From 483f8419ac1b2e7230bee74a3efcb9e37f5b1bea Mon Sep 17 00:00:00 2001 From: Nikolai Kristiansen Date: Fri, 8 Aug 2014 15:07:41 +0200 Subject: [PATCH] Update bonanza --- readme.html | 2 +- wp-admin/about.php | 6 ++- wp-content/languages/admin-nb_NO.mo | Bin 337899 -> 337897 bytes wp-content/languages/admin-nb_NO.po | 8 +-- .../languages/themes/twentyfourteen-nb_NO.mo | Bin 9810 -> 9821 bytes .../languages/themes/twentyfourteen-nb_NO.po | 4 +- .../includes/class-ure-lib.php | 3 +- .../user-role-editor/lang/ure-ru_RU.mo | Bin 19925 -> 19925 bytes .../user-role-editor/lang/ure-ru_RU.po | 2 +- .../plugins/user-role-editor/readme.txt | 5 ++ .../user-role-editor/user-role-editor.php | 4 +- wp-includes/ID3/getid3.lib.php | 11 ++-- wp-includes/class-IXR.php | 32 ++++++++++-- wp-includes/class-wp-customize-widgets.php | 30 +++++------ wp-includes/compat.php | 29 +++++++++++ wp-includes/pluggable.php | 49 ++++++++++++++++-- wp-includes/version.php | 2 +- wp-login.php | 26 ++++++++-- 18 files changed, 166 insertions(+), 47 deletions(-) diff --git a/readme.html b/readme.html index faad3e9..914fb2a 100644 --- a/readme.html +++ b/readme.html @@ -9,7 +9,7 @@

WordPress -
Version 3.9.1 +
Version 3.9.2

Semantic Personal Publishing Platform

diff --git a/wp-admin/about.php b/wp-admin/about.php index 0a4344b..f5c7860 100644 --- a/wp-admin/about.php +++ b/wp-admin/about.php @@ -39,7 +39,11 @@ include( ABSPATH . 'wp-admin/admin-header.php' );
-

+

+

Version %1$s addressed a security issue.', + 'Version %1$s addressed some security issues.', 6 ), '3.9.2', number_format_i18n( 6 ) ); ?> + the release notes.' ), 'http://codex.wordpress.org/Version_3.9.2' ); ?> +

Version %1$s addressed %2$s bug.', 'Version %1$s addressed %2$s bugs.', 34 ), '3.9.1', number_format_i18n( 34 ) ); ?> the release notes.' ), 'http://codex.wordpress.org/Version_3.9.1' ); ?> diff --git a/wp-content/languages/admin-nb_NO.mo b/wp-content/languages/admin-nb_NO.mo index 0356c56312366c2dce2e0629c6fd83d308a7bced..589dccf123901f17cce1b348e4fc8003c3262b6b 100644 GIT binary patch delta 16753 zcmXZjcVJG}AII?<&wXOXiajDx5~D~EvxpH}h)t{_i5+`$?Ny`p-aizjsJ&|MQdOIv zRa*yYwfMb1&$)lS&bjNH^F7~l?oGtg3t1jt$g-t#W2dEMSqH0mtTvdvy2pBr{jnx? zui>#O;5O8C&oMjJjP_W$upOqtA*kbHFfA^^EV$M^zYjB0KZd&Rs#|{%?Qwh$@YeKL zBRG*B%i>flp&L*Qyh1(r1E$B+waoDxt|6!fi(m$b~w6frGFVuE(5syOv`v zc*6nR=&9|oQez;d!MvCU3t?7_#&j6xp6`OqsrN%QbOtlx6;uNcF%e{F&Xo9+-6RM}ZQ6nGd)<>d0^>MhI2z-SKebHDm z(z2*zi$M+OOU#d>P*b|vt#8I8+P5xJQ1Vo5?6HdRz~(re`nV?M!GTSU`A`ooit1=( z)Lh1(BGLghr-LyNXQCpw1~riHP}lE3U4IfY)4p|wf|Bb6D)gzEnFh0=9+V$-Lm4c9 zF_;(o;RBqB`EYP^k5v&Dpho@+YPr2cjXZq|kJS}(qL%kqbmAzSp%9LtEloo$P!CAL z@;DtI;VIPAY;9#ch-%=hTYrE`)|aS}2DCQye5mDE-mN!7wU^YI^Md&apl0T!S z?03}jUSJDM+1ad;_Q=#a)?ibxCZa|<4;8x2s2h)=B68h5{@6YK3ANm^#G6PJLk*-Z zDk=N8$EV^R>g!QS-6_G0d<=$Z{r``GlI9$;BUx`z%P@bUi9k52L)B0nZ0Xt?wXP?j zl5{$1#7j{PZNNl4jmnvbE+#UyQ3Hy@^jiPjDQK%4ih6*9zNtX%Y;#d_wi30W97m1t z0@^9adTh&-{MpT8wZ{fMOaq&GnvNYnEx&WFk5IW~_hS9)K_L{>&=;r>)<#7j2^E!`d-xPIgZNy>llo0P!Y+IWS$d-vD70`xiJxMw+Yd7)CFr$ z%WyZUBZp8OJdcXZ4cFgLBYWo7Q}r?DGod1x3l*_2R0Jb10-K?xWMUu3yuX)mK+EGF zEQ5Lbnh%hss0WNg&HZ##hu5MWupgC#m)!HuP!YBJnGWYeMWQJBV+H&It6~it=}`EN z!ckPi{rZ~*H=stm9o66=RAjE88hGrUw+EPwB_l?0ycJf)MHr0NQOoi@Dxzrznhpoz z2e^KB5}RHpJvg5NgT_ zpr)W0mc>}Sq4htRfd0c$2sWZZxgQmYvu-`v^*L(8`VW4%w) zXwbKWYbDhf%m6i{S@sj73S_B{&k* z!Q7+F{Z&y(+X?mDo~Wc7fO_6G)Rde==M06PDD1+;qdk`DO~$a1V9;38(~+o=%s@S0 z3F^CGE9#~56!T-oaUQD(mcl~V4mIZ!u`O;yO-<_YCgOR=v;OCCpaci>QaOQ5sCS-d z9=ID7x|?_ypI|V4JIRdjN7NKtMZF!LpjL}L*=$(3P#ai5^k6J%RW(CB_shwIPIJN$U+cF0etT+92F zIbOn{pa)k$^{g&xZknS))gFEO0{%#S18Ut4o@%apjlSe^>*=SN5obqDQFYYRj6ii{ z1!^POf&u94qM+q<9JP~OL3QL$)QJ8?B~jt&=6D1uB9%}hY=r7)0;++bsF&Fk*BPi} zoP*nN8CJpA86In=AM0->1!ZULnI^f$V>tCiI3Ca9K;1CQ-FQ$Px{MmZZB)dbqB`~p z6_J#)&2`x@hI$Zcqw0yeZW5-|`d>^zJJ&kY1Ajne`;Vv*-oUE(7b-_e&hc0&Fb4Z$ zEUH5%Q1_ij&GAjtoIgiBKkZy|{xejh!ZASWKZ=5KAO^LZTA>;qiJFQzZhZwRxprb< zyoPx&#XR>j8`V&G)Cgly%e6DALqo7EeuWz7QFJs{7bz$yuAoA98`Ys_*b3jEIubkI zjG!%QO1hz@=pO!yi3>c|4(znh?EN_xndjw0EzjbvwQ&~pj*D3TUJCzkKn?zj4bgwG z$NCzZ;{<$&6a6f!