; } /** @@ -2200,3 +2207,35 @@ function wp_text_diff( $left_string, $right_string, $args = null ) { } endif; +if ( ! function_exists( 'hash_equals' ) ) : +/** + * Compare two strings in constant time. + * + * This function is NOT pluggable. It is in this file (in addition to + * compat.php) to prevent errors if, during an update, pluggable.php + * copies over but compat.php does not. + * + * This function was added in PHP 5.6. + * It can leak the length of a string. + * + * @since 3.9.2 + * + * @param string $a Expected string. + * @param string $b Actual string. + * @return bool Whether strings are equal. + */ +function hash_equals( $a, $b ) { + $a_length = strlen( $a ); + if ( $a_length !== strlen( $b ) ) { + return false; + } + $result = 0; + + // Do not attempt to "optimize" this. + for ( $i = 0; $i < $a_length; $i++ ) { + $result |= ord( $a[ $i ] ) ^ ord( $b[ $i ] ); + } + + return $result === 0; +} +endif; diff --git a/wp-includes/version.php b/wp-includes/version.php index 7e434ec..7767d12 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '3.9.1'; +$wp_version = '3.9.2'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. diff --git a/wp-login.php b/wp-login.php index 7bb5334..0197167 100644 --- a/wp-login.php +++ b/wp-login.php @@ -562,10 +562,25 @@ break; case 'resetpass' : case 'rp' : - $user = check_password_reset_key($_GET['key'], $_GET['login']); + list( $rp_path ) = explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) ); + $rp_cookie = 'wp-resetpass-' . COOKIEHASH; + if ( isset( $_GET['key'] ) ) { + $value = sprintf( '%s:%s', wp_unslash( $_GET['login'] ), wp_unslash( $_GET['key'] ) ); + setcookie( $rp_cookie, $value, 0, $rp_path, COOKIE_DOMAIN, is_ssl(), true ); + wp_safe_redirect( remove_query_arg( array( 'key', 'login' ) ) ); + exit; + } - if ( is_wp_error($user) ) { - if ( $user->get_error_code() === 'expired_key' ) + if ( isset( $_COOKIE[ $rp_cookie ] ) && 0 < strpos( $_COOKIE[ $rp_cookie ], ':' ) ) { + list( $rp_login, $rp_key ) = explode( ':', wp_unslash( $_COOKIE[ $rp_cookie ] ), 2 ); + $user = check_password_reset_key( $rp_key, $rp_login ); + } else { + $user = false; + } + + if ( ! $user || is_wp_error( $user ) ) { + setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true ); + if ( $user && $user->get_error_code() === 'expired_key' ) wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=expiredkey' ) ); else wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=invalidkey' ) ); @@ -589,6 +604,7 @@ case 'rp' : if ( ( ! $errors->get_error_code() ) && isset( $_POST['pass1'] ) && !empty( $_POST['pass1'] ) ) { reset_password($user, $_POST['pass1']); + setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true ); login_header( __( 'Password Reset' ), '

' . __( 'Your password has been reset.' ) . ' ' . __( 'Log in' ) . '

' ); login_footer(); exit; @@ -600,8 +616,8 @@ case 'rp' : login_header(__('Reset Password'), '

' . __('Enter your new password below.') . '

', $errors ); ?> -
- + +