diff --git a/.htaccess b/.htaccess
new file mode 100644
index 0000000..02db732
--- /dev/null
+++ b/.htaccess
@@ -0,0 +1,12 @@
+
+# BEGIN WordPress
+
+RewriteEngine On
+RewriteBase /
+RewriteRule ^index\.php$ - [L]
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteRule . /index.php [L]
+
+
+# END WordPress
diff --git a/wordpress/index.php b/wordpress/index.php
index 1e3364a..dd3d554 100644
--- a/wordpress/index.php
+++ b/wordpress/index.php
@@ -14,4 +14,4 @@
define('WP_USE_THEMES', true);
/** Loads the WordPress Environment and Template */
-require('./wp-blog-header.php');
+require( dirname( __FILE__ ) . '/wp-blog-header.php' );
diff --git a/wordpress/license.txt b/wordpress/license.txt
index ec05d29..93c3881 100644
--- a/wordpress/license.txt
+++ b/wordpress/license.txt
@@ -1,6 +1,6 @@
WordPress - Web publishing software
-Copyright 2011 by the contributors
+Copyright 2014 by the contributors
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -382,4 +382,4 @@ WRITTEN OFFER
The source code for any program binaries or compressed scripts that are
included with WordPress can be freely obtained at the following URL:
- http://wordpress.org/download/source/
+ https://wordpress.org/download/source/
diff --git a/wordpress/readme.html b/wordpress/readme.html
index d5998ba..3688bb3 100644
--- a/wordpress/readme.html
+++ b/wordpress/readme.html
@@ -1,19 +1,20 @@
-
-
+
+
+
WordPress › ReadMe
-
- Version 3.4.2
+
+ Version 3.9
Semantic Personal Publishing Platform
First Things First
-Welcome. WordPress is a very special project to me. Every developer and contributor adds something unique to the mix, and together we create something beautiful that I'm proud to be a part of. Thousands of hours have gone into WordPress, and we're dedicated to making it better every day. Thank you for making it part of your world.
+Welcome. WordPress is a very special project to me. Every developer and contributor adds something unique to the mix, and together we create something beautiful that I’m proud to be a part of. Thousands of hours have gone into WordPress, and we’re dedicated to making it better every day. Thank you for making it part of your world.
— Matt Mullenweg
Installation: Famous 5-minute install
@@ -21,35 +22,32 @@
Unzip the package in an empty directory and upload everything.
Open wp-admin/install.php in your browser. It will take you through the process to set up a wp-config.php file with your database connection details.
- If for some reason this doesn't work, don't worry. It doesn't work on all web hosts. Open up wp-config-sample.php with a text editor like WordPad or similar and fill in your database connection details.
+ If for some reason this doesn’t work, don’t worry. It doesn’t work on all web hosts. Open up wp-config-sample.php with a text editor like WordPad or similar and fill in your database connection details.
Save the file as wp-config.php and upload it.
Open wp-admin/install.php in your browser.
- Once the configuration file is set up, the installer will set up the tables needed for your blog. If there is an error, double check your wp-config.php file, and try again. If it fails again, please go to the support forums with as much data as you can gather.
+ Once the configuration file is set up, the installer will set up the tables needed for your blog. If there is an error, double check your wp-config.php file, and try again. If it fails again, please go to the support forums with as much data as you can gather.
If you did not enter a password, note the password given to you. If you did not provide a username, it will be admin.
- The installer should then send you to the login page . Sign in with the username and password you chose during the installation. If a password was generated for you, you can then click on 'Profile' to change the password.
+ The installer should then send you to the login page . Sign in with the username and password you chose during the installation. If a password was generated for you, you can then click on “Profile” to change the password.
Updating
Using the Automatic Updater
If you are updating from version 2.7 or higher, you can use the automatic updater:
- Open the wp-admin/update-core.php in your browser and follow the instructions.
- You wanted more, perhaps? That's it!
+ Open wp-admin/update-core.php in your browser and follow the instructions.
+ You wanted more, perhaps? That’s it!
Updating Manually
Before you update anything, make sure you have backup copies of any files you may have modified such as index.php.
- Delete your old WordPress files, saving ones you've modified.
+ Delete your old WordPress files, saving ones you’ve modified.
Upload the new files.
Point your browser to /wp-admin/upgrade.php .