*Af$%*Go-OrCVlRUfHk)*LBB{xCJ$k63flpS9YC-O*wuGHK2$U zj%m2k3KOc@c!3jb@hTQuX?8;IDvy;wJs!)@k#o3@y61m{5P!h!SY-_x73W`J7wS9L zd8}@j?;DR*7pI^<=PzS0-g4G^tZAJ1u)$*u!LK%&z1{n*dHuG;W*pyutI*n{pIZ4T z79U{XW{=f~2ffE0SZ|9tzk4e?9`!=oJXRmB`}}*4H3OGnbu7N!W9>($FNL2el-R*O zzzr#OnuY>*d8}lP@5GuMpSzpA9dGS%zvK6Ltk#@wkBvFL7b7v?fXBLt)eoAtX}&`& zXX@KgtK;{>CK+EKN$yzo5wij1LapPXsH`pRS_h-3w?pk{%P|zMyXUQ==9?}ns)1Ul z4Xr6E7veD%@1ypaGRKVlFqI~63k9v;J(vv-qn6b*ERFx5=C;Ujk2MJI;2Lak!n}4r z;BVAFJL$2`GSZZ%$SF36OQ%_G)RWJ8taY5v_9Ih;2T^au4Cjf2lBW~}ZIRKa_1h4& zeiKn08j4!4Gg0e!xqE&qYQH$<)*qvu^B*b_{uj)Bfv7Dy1QnS`)N-tej!tx-pa=DL zPb|cO)W64gypEddDnFSWZxPm{p5da$s)x;S0j@$FulTdanv7#m&rf&Btg>L#fQn*K ztagd@ub%YcfaY`(YVNeawgP zZhbszikG2sEak*&svYMT1-%2#;{m*c>d?%aCJ9%fF5Hgl@j;-BnG9{Z1l|Xf{0_r(6a5=U{<;Hu|08`#EukCbLn0f|Gr^zW#K|QRA`ao#tJHgux zBd8C;hPWQp@H?!5+3%W=wn0U#H>v}p-1swjJP>!WbvqoB)JYl&E-VYKCu{;1DoCYc8sBZ602dh-_7!Eh1y@Xqat|@ z9nIBK3R?g61JmQesJX6)N~W5q2sJ>Bw7FYPK#ed773$HbWSfqYJaK z5yw3>*Y!h1bO>rdW1l)^qnXNqf*jb6dhiWYLw})0=J(9pm>$)k99RUyun9IsCF@$$ zecMqTJMPxcqF%eV+yNM1?xpJ^mgw zx9R^d_lIJ6>Sa;K`(Pwa#*{?p2i!;9Ir*n)c{0h_kWA^F= z7(smnYASw4P0ck_@;t`b_yVWmgx7SG&<4KoSSzUKf9tUp;Zam_wtHtH-4!oWpNRRj z{@cDc|KKnR6`BnHnje=VQCsS4RL{?%&c8-YO`iWuZiJ#W z_T@l3tVewUs^dSqCSy*X`$Tfw_VV+Ok}k+=`+8Uw_23$=b#Msv7*tlD!n*hjwY8S@ zw|&3q7>b&r)u<^tkMZ~lm4vNR8hfL1Y62F+-42CH6ds`Fv_LA;P;u0Q8lxgK7_~!A zLe1?WR8oECx)-%oA4fgs9BQhrpsv4zjqw$h!CI+JyUs`oAspC`S~kh3_3oF(L?jO? zgoRO|k93dMcI(aDdKc7v15nTT8rAUks0f@w?U2cM1)t#nt^cEGZQs9GmQQEv7Xns5 zfNAJhdfT_|uc8`$fJ)MLuGun}sVapUX*pD+s-l)@ENW^yqHTxYhz&2PDkD@w|CX<=Fyr>5^#2eTJmHpK-n}+M*7u4IJLcI{Rf&GO3DVPcz zNBuz-I;{2IJ*(~8`-h>{=R(wa-GbWVU%BTqW;1hJ94m0V9BRbaYNL9A1<=Wx&$faoR6}ivom@v?81?zs z9e+TLsA#Zl{f-q-_23ZG(GsWuR7B-S3~IzpQ5{Tj9gVtfHZp~dwU&ZLv=Pc_?V) z(_OzoW$6*Oeh$@<2d=MBBTrGl%ylMI#|xqws)ibQGmOCAsHt3q`o!DpdJcWR|9e6~ zBY2BSK5s#jow-q=E9%xOp&D+08fhEU^?lIy^8o54wHVc*A5e3A3)L~dP!oYHsFzP} zbhLBTp`a1RqCy&n>QDlz$NjJs&O~+KDJmJ?qxOevVeYzuOss{=Q4e^CUGW2IeJ2*SeLp8`Kn-BC z>ps+oPoX078nyldi#TSvd{)GaAR5)f_Naz?p^|MhDywIqI}>dpiua8+xJVQDaf+0!i(8fZ;ZsrxE5>ZcyZhJOQZqV zlllp)jHOGM9kU-QA{#Lpvxb{@MI36X=HV>dgc_g|6=6cs1T}ZPF%*}ga^e_j4$q@< zxN3+{zyCg`yU1MWDAbMqo{RWqm+3I zHb8}HCYHxTsE)ozg+8pb33VgaF{n^)cl`ldP(Oq1F@K~P;1~?h`d?3>H79nV)@kN4 zrb9ufIgUUr!>XvHY=V0KcSkL|ai|?~0cs$2Su@h?sECE2a;Gqc@_|zV6_MuUXpi=- zI0`zDh#Gkh)CdNkZXAVr8%}VKAH=EDPoq{(^YZ4~ZYsu6zk?mHVg=jxTl6KU>xxyh zeg6#C35QWXj7~ucmA)`N?}YQI4@4zj`bs8r4vwaN6>DRw%4Qj^!X}L93F?>7m81BC ziUx3DVauVd!8GajOT47cIe1YY(#}TEXHg=V^JMDf%Py$L#C90#i8CYog0}P z8i~4pov+|Dvf`C5aeDeIaV#&S46=F;_E_B$ZIv+z&hB9n=jqn$r*u?1AdYi5BLy{W~g@ z-j=3;l9-R{I^zl)*UIdO1>zVmZv! z&dhBSEJgi$Ou&a2k1_3Ss~v8~x)|8O?3nE^g!*dKlpaT|wm&eN*8fWi={S()OSAW9 zcMU}?!$|bUDAayX3sYeW)VrbsYJW(=j5r$A@mZ)X_Yc%d$J^1I&yRXuDa@nwUx9)i z+yeFBMAX}=x9c*jMg1HSGAm0bvrMOD7#*HxReFtjlE?_8T zA88^}8MX6vbSNlvlQ0Cgq1NRuI0}o=!G^dQmDL}y6V@4JvV9ZkC6sQoN#bD4N4*&8 zWz_(cQ}L)A>xD|jkvIdL#T3R-C_2XW{r-OoPSu5DO$YwP8`Ou7Gh1nk@#eLhW`b?? z<#-Hg`5nf0L?mpY`AI5dvg!D4EY0y$Q*3Js*H!w;T;|aQ~4s{f`*vP1;0)+ zZ@t6QP0vrFJ}iE6>&cjz`a{(6e2!?@Yoj)r#;8@+0(0Xs zRL(mejL@2WYpaM ziQ1^%qOMCh*9( z9jKSs5mdu}xPEZYr<-r?%Q>I*uNyz-fI=UIS+Nmnt`gki{ZU)#IJdqS)$m4CHXlTF z{3dEyy+=JSc!3#MI4+=G8x@&*sOw%VU^xX-$g$A8=gXr;*ag+G(KrC-qUJ8`A~RKC zsCo-Lfc;R{M=UlSi$)EgC8{F{sOJtu<J7UTeCUV`dDvz@!P*4O;q4w_c zm=ga+_4pm?!S+gH0IK0^s1f8x50*kDb6M2&^-&#ehPu8JD#A(bc?Scv{wKK?EWuzd z_y)D!Pow7QA$Gxcs19{pWtLG-R7d-xjt@sA??hC?OHp&Y5tXDzQIWWd`WF0z*|h$1 zt~NVWIO;@8Y>Is`0#Bl{{T)VOy8oFkn+B+t)-0@uw@@R^vBpHE0BWitaX3~%P4#{p zgm2LI_rFPNO?FPfe4JQ~Bk(B3W7T!$wY(04{P@?gZ_IoA-Fnkt{07s(KB%|kI4p;6 zH`>-m?vL1H=01G0`KFwWEp>h~>;DrM#BQ;zgL12F{fZg4v2k$0OVryg#dbzWJpq?e zU$w(*tx-G82%}N|UeFMSasK2k+xO=?)pwiox%ZfX6+~r!H0s^Zc#mT?f}!pOE3gnJ z4x!ffV^q?3_nKVDikj0fyo6P75(e%go9Vz3jH8~s-+Y2qIAB{(sjoui!1RN9>5vmx z7ppoym>-#@VtEc!KV+8A2vkSrpqAwU)YRO=ROoluY&dDKF!dn(8*8JIx55#VoGno~ z(ZRI`YPAeTEmLPW1!d)I)QGoX2Rx5Ou*6aG&DR=>QlEyO;~p%54_vbyGaadktvTKs zlkhAy!HUOi>pITBirDppZ=Z3jH596F;0AWUTqn&2Gz=AyEm#(xU@gpl%1l`|R0qDs zs(1)>eTviOQ|k*v!ihi_0_1kFZZKut;c5A6F=cy+P8Y1H(#YO7fe#Dz;+ye ziVaDsx<8qph8JD5tHl}f?Z_3kdJ?1yl(b>3{-k`qJzF+JP#ny*yqHQw0Pd(JOTmR@#&{q4|NAoL} zm8iF1=1=CrNYr~g7OUYvT!niu8QbvgT!9t+yuM_;h4rZirtn%Tu>;=16dted2b4Rg z)!^8!-%yC+z(v$D%k1^~RzY3V@*0L(o*PjQeu{OloWIxiM zsjqVDPq6{@$W-R~u^6NG|9SU7-qfanF4%|*cVHXzPh)QEgj)YwQ5|@PT6WdbdVR}o zASO`%3X9_lY=$A}yuMX22s={GAK>-Ak*}P6CdheguWyTPfkD)Vq4tYKxCt-d1RRmcbi~f=wY2KK!z8W$;eqCX z&#)l%fGnKAQrH$(V;c0!>h*nKq(jy7V+JgS>Ubs8$h%^GT;RG7wJ{~5p8FCPYG8dsw_^cWT5 zH>kPG5@JGG2J=ym#lqMJHARcDGVVeR>@})kE5CW3Kk9fE)3_xwJrP2F3-Y;ZA{PV0X;1wH6nRA{!M z8rp|SwiE90GpG^#f|{BesD>V)I{3F+|A1=Pzo6Imb3=Mma)zLu8;)wHB04HWQ}Dxv z?ul5}I8?{tQ4j2f%7wnD2hDI@gt~4GDiRw|9eU-Sw?a+F)1unTggT!)l=ZJ0!Z@Ih z#6GAwK8|YWrhDOA%uL-5Gs`PGDguR39Vv@?PBm0Vr=lV?2Nj`3sOPSB&+kEX_;46I zp0>~v98k}$pl-N3_T8+B?`HY!dN(V@t!4pbiBtHtBX<4zD8-{ze%h{UT8N2pM4DR2xM`E}5UWxHNx+d<*HP5~{^Z&dHv#bCB delta 16775 zcmXxrcVJJ~|HttgpBrKmTZ{-oj1t6Nv0{&)h*=e4v}#l1V~^S@(yCqRODkG6OI3~9 zmD1K$tF2wCRiowie0|>c_t)c`bMHOlea5|sxP2=3-BYdT3e1fgz3bm#DET9(=Pr8rCyjmn zKm{3__?+=v2*ql+04wMLR0B^@6$i!noNSmCRbI%mB&xyJFgrHHFl>){ZZJmUSgeej zumE0*^V>} zB3ce}k{^coahjh*UJ@%jx1mOO0yV;msETf427HNKFnx2MGa<-vdZ9x9OADV4RBXS^Yy$_07a!TSZ#wMDEm#*@C#T|`Cfs#ks=i<5teQI6wxBHCD}TcW0*6Y7C}sGbf-jr?6NKN-`LpNT7p zzzc< zsER9~I@$m=m+`2G^g+$(ILw8~s0eOA4dhGI{ku^2AIDJIcW#i-;(CG#eU^^aU_n$x zk*Ei1VhN1L!Z-?l!(=Rq<6ieUwQw0~DmW zDQwc6{jU(eO@ZciGHS6UV-;NPm7hkf>R(X}JwdI3tUYY13ZteZ3boDRP#tTF3VB~_ zifLF93-q*s)$@~3Pg;8gBT*GkLmfQHsJY*Q3hgnhk2f(KOZKu3H9`%sJQDJ~Ckocz7*{_Stt>iz~5 zp+l%h{*0Qk+o<}UU? zNJXOt(i*iWM|kB6a2NSas72kcuZ?^17s6w#5=wGUexY6idy}bF&tl@B2s9u)l(MRk*|ST8?*5;t{BYzS7^t* zVR2S|xmcWxZBg}~!NS`A*GTBWSGX8+js|j9wFsY}I^dgN=RzoIK+%|4`@aDR%}r}8hOc8K9E~~wKgIgE56fc^i#8rB z;4++y>R{1{_IzX1qV0#OcL-|HjX~A79W^D#(SMA@k0f^B%1J&)`A(BLNHAiG^>i|7 zB=4gtScUp7*oJ!P{DBded#cYVgVnG!_D0S5Z0wGkQRhY0X%_Kf)7bw@D5y+=R^c90=zhU(@d1Y8=QC}DKcJ@IBI@n<0JU2}X4!#N1a*K#p$|Kvc2yTty@|63 zozCjv6zCv%AC=#XT72K58n}Ww0Ux2(z`v-ehelBVXccVIT8CB0?)CuXE z?Ts8&UfEAV6*olntTk$G5>TOf69eZ0o+O`&+PCB8*nQ72u(;-0J`^?LFw_*qp{8aM zs=>9WgJ>&eMgMLRT8&3hC)ov5M;@a_^a{0z%Fna%7*s@JQ6ubt>gWJe0~1g$vw5EH zqZZ=_xCPf>J?uE&=WGvR|0R>q>TJ2t7S}ASNPY!Q!&5j?4=nNy9#n_UqegHI6|p~1 z9eaw3NapwLzJl1Ad<5z|7=pTQ4rbQ=Ur9nI*Qclo51>~252z7d!C3qYwMMEg_BrV= z9*1K`RELhCo;!^?Pkuqo`6E>Q*^}*hDO9AYU{>w_MkKTb;!)eFJF4NysHynC%dbT( zuCFi(FJU1}zr_2@Mm1CiHNuXl?V5z@(0Htd^HBpmjDF44Pb9P`E}%kp4b`EC*acsp zI?^%4M(_q|O5R3I(XaRd2Y%plwqd^y?d&hS)aoma+Mbm>TjC<}eV4NTgGoH2Kn=da zHkj!npR)iHa5~<_89|OSbeTow`EpxSIab)qs~|SwzQH&Fx1t78d8N&L1J8xnf%2=U z0mZEHTf?!dEL1J=6c^sWvlzYFPQr|9d`@5T{jn+?NyFXbGpr?qcmTIz!*v`~Tz`s5 zu6r{WrPH|eKV zeu~B4FkhfaS*oo+^+BWf)kH?xh+0t2=`U|(&x;_HP{d-@i zYd7ey&$&Uq6dq@!nUAohI3Ug*WxJ8Te%$A*=X$}DOcm}&y%lqPPb9Q>s*%tU*$lOR z+oSgHKvah&p!RDrY9D{>UEhW}FOGQm`>1-HQx=I#sOR#bj_8u8$kae>$L8qQg+3%y z(P;0&ax6)H2PWcW)Lb`AvlDLxHX)zu2cOdd6YvB41XW(|w9lD^(^2*3IAgo41ZqGP zuq-w?!~R!KhEkw8or9YDFR>IJK^>tFQTJv0kyVbRQ7@}x)SRcH8rto73N?i{Pz^di z+0mU3HHDQ?9sKks_J0hCn4f*l5gdqfu*z9GXud^t=q#!u_fQ?lbj~U+fx2D`)uFan z6#IMmS*R&qgIZ$|=WS7zK^=G-{3NoI*or!l4x;8T4RwND@UGuRy?mZw1m?M59jT5w zLE}*!=#1%c2x{&}qn?|NiqIO=8rqI($A5%`-T|laYdnkUQ1V4vgzHc@?nL!?zn4FW zfykg1)jh0+|Die(bIIyyjoQ{d@JsB6IuXMz2kP}Z(@Ag;I15l~;1g6NPNGI|9ue2c~-YrKnJE^zwUfEcp}IiF2XpHJ|gY7RRdV zG)zI*4LcaB-n0=Xphngo6_H_{e$-sfMx7HYQEOm}m*0u4$sflCSnyZdzTHvh%T81z z)6lQE`h$e_f5>mvummh!{;V@LFr=b?xBGi4U*q4FrMGc_j zE$eW!XQNx}e}%LY1*&KSYJ1HeppAuNMsu|2+y zTC5vU&+SBY?5LMNg?jB?_3|a|TO?xqBy>VGMMa_~s)F&T3g%%sT#TCYZ&4lk2^H$= zUinMZ+=f1|=gVLX^0iRqBQOT%Vg@2~0C$u3AOFJ|p7GG;XdSA7FHoV{i`o@OP#wL2 z+CI-wQ&r-TSr>IMbw<72#-iqYC2A@^MJ>90s7U{U)XVqZpH>i#T8vGw681!`?nS7O zuk)^N#dhRRqB>Iau{F>P_0H&l>d17|RBk{m?r%_2b`v$g?0;!{v;PW__?Cj!I2&{P zZD;i|j3&PpH5EUjrsfiA@!ZGv@d?hs_ny#ELYwa&pR9_DF z^0P5Q`~QvS_74tIQK8B8!hT$?fjUxCP(43|y8awBHR1o-+9-p1xpYE>yeBH;15qQL zh+2GeQB(MXSAGlqS{#3q(CaemfA-^b8P67;gHRREMUDJJjKejkeSQbkf#;}`G2Kg> znmAO4hoCx=f<199)YiA;J9oqeT}H>;`&R3srGb&sI2wd^~DZpTOq$ z5OuWHO78}K(=h=xMe9)`K8=a^6txI@WH5)L*3^4g9{2c3)FE*PHK(ORtf5M%ie5)W zXdLQV&+GKjT9jq5Xe2vm5vq%Q{(H z{X)RWnbjIPlFbe5`-`ZC@1Pdxf1U-i+f-FUjkGo@QjJmDv?FS2`=Zu@AGHXNV?{g{ zxX%8|n8W5U0@dRd*cW?Y6FiLSK(?GVcg0W@x5o=O2(|j-LapI8Setw=RH&Du4zM3F zeLAKBr;@*un+|LL56givQ{jWtehJq!y1l3^qFuSoKYO!=iMQRo* z65FvT9>(|Zchmre7IFix=`pBK&qalL8ESWIMosxKtb)z`g>5lO-S`2jflpB(+=B|~ z5!4htKsB7Hh~>+mBGv@;dhLwb&ZAKEe2A~%M$|yhqYkPkSOWdUin>lXi6*Ecv7hH8 zEJgk!9Eb-{BdQSYI=^CFRK7$p>u6=v0P3OENIYu9olzYe<~a>@UkWmXerF>Ijc7Bf zho`*!J=B4bCBhB7=L@1%btBZsTA@zB9;mtRkJ`Q?QK6lU)o~xH!Dpx`%2M3!