-Theme Template Changes
-If you have customized your theme templates, you may have to make some changes across major versions.
-
Migrating from other systems
WordPress can import from a number of systems . First you need to get WordPress installed and working as described above, before using our import tools .
@@ -62,44 +60,34 @@
System Recommendations
Online Resources
-If you have any questions that aren't addressed in this document, please take advantage of WordPress' numerous online resources:
+If you have any questions that aren’t addressed in this document, please take advantage of WordPress’ numerous online resources:
The WordPress Codex
The Codex is the encyclopedia of all things WordPress. It is the most comprehensive source of information for WordPress available.
- The WordPress Blog
- This is where you'll find the latest updates and news related to WordPress. Recent WordPress news appears in your administrative dashboard by default.
+ The WordPress Blog
+ This is where you’ll find the latest updates and news related to WordPress. Recent WordPress news appears in your administrative dashboard by default.
WordPress Planet
The WordPress Planet is a news aggregator that brings together posts from WordPress blogs around the web.
- WordPress Support Forums
- If you've looked everywhere and still can't find an answer, the support forums are very active and have a large community ready to help. To help them help you be sure to use a descriptive thread title and describe your question in as much detail as possible.
+ WordPress Support Forums
+ If you’ve looked everywhere and still can’t find an answer, the support forums are very active and have a large community ready to help. To help them help you be sure to use a descriptive thread title and describe your question in as much detail as possible.
WordPress IRC Channel
There is an online chat channel that is used for discussion among people who use WordPress and occasionally support topics. The above wiki page should point you in the right direction. (irc.freenode.net #wordpress )
-XML -RPC and Atom Interface
-You can post to your WordPress blog with tools like Windows Live Writer , Ecto , w.bloggar , Radio Userland (which means you can use Radio's email-to-blog feature), NewzCrawler , and other tools that support the blogging API s! :) You can read more about XML -RPC support on the Codex .
-
-Post via Email
-You can post from an email client! To set this up go to your "Writing" options screen and fill in the connection details for your secret POP3 account. Then you need to set up wp-mail.php to execute periodically to check the mailbox for new posts. You can do it with cron -jobs, or if your host doesn't support it you can look into the various website-monitoring services, and make them check your wp-mail.php URL .
-Posting is easy: Any email sent to the address you specify will be posted, with the subject as the title. It is best to keep the address discrete. The script will delete emails that are successfully posted.
-
-User Roles
-We introduced a very flexible roles system in version 2.0. You can read more about Roles and Capabilities on the Codex .
-
Final Notes
- If you have any suggestions, ideas, or comments, or if you (gasp!) found a bug, join us in the Support Forums .
- WordPress has a robust plugin API that makes extending the code easy. If you are a developer interested in utilizing this, see the plugin documentation in the Codex . You shouldn't modify any of the core code.
+ If you have any suggestions, ideas, or comments, or if you (gasp!) found a bug, join us in the Support Forums .
+ WordPress has a robust plugin API that makes extending the code easy. If you are a developer interested in utilizing this, see the plugin documentation in the Codex . You shouldn’t modify any of the core code.
Share the Love
WordPress has no multi-million dollar marketing campaign or celebrity sponsors, but we do have something even better—you. If you enjoy WordPress please consider telling a friend, setting it up for someone less knowledgable than yourself, or writing the author of a media article that overlooks us.
-WordPress is the official continuation of b2/cafélog , which came from Michel V. The work has been continued by the WordPress developers . If you would like to support WordPress, please consider donating .
+WordPress is the official continuation of b2/cafélog , which came from Michel V. The work has been continued by the WordPress developers . If you would like to support WordPress, please consider donating .
License
WordPress is free software, and is released under the terms of the GPL version 2 or (at your option) any later version. See license.txt .
diff --git a/wordpress/wp-activate.php b/wordpress/wp-activate.php
index d470772..5e9be6e 100644
--- a/wordpress/wp-activate.php
+++ b/wordpress/wp-activate.php
@@ -1,10 +1,17 @@
cache_enabled = false;
+// Fix for page title
+$wp_query->is_404 = false;
+
+/**
+ * Fires before the Site Activation page is loaded.