&xJ!Y z8Q~-}@NXqDG#+gw1sxRL7%G4K+cHybDI-aMVUzg~*{A4B3P1q#_~rEM`bL%q)jpn5(TH3i8ShaaOVxQqQUD9ZNtK=hGM zMGat!=QpSkpFlP-P_!X){ zH&79KhMN0)Wv#p!1|p04W*mTu&`UpwUL?wwa|6Frnulx)r%HL(c?WCYEZm5VRQ{S9 z_$AU9e2e@stc%qv*oip`6_L%@7z+Z^3q`P$gpxJc#P(OH}B~RmU5(!+` zjoPPqt6GO5P;(rE+J=o$i?S2y{XZDB?Pj7*$YrR3gjBPUhM^)>618^9V1xhx|#@?n$U&-*yYIEBPDP3+vT%1HVOI zg}N`gmK*qIxPCa6{2}z0BoSNNdfpFH$iItPe4%wLbW?B=`HR>TyVtdC_zAXWL=RBE zglAIqX7-@JjnerGkbU33_aaQz&r1FIXc|67tM+?Ykd0|T%vd4Chjr=b?( zuW@eRS1?(c+G_5G>PQM|m0!hJjBI9eoP_(xAHgj+tGOHag=6g&_Bo$~T0_@cu>bX8 zk-eq8?UHaX`2|=SomRH^qObzl&ZrK}M2%oGD&%Eb+W|BK)v;sP0&}%tN*P#B)H^1r zt*xQSsOOjZNpvKUx1D`x48pSHmtziwQ6-Xai%QRMrej^=r&&+c1T5i_^v zB&6ZmScZK44z^1MVkz>=Q3LlMBB2M1bhJehi(1X2un*oqJ<#-Z8lu8?P#rne$zI#H zQK8J(*&3*dMY%5tSK-Vqb|OY~b)9#)FAlfiejKg+Kf0UiETrHOsv}dn+sHpbg?2wy z$09v!ZaZOR@;k6E-o-?W@975qh;=76C!epEotV9`82R<6DLsnXZGU23?f-vBWT7D2 z8+P`Gd6q$K!y1?#8==mF78rtEQSXXAsPkbM=D=yFjxRwSxqqTwIvIQ0^+;5G)v%EE ze_ax)xGSpSfvC6DaL+XuM?MV+nUnub+olUqizup(>wJgna6b-8bOV2QRH3h}jTD?t z`6FzAqx;zpHoMW^go1QQZeSZW!^`BCpbnhj{cY|)LoKQwu@VLkur*K}wKh7T7NZ}v zm^Yw4L|$Pm79Z$3A7LVDZ3PXo=ieH{{@2+)hk|juxOZbE7ESec?5lU+5ZC#b>kDxr z#tgN{Y{z)=H&Neu)rQ$gHwd+c{==CVKHLrbdF}@6K;9YQ27Y(c5qptcKZ5;Vk3`5w z*J*}L@iSb6dac$Q#RGI`0uIBp(Qe>xLmR!zswRI1pK#x!v2Ng(&bP){q-Kt{{k{t| zb!RXV!zNf{8lXOJ>{qL-VZX$59^^KYID=7)t&wYJ0v!O;N`AHuA0u?2~IOYH=<^?WSF*dVWWJ zfc%Zg+W(mr+CE-|3ejfFjNhR4^>NfU-DR)*1qPGPu*lx?S+O|ze5n0j%PVh*I%r-; z?Xs>IhHFr3ZZ9^cedi^K3fSy@JNw6A8S?8;Jx{}8x)1dp4_|B_Ag`l#!C*{}`@Qm` zsE%Am&HZE4LG>@{zRbxs&`|U%6cHq}SgN7U_BN={zKt1i3{J!;s1way;s*ZmAq+JY z3s8&jW7J8y1N9O+h-&zu=PU1ewiJ6VEQS5A2VbK=p>KeBFdj8mNnZI#RKwG~{Bl&o zn^3EHAFAV*QQPWYRDBU2*uW~`2jrWhB69wJ<;V0jQ2m!4a5( zn!Bt^ZK|SB`7Zc1jzHaC`6KIC9BKdwsE#C|>K%<*QwvcM|JYALi)lCN#&59|{(w3M ziY~JclF_Kp-ooGUZ`9}Y<>eNEr>H5*v%(@6jwQ%fMcvmGb$ukNo=K=k_~((RNn#~x z6<EU7v)x zwEy4pZdifg+^`X~-;bl_>NY0f3si^ttg&r07}e2{sPYM@#XAet@JiGiZ$d57L#Rkx zM|}$heN3dZ|HDY=q^g9vkboU+F?ZxXyJ9-NM1a4S%EF zcJ5Y2NInUdlV7{dj@Aa-ZG>^Ce=lfZQY)z~Jt-7d&5>b&{jTP}2>b@5ksr?^w%tq7=b;B%F2*1Lrcn)6W*&2I>AF;@{{?T>5$3Ji*?)}MrD(?TY z>-<7~GwNTx=AU%~e-X9eoaIZOXaAqzh6Wd0=N@LiXy5<;Vi*rxxa2xhD1UOSG{T9h>vcv|KF!z=C6c; z3Jd*aKgs;}J4Y$`gST8~HD0*QKdIojyRNf>`*+>5&+yLoIUyZ3@CfClUbxO$e24=u`CmJzod4{dvI6xw{sy(nZhCpg|I&`y zlK2i6K1RI-bHB11tDzojj}34%uEE`S1$*%BT!nRlf&+{73brJlCta|!8hhgD5ptfD( z%)xdL9BW#mBIPk}3i!q#hP!0=u1QsXX1&iQ#)OoQCH{lOB9sN12Bk4nf9qqa=aIp6O zgj`nP11w2Cdu}dZ40gwLmnyiI$jSo@_`tEOFh3v9ZXkI_5O_$ zF)?p2|Nn!;ZzP^!zI?%f500GqZA1+*obrCC*X~U0gOLS-1HXuvjdjSo1#L1!gqJ^yy8jn1e-~BHW7Km`F&Klw?YRtCio8FRgjQ=!jKRU!7}udX zbQcxkXQ;W$Tg*aP9gC80k5M=bHATy@F784N>?x|@bP-lx2&z0UQto%cNvP+Ms2*2B zjj)<$J=9dhq2|5=>b?Ptqy#M!;&7N zDhfwE7=`L!MO4UZd&Z$U5|7QWlUKeP)sfFo1KH+X{~DW;&rre+xVD%@`+qeFRg{Vf z&6lW#zD6y!BVPFl)Chh?P0b}#Lw8UeeC*|4p&AY;865bzAqQ%47Dv@v3Dr&=^eYiZ zA_&`g7utJvM|G?ps=`62wJ;o2(L&E^ zQ55JSaTscj52G5o?A`brL&>KvW!tL&DgtFu9jSq;rxB{7^H7mmf{M^GRK4rG>$_1M zK2VAiPeZ6s0Xf3dA4ZAvqeEWo-ImusbkhE<)f>HM^~;{v3kua6?a^}mF`v- zU*gc=DaRZ5I{$y7@Qm1oz8$d*-NW(O!iV=C)NerI+x-#;_3xLM@+#RakP`ZRP~Mar TC4w@i%v<7y>_}MR&R_U{*KNBh diff --git a/wp-content/languages/admin-nb_NO.po b/wp-content/languages/admin-nb_NO.po index 66282c0..5835578 100644 --- a/wp-content/languages/admin-nb_NO.po +++ b/wp-content/languages/admin-nb_NO.po @@ -2,7 +2,7 @@ # This file is distributed under the same license as the Administration package. msgid "" msgstr "" -"PO-Revision-Date: 2014-04-16 13:08:40+0000\n" +"PO-Revision-Date: 2014-07-22 09:45:21+0000\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -651,7 +651,7 @@ msgstr "Legg til nytt" #: wp-admin/themes.php:227 wp-admin/themes.php:304 wp-admin/themes.php:334 msgid "Update Available" -msgstr "Oppdater tilgjengelige" +msgstr "Oppdatering tilgjengelig" #: wp-admin/themes.php:314 msgid "Close overlay" @@ -6493,11 +6493,11 @@ msgstr "Siste" #: wp-admin/includes/update.php:433 msgid "An automated WordPress update has failed to complete - please attempt the update again now." -msgstr "En automatisert WordPress-oppdatering feilet—vennligst prøv igjen nå." +msgstr "En automatisk WordPress-oppdatering feilet—vennligst prøv igjen nå." #: wp-admin/includes/update.php:435 msgid "An automated WordPress update has failed to complete! Please notify the site administrator." -msgstr "En automatisert WordPress-oppdatering feilet! Vennligst si ifra til nettstedets administrator." +msgstr "En automatisk WordPress-oppdatering feilet! Vennligst si ifra til nettstedets administrator." #: wp-admin/includes/upgrade.php:66 msgid "Note that password carefully! It is a random password that was generated just for you." diff --git a/wp-content/languages/themes/twentyfourteen-nb_NO.mo b/wp-content/languages/themes/twentyfourteen-nb_NO.mo index 280449001c731472538f501e251ea9e7957ad72e..f6e328d7838e488c635e4ba3da69a1ed337831d0 100644 GIT binary patch delta 662 zcmXZZODIHP6u|K_#`}@+2#v>F21Q7dM>7&a5s8$9g))~kUd_yg(kL4XE6I{5$wD5J z&FrwVuuy6uD*Bn7Xq+aeOd9OB<% z5gxIXh|FOf=Hf1<;R&YVB_?A8H~Ibs$BBE(MA~p46Yv=|{}l`Iy-Y&?AO5mY%0`ky zqyU|mg&x$#`Y;=ZF%zfbE~4hG#ofXp;yp~lbJYB6%)r~Y4`?HPc7#MYTRz$7#B?Ke z-~j54Mp55Spx%5n?lx*;2dE94pdN6Id3b}G|Adkv?QH+@Bn^WwqA3Tt=hY)70W=c841Z mXRHpd84Q|6AUN;yE&BWwUDhXXf!IUw0X)VWOrqw$pbg&~68>M9W}=pfZ>&Un zoroDbQ4cnV797K3oX@(1nit5rjdtQgG~p#`eguo~F6#qYiIa6<5%!dKCWi4Bb;Dt2 z=0@YF|7TEd?$5e|nsnHw^B6{xLj#Sw!@7akD@DW-X*CXsT@N3GX@+L;~<;Ur$*+&zPJ28+#^ zH+n)X@QiwsSJb!uL@n@zZD?r`F`@_c;6uncWHvsL_i8n}+PnIk-EL2>%j0&%J8a9w d^3cYjFA(%PHy^H?tASu>&AZ}{$Et3N{s4gvP6Ge{ diff --git a/wp-content/languages/themes/twentyfourteen-nb_NO.po b/wp-content/languages/themes/twentyfourteen-nb_NO.po index ad1840b..ec0fbe3 100644 --- a/wp-content/languages/themes/twentyfourteen-nb_NO.po +++ b/wp-content/languages/themes/twentyfourteen-nb_NO.po @@ -2,7 +2,7 @@ # This file is distributed under the same license as the Twenty Fourteen package. msgid "" msgstr "" -"PO-Revision-Date: 2014-04-07 15:34:54+0000\n" +"PO-Revision-Date: 2014-07-22 09:46:59+0000\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -91,7 +91,7 @@ msgstr "Stikkord" #: inc/featured-content.php:436 msgid "Don’t display tag on front end." -msgstr "Ikke vis slagord på forsiden." +msgstr "Ikke vis dette stikkordet på fremsidene." msgid "In 2014, our default theme lets you create a responsive magazine website with a sleek, modern design. Feature your favorite homepage content in either a grid or a slider. Use the three widget areas to customize your website, and change your content's layout with a full-width page template and a contributor page to show off your authors. Creating a magazine website with WordPress has never been easier." msgstr "I 2014 gjør vårt standardtema deg i stand til å lage et responsivt magasinnettsted med et moderne design. Fremhev ditt favorittinnhold i et rutenett eller en slider. Bruk de tre widgetområdene for å tilpasse nettstedet og endre layouten med fullbreddeformat og bidragsytersider for å fremheve dine ulike forfattere. Å lage et magasinnettsted med WordPress har aldri vært enklere." diff --git a/wp-content/plugins/user-role-editor/includes/class-ure-lib.php b/wp-content/plugins/user-role-editor/includes/class-ure-lib.php index 508cbc7..ff0bfb0 100644 --- a/wp-content/plugins/user-role-editor/includes/class-ure-lib.php +++ b/wp-content/plugins/user-role-editor/includes/class-ure-lib.php @@ -883,7 +883,8 @@ class Ure_Lib extends Garvs_WP_Lib { $caps['delete_users'] = 1; $caps['create_users'] = 1; if ($this->multisite) { - $caps['manage_network'] = 1; + $caps['manage_network'] = 1; + $caps['manage_sites'] = 1; $caps['manage_network_users'] = 1; $caps['manage_network_themes'] = 1; $caps['manage_network_plugins'] = 1; diff --git a/wp-content/plugins/user-role-editor/lang/ure-ru_RU.mo b/wp-content/plugins/user-role-editor/lang/ure-ru_RU.mo index 1da1f6aac9b1f08d16597768b9cdd4c53c397c1f..790046f007676fe36005df291c05663d9840d9f5 100644 GIT binary patch delta 30 ocmV+(0O9}Dn*r6E0kDrU517!m(7e#K(7n*O(Sp&8vz{_H8w%PHEdT%j delta 30 ocmV+(0O9}Dn*r6E0kDrU51`Ps(6rF7(7Mrr(7w@tvz{_H8wu(W9RL6T diff --git