+ *
+ * @since 3.0.0
+ */
do_action( 'activate_header' );
+/**
+ * Adds an action hook specific to this page that fires on wp_head
+ *
+ * @since MU
+ */
function do_activate_header() {
- do_action( 'activate_wp_head' );
+ /**
+ * Fires before the Site Activation page is loaded, but on the wp_head action.
+ *
+ * @since 3.0.0
+ */
+ do_action( 'activate_wp_head' );
}
add_action( 'wp_head', 'do_activate_header' );
+/**
+ * Loads styles specific to this page.
+ *
+ * @since MU
+ */
function wpmu_activate_stylesheet() {
?>
diff --git a/wordpress/wp-admin/images/wordpress-logo.png b/wordpress/wp-admin/images/wordpress-logo.png
index 849a2d0..63b0379 100644
Binary files a/wordpress/wp-admin/images/wordpress-logo.png and b/wordpress/wp-admin/images/wordpress-logo.png differ
diff --git a/wordpress/wp-admin/images/wordpress-logo.svg b/wordpress/wp-admin/images/wordpress-logo.svg
new file mode 100644
index 0000000..da5e5df
--- /dev/null
+++ b/wordpress/wp-admin/images/wordpress-logo.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/wordpress/wp-admin/images/wpspin_light-2x.gif b/wordpress/wp-admin/images/wpspin_light-2x.gif
new file mode 100644
index 0000000..fe2d5c0
Binary files /dev/null and b/wordpress/wp-admin/images/wpspin_light-2x.gif differ
diff --git a/wordpress/wp-admin/images/wpspin_light.gif b/wordpress/wp-admin/images/wpspin_light.gif
index e10b97f..7f71727 100644
Binary files a/wordpress/wp-admin/images/wpspin_light.gif and b/wordpress/wp-admin/images/wpspin_light.gif differ
diff --git a/wordpress/wp-admin/images/xit-2x.gif b/wordpress/wp-admin/images/xit-2x.gif
new file mode 100644
index 0000000..b5ce86b
Binary files /dev/null and b/wordpress/wp-admin/images/xit-2x.gif differ
diff --git a/wordpress/wp-admin/images/xit.gif b/wordpress/wp-admin/images/xit.gif
index 80c251f..64cb854 100644
Binary files a/wordpress/wp-admin/images/xit.gif and b/wordpress/wp-admin/images/xit.gif differ
diff --git a/wordpress/wp-admin/images/yes.png b/wordpress/wp-admin/images/yes.png
index 2f86f0a..fbb3983 100644
Binary files a/wordpress/wp-admin/images/yes.png and b/wordpress/wp-admin/images/yes.png differ
diff --git a/wordpress/wp-admin/import.php b/wordpress/wp-admin/import.php
index a9de265..e6f05e0 100644
--- a/wordpress/wp-admin/import.php
+++ b/wordpress/wp-admin/import.php
@@ -9,7 +9,7 @@
define('WP_LOAD_IMPORTERS', true);
/** Load WordPress Bootstrap */
-require_once ('admin.php');
+require_once( dirname( __FILE__ ) . '/admin.php' );
if ( !current_user_can('import') )
wp_die(__('You do not have sufficient permissions to import content in this site.'));
@@ -26,36 +26,32 @@ get_current_screen()->add_help_tab( array(
get_current_screen()->set_help_sidebar(
'' . __('For more information:') . '
' .
'' . __('Documentation on Import ') . '
' .