a/wp-content/plugins/user-role-editor/lang/ure-ru_RU.po b/wp-content/plugins/user-role-editor/lang/ure-ru_RU.po index 3577205..73c54a7 100644 --- a/wp-content/plugins/user-role-editor/lang/ure-ru_RU.po +++ b/wp-content/plugins/user-role-editor/lang/ure-ru_RU.po @@ -278,7 +278,7 @@ msgstr "Другие роли" #: ../includes/class-user-role-editor.php:904 msgid "Edit" -msgstr "Редактор" +msgstr "Изменить" #: ../includes/ure-role-edit.php:17 msgid "Select Role and change its capabilities:" diff --git a/wp-content/plugins/user-role-editor/readme.txt b/wp-content/plugins/user-role-editor/readme.txt index e61ac08..8ba81fc 100644 --- a/wp-content/plugins/user-role-editor/readme.txt +++ b/wp-content/plugins/user-role-editor/readme.txt @@ -83,6 +83,11 @@ Share with me new ideas about plugin further development and link to your site w == Changelog == += 4.14.4 = +* 08.08.2014 +* Missed "manage_sites" user capability was added to the list of built-in WordPress capabilities managed by User Role Editor. +* Russian translation was updated. + = 4.14.3 = * 25.07.2014 * Integer "1" as default capability value for new added empty role was excluded for the better compatibility with WordPress core. Boolean "true" is used instead as WordPress itself does. diff --git a/wp-content/plugins/user-role-editor/user-role-editor.php b/wp-content/plugins/user-role-editor/user-role-editor.php index 94af799..9c1e168 100644 --- a/wp-content/plugins/user-role-editor/user-role-editor.php +++ b/wp-content/plugins/user-role-editor/user-role-editor.php @@ -3,7 +3,7 @@ Plugin Name: User Role Editor Plugin URI: http://role-editor.com Description: Change/add/delete WordPress user roles and capabilities. -Version: 4.14.3 +Version: 4.14.4 Author: Vladimir Garagulya Author URI: http://www.shinephp.com Text Domain: ure @@ -23,7 +23,7 @@ if (defined('URE_PLUGIN_URL')) { wp_die('It seems that other version of User Role Editor is active. Please deactivate it before use this version'); } -define('URE_VERSION', '4.14.3'); +define('URE_VERSION', '4.14.4'); define('URE_PLUGIN_URL', plugin_dir_url(__FILE__)); define('URE_PLUGIN_DIR', plugin_dir_path(__FILE__)); define('URE_PLUGIN_FILE', basename(__FILE__)); diff --git a/wp-includes/ID3/getid3.lib.php b/wp-includes/ID3/getid3.lib.php index f8df233..a7282c7 100644 --- a/wp-includes/ID3/getid3.lib.php +++ b/wp-includes/ID3/getid3.lib.php @@ -519,11 +519,12 @@ class getid3_lib } public static function XML2array($XMLstring) { - if (function_exists('simplexml_load_string')) { - if (function_exists('get_object_vars')) { - $XMLobject = simplexml_load_string($XMLstring); - return self::SimpleXMLelement2array($XMLobject); - } + if ( function_exists( 'simplexml_load_string' ) && function_exists( 'libxml_disable_entity_loader' ) ) { + $loader = libxml_disable_entity_loader( true ); + $XMLobject = simplexml_load_string( $XMLstring, 'SimpleXMLElement', LIBXML_NOENT ); + $return = self::SimpleXMLelement2array( $XMLobject ); + libxml_disable_entity_loader( $loader ); + return $return; } return false; } diff --git a/wp-includes/class-IXR.php b/wp-includes/class-IXR.php index 7264db6..f576719 100644 --- a/wp-includes/class-IXR.php +++ b/wp-includes/class-IXR.php @@ -203,11 +203,37 @@ class IXR_Message { // first remove the XML declaration // merged from WP #10698 - this method avoids the RAM usage of preg_replace on very large messages - $header = preg_replace( '/<\?xml.*?\?'.'>/', '', substr($this->message, 0, 100), 1); - $this->message = substr_replace($this->message, $header, 0, 100); - if (trim($this->message) == '') { + $header = preg_replace( '/<\?xml.*?\?'.'>/s', '', substr( $this->message, 0, 100 ), 1 ); + $this->message = trim( substr_replace( $this->message, $header, 0, 100 ) ); + if ( '' == $this->message ) { return false; } + + // Then remove the DOCTYPE + $header = preg_replace( '/^]*+>/i', '', substr( $this->message, 0, 200 ), 1 ); + $this->message = trim( substr_replace( $this->message, $header, 0, 200 ) ); + if ( '' == $this->message ) { + return false; + } + + // Check that the root tag is valid + $root_tag = substr( $this->message, 0, strcspn( substr( $this->message, 0, 20 ), "> \t\r\n" ) ); + if ( 'message, '<' ) ) { + return false; + } + $this->_parser = xml_parser_create(); // Set XML parser to take the case of tags in to account xml_parser_set_option($this->_parser, XML_OPTION_CASE_FOLDING, false); diff --git a/wp-includes/class-wp-customize-widgets.php b/wp-includes/class-wp-customize-widgets.php index 8efead2..40663f2 100644 --- a/wp-includes/class-wp-customize-widgets.php +++ b/wp-includes/class-wp-customize-widgets.php @@ -1119,22 +1119,19 @@ final class WP_Customize_Widgets { } /** - * Get a widget instance's hash key. + * Get MAC for a serialized widget instance string. * - * Serialize an instance and hash it with the AUTH_KEY; when a JS value is - * posted back to save, this instance hash key is used to ensure that the - * serialized_instance was not tampered with, but that it had originated - * from WordPress and so is sanitized. + * Allows values posted back from JS to be rejected if any tampering of the + * data has occurred. * * @since 3.9.0 * @access protected * - * @param array $instance Widget instance. - * @return string Widget instance's hash key. + * @param string $serialized_instance Widget instance. + * @return string MAC for serialized widget instance. */ - protected function get_instance_hash_key( $instance ) { - $hash = md5( AUTH_KEY . serialize( $instance ) ); - return $hash; + protected function get_instance_hash_key( $serialized_instance ) { + return wp_hash( $serialized_instance ); } /** @@ -1162,18 +1159,19 @@ final class WP_Customize_Widgets { } $decoded = base64_decode( $value['encoded_serialized_instance'], true ); - if ( false === $decoded ) { return null; } - $instance = unserialize( $decoded ); + if ( $this->get_instance_hash_key( $decoded ) !== $value['instance_hash_key'] ) { + return null; + } + + $instance = unserialize( $decoded ); if ( false === $instance ) { return null; } - if ( $this->get_instance_hash_key( $instance ) !== $value['instance_hash_key'] ) { - return null; - } + return $instance; } @@ -1194,7 +1192,7 @@ final class WP_Customize_Widgets { 'encoded_serialized_instance' => base64_encode( $serialized ), 'title' => empty( $value['title'] ) ? '' : $value['title'], 'is_widget_customizer_js_value' => true, - 'instance_hash_key' => $this->get_instance_hash_key( $value ), + 'instance_hash_key' => $this->get_instance_hash_key( $serialized ), ); } return $value; diff --git a/wp-includes/compat.php b/wp-includes/compat.php index cb2a559..83a8c64 100644 --- a/wp-includes/compat.php +++ b/wp-includes/compat.php @@ -94,3 +94,32 @@ if ( !function_exists('json_decode') ) { return is_array($data) ? array_map(__FUNCTION__, $data) : $data; } } + +if ( ! function_exists( 'hash_equals' ) ) : +/** + * Compare two strings in constant time. + * + * This function was added in PHP 5.6. + * It can leak the length of a string. + * + * @since 3.9.2 + * + * @param string $a Expected string. + * @param string $b Actual string. + * @return bool Whether strings are equal. + */ +function hash_equals( $a, $b ) { + $a_length = strlen( $a ); + if ( $a_length !== strlen( $b ) ) { + return false; + } + $result = 0; + + // Do not attempt to "optimize" this. + for ( $i = 0; $i < $a_length; $i++ ) { + $result |= ord( $a[ $i ] ) ^ ord( $b[ $i ] ); + } + + return $result === 0; +} +endif; \ No newline at end of file diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php index ef2821f..dae13a4 100644 --- a/wp-includes/pluggable.php +++ b/wp-includes/pluggable.php @@ -647,7 +647,7 @@ function wp_validate_auth_cookie($cookie = '', $scheme = '') { $key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme); $hash = hash_hmac('md5', $username . '|' . $expiration, $key); - if ( hash_hmac( 'md5', $hmac, $key ) !