- '' . __('Support Forums ') . '
'
+ '' . __('Support Forums ') . '
'
);
-$popular_importers = array();
-if ( current_user_can('install_plugins') )
- $popular_importers = array(
- 'blogger' => array( __('Blogger'), __('Install the Blogger importer to import posts, comments, and users from a Blogger blog.'), 'install' ),
- 'wpcat2tag' => array(__('Categories and Tags Converter'), __('Install the category/tag converter to convert existing categories to tags or tags to categories, selectively.'), 'install', 'wp-cat2tag' ),
- 'livejournal' => array( __( 'LiveJournal' ), __( 'Install the LiveJournal importer to import posts from LiveJournal using their API.' ), 'install' ),
- 'movabletype' => array( __('Movable Type and TypePad'), __('Install the Movable Type importer to import posts and comments from a Movable Type or TypePad blog.'), 'install', 'mt' ),
- 'opml' => array( __('Blogroll'), __('Install the blogroll importer to import links in OPML format.'), 'install' ),
- 'rss' => array( __('RSS'), __('Install the RSS importer to import posts from an RSS feed.'), 'install' ),
- 'tumblr' => array( __('Tumblr'), __('Install the Tumblr importer to import posts & media from Tumblr using their API.'), 'install' ),
- 'wordpress' => array( 'WordPress', __('Install the WordPress importer to import posts, pages, comments, custom fields, categories, and tags from a WordPress export file.'), 'install' )
- );
+if ( current_user_can( 'install_plugins' ) )
+ $popular_importers = wp_get_popular_importers();
+else
+ $popular_importers = array();
-if ( ! empty( $_GET['invalid'] ) && !empty($popular_importers[$_GET['invalid']][3]) ) {
- wp_redirect( admin_url('import.php?import=' . $popular_importers[$_GET['invalid']][3]) );
- exit;
+// Detect and redirect invalid importers like 'movabletype', which is registered as 'mt'
+if ( ! empty( $_GET['invalid'] ) && isset( $popular_importers[ $_GET['invalid'] ] ) ) {
+ $importer_id = $popular_importers[ $_GET['invalid'] ]['importer-id'];
+ if ( $importer_id != $_GET['invalid'] ) { // Prevent redirect loops.
+ wp_redirect( admin_url( 'admin.php?import=' . $importer_id ) );
+ exit;
+ }
+ unset( $importer_id );
}
add_thickbox();
wp_enqueue_script( 'plugin-install' );
-require_once ('admin-header.php');
+require_once( ABSPATH . 'wp-admin/admin-header.php' );
$parent_file = 'tools.php';
?>
-
%s importer is invalid or is not installed.'), esc_html( $_GET['invalid'] ) ); ?>
@@ -68,28 +64,26 @@ $importers = get_importers();
// If a popular importer is not registered, create a dummy registration that links to the plugin installer.
foreach ( $popular_importers as $pop_importer => $pop_data ) {
- if ( isset( $importers[$pop_importer] ) )
+ if ( isset( $importers[ $pop_importer ] ) )
continue;
- if ( isset( $pop_data[3] ) && isset( $importers[ $pop_data[3] ] ) )
+ if ( isset( $importers[ $pop_data['importer-id'] ] ) )
continue;
-
- $importers[$pop_importer] = $popular_importers[$pop_importer];
+ $importers[ $pop_data['importer-id'] ] = array( $pop_data['name'], $pop_data['description'], 'install' => $pop_data['plugin-slug'] );
}
-if ( empty($importers) ) {
- echo '
'.__('No importers are available.').'
'; // TODO: make more helpful
+if ( empty( $importers ) ) {
+ echo '
' . __('No importers are available.') . '
'; // TODO: make more helpful
} else {
- uasort($importers, create_function('$a, $b', 'return strcmp($a[0], $b[0]);'));
+ uasort( $importers, '_usort_by_first_member' );
?>
-
+
$data) {
- $style = ('class="alternate"' == $style || 'class="alternate active"' == $style) ? '' : 'alternate';
+ $alt = '';
+ foreach ($importers as $importer_id => $data) {
$action = '';
- if ( 'install' == $data[2] ) {
- $plugin_slug = $id . '-importer';
+ if ( isset( $data['install'] ) ) {
+ $plugin_slug = $data['install'];
if ( file_exists( WP_PLUGIN_DIR . '/' . $plugin_slug ) ) {
// Looks like Importer is installed, But not active
$plugins = get_plugins( '/' . $plugin_slug );
@@ -111,13 +105,12 @@ if ( empty($importers) ) {
}
}
} else {
- $action = "{$data[0]} ";
+ $action = "{$data[0]} ";
}
- if ($style != '')
- $style = 'class="'.$style.'"';
+ $alt = $alt ? '' : ' class="alternate"';
echo "
-
+
$action
{$data[1]}
";
@@ -136,4 +129,4 @@ if ( current_user_can('install_plugins') )
id and the JS global 'pagenow'
+ if ( ! empty($_POST['screen_id']) )
+ $screen_id = sanitize_key($_POST['screen_id']);
+ else
+ $screen_id = 'front';
- $message = sprintf( __('ALERT: You are logged out! Could not save draft. Please log in again. '), wp_login_url() );
- $x = new WP_Ajax_Response( array(
- 'what' => 'autosave',
- 'id' => $id,
- 'data' => $message
- ) );
- $x->send();
+ if ( ! empty($_POST['data']) ) {
+ $data = wp_unslash( (array) $_POST['data'] );
+
+ /**
+ * Filter Heartbeat AJAX response in no-privilege environments.
+ *
+ * @since 3.6.0
+ *
+ * @param array|object $response The no-priv Heartbeat response object or array.
+ * @param array $data An array of data passed via $_POST.
+ * @param string $screen_id The screen id.
+ */
+ $response = apply_filters( 'heartbeat_nopriv_received', $response, $data, $screen_id );
+ }
+
+ /**
+ * Filter Heartbeat AJAX response when no data is passed.
+ *
+ * @since 3.6.0
+ *
+ * @param array|object $response The Heartbeat response object or array.
+ * @param string $screen_id The screen id.
+ */
+ $response = apply_filters( 'heartbeat_nopriv_send', $response, $screen_id );
+
+ /**
+ * Fires when Heartbeat ticks in no-privilege environments.
+ *
+ * Allows the transport to be easily replaced with long-polling.
+ *
+ * @since 3.6.0
+ *
+ * @param array|object $response The no-priv Heartbeat response.
+ * @param string $screen_id The screen id.
+ */
+ do_action( 'heartbeat_nopriv_tick', $response, $screen_id );
+
+ // send the current time according to the server
+ $response['server_time'] = time();
+
+ wp_send_json($response);
}
/*
* GET-based Ajax handlers.
*/
function wp_ajax_fetch_list() {
- global $current_screen, $wp_list_table;
+ global $wp_list_table;
$list_class = $_GET['list_args']['class'];
check_ajax_referer( "fetch-list-$list_class", '_ajax_fetch_list_nonce' );
- $current_screen = convert_to_screen( $_GET['list_args']['screen']['id'] );
-
- define( 'WP_NETWORK_ADMIN', $current_screen->is_network );
- define( 'WP_USER_ADMIN', $current_screen->is_user );
-
- $wp_list_table = _get_list_table( $list_class );
+ $wp_list_table = _get_list_table( $list_class, array( 'screen' => $_GET['list_args']['screen']['id'] ) );
if ( ! $wp_list_table )
wp_die( 0 );
@@ -64,7 +101,7 @@ function wp_ajax_ajax_tag_search() {
wp_die( 0 );
}
- $s = stripslashes( $_GET['q'] );
+ $s = wp_unslash( $_GET['q'] );
$comma = _x( ',', 'tag delimiter' );
if ( ',' !== $comma )
@@ -77,7 +114,7 @@ function wp_ajax_ajax_tag_search() {
if ( strlen( $s ) < 2 )
wp_die(); // require 2 chars for matching
- $results = $wpdb->get_col( $wpdb->prepare( "SELECT t.name FROM $wpdb->term_taxonomy AS tt INNER JOIN $wpdb->terms AS t ON tt.term_id = t.term_id WHERE tt.taxonomy = %s AND t.name LIKE (%s)", $taxonomy, '%' . like_escape( $s ) . '%' ) );
+ $results = get_terms( $taxonomy, array( 'name__like' => $s, 'fields' => 'names', 'hide_empty' => false ) );
echo join( $results, "\n" );
wp_die();
@@ -153,22 +190,34 @@ function wp_ajax_autocomplete_user() {
if ( ! is_multisite() || ! current_user_can( 'promote_users' ) || wp_is_large_network( 'users' ) )
wp_die( -1 );
+ /** This filter is documented in wp-admin/user-new.php */
if ( ! is_super_admin() && ! apply_filters( 'autocomplete_users_for_site_admins', false ) )
wp_die( -1 );
$return = array();
// Check the type of request
- if ( isset( $_REQUEST['autocomplete_type'] ) )
+ // Current allowed values are `add` and `search`
+ if ( isset( $_REQUEST['autocomplete_type'] ) && 'search' === $_REQUEST['autocomplete_type'] ) {
$type = $_REQUEST['autocomplete_type'];
- else
+ } else {
$type = 'add';
+ }
+
+ // Check the desired field for value
+ // Current allowed values are `user_email` and `user_login`
+ if ( isset( $_REQUEST['autocomplete_field'] ) && 'user_email' === $_REQUEST['autocomplete_field'] ) {
+ $field = $_REQUEST['autocomplete_field'];
+ } else {
+ $field = 'user_login';
+ }
// Exclude current users of this blog