== hash_hmac( 'md5', $hash, $key ) ) { + if ( ! hash_equals( $hash, $hmac ) ) { /** * Fires if a bad authentication cookie hash is encountered. * @@ -1658,11 +1658,17 @@ function wp_verify_nonce($nonce, $action = -1) { $i = wp_nonce_tick(); // Nonce generated 0-12 hours ago - if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) === $nonce ) + $expected = substr( wp_hash( $i . '|' . $action . '|' . $uid, 'nonce'), -12, 10 ); + if ( hash_equals( $expected, $nonce ) ) { return 1; + } + // Nonce generated 12-24 hours ago - if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) === $nonce ) + $expected = substr( wp_hash( ( $i - 1 ) . '|' . $action . '|' . $uid, 'nonce' ), -12, 10 ); + if ( hash_equals( $expected, $nonce ) ) { return 2; + } + // Invalid nonce return false; } @@ -1687,7 +1693,7 @@ function wp_create_nonce($action = -1) { $i = wp_nonce_tick(); - return substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10); + return substr(wp_hash($i . '|' . $action . '|' . $uid, 'nonce'), -12, 10); } endif; @@ -2107,7 +2113,8 @@ function get_avatar( $id_or_email, $size = '96', $default = '', $alt = false ) { $out = str_replace( '&', '&', esc_url( $out ) ); $avatar = "{$safe_alt}"; } else { - $avatar = "{$safe_alt}"; + $out = esc_url( $default ); + $avatar = "{$safe_alt}"; } /** @@ -2200,3 +2207,35 @@ function wp_text_diff( $left_string, $right_string, $args = null ) { } endif; +if ( ! function_exists( 'hash_equals' ) ) : +/** + * Compare two strings in constant time. + * + * This function is NOT pluggable. It is in this file (in addition to + * compat.php) to prevent errors if, during an update, pluggable.php + * copies over but compat.php does not. + * + * This function was added in PHP 5.6. + * It can leak the length of a string. + * + * @since 3.9.2 + * + * @param string $a Expected string. + * @param string $b Actual string. + * @return bool Whether strings are equal. + */ +function hash_equals( $a, $b ) { + $a_length = strlen( $a ); + if ( $a_length !== strlen( $b ) ) { + return false; + } + $result = 0; + + // Do not attempt to "optimize" this. + for ( $i = 0; $i < $a_length; $i++ ) { + $result |= ord( $a[ $i ] ) ^ ord( $b[ $i ] ); + } + + return $result === 0; +} +endif; diff --git a/wp-includes/version.php b/wp-includes/version.php index 7e434ec..7767d12 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '3.9.1'; +$wp_version = '3.9.2'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. diff --git a/wp-login.php b/wp-login.php index 7bb5334..0197167 100644 --- a/wp-login.php +++ b/wp-login.php @@ -562,10 +562,25 @@ break; case 'resetpass' : case 'rp' : - $user = check_password_reset_key($_GET['key'], $_GET['login']); + list( $rp_path ) = explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) ); + $rp_cookie = 'wp-resetpass-' . COOKIEHASH; + if ( isset( $_GET['key'] ) ) { + $value = sprintf( '%s:%s', wp_unslash( $_GET['login'] ), wp_unslash( $_GET['key'] ) ); + setcookie( $rp_cookie, $value, 0, $rp_path, COOKIE_DOMAIN, is_ssl(), true ); + wp_safe_redirect( remove_query_arg( array( 'key', 'login' ) ) ); + exit; + } - if ( is_wp_error($user) ) { - if ( $user->get_error_code() === 'expired_key' ) + if ( isset( $_COOKIE[ $rp_cookie ] ) && 0 < strpos( $_COOKIE[ $rp_cookie ], ':' ) ) { + list( $rp_login, $rp_key ) = explode( ':', wp_unslash( $_COOKIE[ $rp_cookie ] ), 2 ); + $user = check_password_reset_key( $rp_key, $rp_login ); + } else { + $user = false; + } + + if ( ! $user || is_wp_error( $user ) ) { + setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true ); + if ( $user && $user->get_error_code() === 'expired_key' ) wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=expiredkey' ) ); else wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=invalidkey' ) ); @@ -589,6 +604,7 @@ case 'rp' : if ( ( ! $errors->get_error_code() ) && isset( $_POST['pass1'] ) && !empty( $_POST['pass1'] ) ) { reset_password($user, $_POST['pass1']); + setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true ); login_header( __( 'Password Reset' ), '

' . __( 'Your password has been reset.' ) . ' ' . __( 'Log in' ) . '

' ); login_footer(); exit; @@ -600,8 +616,8 @@ case 'rp' : login_header(__('Reset Password'), '

' . __('Enter your new password below.') . '

', $errors ); ?> -
- + +