- if ( isset( $_REQUEST['site_id'] ) )
+ if ( isset( $_REQUEST['site_id'] ) ) {
$id = absint( $_REQUEST['site_id'] );
- else
+ } else {
$id = get_current_blog_id();
+ }
$include_blog_users = ( $type == 'search' ? get_users( array( 'blog_id' => $id, 'fields' => 'ID' ) ) : array() );
$exclude_blog_users = ( $type == 'add' ? get_users( array( 'blog_id' => $id, 'fields' => 'ID' ) ) : array() );
@@ -185,7 +234,7 @@ function wp_ajax_autocomplete_user() {
$return[] = array(
/* translators: 1: user_login, 2: user_email */
'label' => sprintf( __( '%1$s (%2$s)' ), $user->user_login, $user->user_email ),
- 'value' => $user->user_login,
+ 'value' => $user->$field,
);
}
@@ -193,21 +242,17 @@ function wp_ajax_autocomplete_user() {
}
function wp_ajax_dashboard_widgets() {
- require ABSPATH . 'wp-admin/includes/dashboard.php';
+ require_once ABSPATH . 'wp-admin/includes/dashboard.php';
+
+ $pagenow = $_GET['pagenow'];
+ if ( $pagenow === 'dashboard-user' || $pagenow === 'dashboard-network' || $pagenow === 'dashboard' ) {
+ set_current_screen( $pagenow );
+ }
switch ( $_GET['widget'] ) {
- case 'dashboard_incoming_links' :
- wp_dashboard_incoming_links();
- break;
case 'dashboard_primary' :
wp_dashboard_primary();
break;
- case 'dashboard_secondary' :
- wp_dashboard_secondary();
- break;
- case 'dashboard_plugins' :
- wp_dashboard_plugins();
- break;
}
wp_die();
}
@@ -225,16 +270,17 @@ function wp_ajax_logged_in() {
*
* Contrary to normal success AJAX response ("1"), die with time() on success.
*
- * @since 2.7
+ * @since 2.7.0
*
* @param int $comment_id
* @return die
*/
function _wp_ajax_delete_comment_response( $comment_id, $delta = -1 ) {
- $total = (int) @$_POST['_total'];
- $per_page = (int) @$_POST['_per_page'];
- $page = (int) @$_POST['_page'];
- $url = esc_url_raw( @$_POST['_url'] );
+ $total = isset( $_POST['_total'] ) ? (int) $_POST['_total'] : 0;
+ $per_page = isset( $_POST['_per_page'] ) ? (int) $_POST['_per_page'] : 0;
+ $page = isset( $_POST['_page'] ) ? (int) $_POST['_page'] : 0;
+ $url = isset( $_POST['_url'] ) ? esc_url_raw( $_POST['_url'] ) : '';
+
// JS didn't send us everything we need to know. Just die with success message
if ( !$total || !$per_page || !$page || !$url )
wp_die( time() );
@@ -331,7 +377,7 @@ function _wp_ajax_add_hierarchical_term() {
$term_id = $parent->term_id;
while ( $parent->parent ) { // get the top parent
- $parent = &get_term( $parent->parent, $taxonomy->name );
+ $parent = get_term( $parent->parent, $taxonomy->name );
if ( is_wp_error( $parent ) )
break;
$term_id = $parent->term_id;
@@ -512,7 +558,7 @@ function wp_ajax_delete_page( $action ) {
if ( !current_user_can( 'delete_page', $id ) )
wp_die( -1 );
- if ( !get_page( $id ) )
+ if ( ! get_post( $id ) )
wp_die( 1 );
if ( wp_delete_post( $id ) )
@@ -536,7 +582,7 @@ function wp_ajax_dim_comment() {
wp_die( -1 );
$current = wp_get_comment_status( $comment->comment_ID );
- if ( $_POST['new'] == $current )
+ if ( isset( $_POST['new'] ) && $_POST['new'] == $current )
wp_die( time() );
check_ajax_referer( "approve-comment_$id" );
@@ -564,7 +610,7 @@ function wp_ajax_add_link_category( $action ) {
check_ajax_referer( $action );
if ( !current_user_can( 'manage_categories' ) )
wp_die( -1 );
- $names = explode(',', $_POST['newcat']);
+ $names = explode(',', wp_unslash( $_POST['newcat'] ) );
$x = new WP_Ajax_Response();
foreach ( $names as $cat_name ) {
$cat_name = trim($cat_name);
@@ -577,7 +623,7 @@ function wp_ajax_add_link_category( $action ) {
continue;
else if ( is_array( $cat_id ) )
$cat_id = $cat_id['term_id'];
- $cat_name = esc_html(stripslashes($cat_name));
+ $cat_name = esc_html( $cat_name );
$x->add( array(
'what' => 'link-category',
'id' => $cat_id,
@@ -615,9 +661,7 @@ function wp_ajax_add_tag() {
$x->send();
}
- set_current_screen( $_POST['screen'] );
-
- $wp_list_table = _get_list_table('WP_Terms_List_Table');
+ $wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => $_POST['screen'] ) );
$level = 0;
if ( is_taxonomy_hierarchical($taxonomy) ) {
@@ -658,7 +702,7 @@ function wp_ajax_get_tagcloud() {
$tags = get_terms( $taxonomy, array( 'number' => 45, 'orderby' => 'count', 'order' => 'DESC' ) );
if ( empty( $tags ) )
- wp_die( isset( $tax->no_tagcloud ) ? $tax->no_tagcloud : __('No tags found!') );
+ wp_die( $tax->labels->not_found );
if ( is_wp_error( $tags ) )
wp_die( $tags->get_error_message() );
@@ -686,11 +730,18 @@ function wp_ajax_get_comments( $action ) {
check_ajax_referer( $action );
- set_current_screen( 'edit-comments' );
+ if ( empty( $post_id ) && ! empty( $_REQUEST['p'] ) ) {
+ $id = absint( $_REQUEST['p'] );
+ if ( ! empty( $id ) )
+ $post_id = $id;
+ }
- $wp_list_table = _get_list_table('WP_Post_Comments_List_Table');
+ if ( empty( $post_id ) )
+ wp_die( -1 );
- if ( !current_user_can( 'edit_post', $post_id ) )
+ $wp_list_table = _get_list_table( 'WP_Post_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
+
+ if ( ! current_user_can( 'edit_post', $post_id ) )
wp_die( -1 );
$wp_list_table->prepare_items();
@@ -723,27 +774,30 @@ function wp_ajax_replyto_comment( $action ) {
check_ajax_referer( $action, '_ajax_nonce-replyto-comment' );
- set_current_screen( 'edit-comments' );
-
$comment_post_ID = (int) $_POST['comment_post_ID'];
+ $post = get_post( $comment_post_ID );
+ if ( ! $post )
+ wp_die( -1 );
+
if ( !current_user_can( 'edit_post', $comment_post_ID ) )
wp_die( -1 );
- $status = $wpdb->get_var( $wpdb->prepare("SELECT post_status FROM $wpdb->posts WHERE ID = %d", $comment_post_ID) );
-
- if ( empty($status) )
+ if ( empty( $post->post_status ) )
wp_die( 1 );
- elseif ( in_array($status, array('draft', 'pending', 'trash') ) )
+ elseif ( in_array($post->post_status, array('draft', 'pending', 'trash') ) )
wp_die( __('ERROR: you are replying to a comment on a draft post.') );
$user = wp_get_current_user();
if ( $user->exists() ) {
$user_ID = $user->ID;
- $comment_author = $wpdb->escape($user->display_name);
- $comment_author_email = $wpdb->escape($user->user_email);
- $comment_author_url = $wpdb->escape($user->user_url);
+ $comment_author = wp_slash( $user->display_name );
+ $comment_author_email = wp_slash( $user->user_email );
+ $comment_author_url = wp_slash( $user->user_url );
$comment_content = trim($_POST['content']);
if ( current_user_can( 'unfiltered_html' ) ) {
+ if ( ! isset( $_POST['_wp_unfiltered_html_comment'] ) )
+ $_POST['_wp_unfiltered_html_comment'] = '';
+
if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {
kses_remove_filters(); // start with a clean slate
kses_init_filters(); // set up the filters
@@ -756,16 +810,12 @@ function wp_ajax_replyto_comment( $action ) {
if ( '' == $comment_content )
wp_die( __( 'ERROR: please type a comment.' ) );
- $comment_parent = absint($_POST['comment_ID']);
+ $comment_parent = 0;
+ if ( isset( $_POST['comment_ID'] ) )
+ $comment_parent = absint( $_POST['comment_ID'] );
$comment_auto_approved = false;
$commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_content', 'comment_type', 'comment_parent', 'user_ID');
- $comment_id = wp_new_comment( $commentdata );
- $comment = get_comment($comment_id);
- if ( ! $comment ) wp_die( 1 );
-
- $position = ( isset($_POST['position']) && (int) $_POST['position'] ) ? (int) $_POST['position'] : '-1';
-
// automatically approve parent comment
if ( !empty($_POST['approve_parent']) ) {
$parent = get_comment( $comment_parent );
@@ -776,20 +826,25 @@ function wp_ajax_replyto_comment( $action ) {
}
}
+ $comment_id = wp_new_comment( $commentdata );
+ $comment = get_comment($comment_id);
+ if ( ! $comment ) wp_die( 1 );
+
+ $position = ( isset($_POST['position']) && (int) $_POST['position'] ) ? (int) $_POST['position'] : '-1';
+
ob_start();
- if ( 'dashboard' == $_REQUEST['mode'] ) {
- require_once( ABSPATH . 'wp-admin/includes/dashboard.php' );
- _wp_dashboard_recent_comments_row( $comment );
+ if ( isset( $_REQUEST['mode'] ) && 'dashboard' == $_REQUEST['mode'] ) {
+ require_once( ABSPATH . 'wp-admin/includes/dashboard.php' );
+ _wp_dashboard_recent_comments_row( $comment );
+ } else {
+ if ( isset( $_REQUEST['mode'] ) && 'single' == $_REQUEST['mode'] ) {
+ $wp_list_table = _get_list_table('WP_Post_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
} else {
- if ( 'single' == $_REQUEST['mode'] ) {
- $wp_list_table = _get_list_table('WP_Post_Comments_List_Table');
- } else {
- $wp_list_table = _get_list_table('WP_Comments_List_Table');
- }
- $wp_list_table->single_row( $comment );
+ $wp_list_table = _get_list_table('WP_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
}
- $comment_list_item = ob_get_contents();
- ob_end_clean();
+ $wp_list_table->single_row( $comment );
+ }
+ $comment_list_item = ob_get_clean();
$response = array(
'what' => 'comment',
@@ -811,8 +866,6 @@ function wp_ajax_edit_comment() {
check_ajax_referer( 'replyto-comment', '_ajax_nonce-replyto-comment' );
- set_current_screen( 'edit-comments' );
-
$comment_id = (int) $_POST['comment_ID'];
if ( ! current_user_can( 'edit_comment', $comment_id ) )
wp_die( -1 );
@@ -820,21 +873,23 @@ function wp_ajax_edit_comment() {
if ( '' == $_POST['content'] )
wp_die( __( 'ERROR: please type a comment.' ) );
- $_POST['comment_status'] = $_POST['status'];
+ if ( isset( $_POST['status'] ) )
+ $_POST['comment_status'] = $_POST['status'];
edit_comment();
$position = ( isset($_POST['position']) && (int) $_POST['position']) ? (int) $_POST['position'] : '-1';
$comments_status = isset($_POST['comments_listing']) ? $_POST['comments_listing'] : '';
$checkbox = ( isset($_POST['checkbox']) && true == $_POST['checkbox'] ) ? 1 : 0;
- $wp_list_table = _get_list_table( $checkbox ? 'WP_Comments_List_Table' : 'WP_Post_Comments_List_Table' );
+ $wp_list_table = _get_list_table( $checkbox ? 'WP_Comments_List_Table' : 'WP_Post_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
$comment = get_comment( $comment_id );
+ if ( empty( $comment->comment_ID ) )
+ wp_die( -1 );
ob_start();
- $wp_list_table->single_row( $comment );
- $comment_list_item = ob_get_contents();
- ob_end_clean();
+ $wp_list_table->single_row( $comment );
+ $comment_list_item = ob_get_clean();
$x = new WP_Ajax_Response();
@@ -901,6 +956,14 @@ function wp_ajax_add_menu_item() {
}
}
+ /**
+ * Filter the Walker class used when adding nav menu items.
+ *
+ * @since 3.4.0
+ *
+ * @param string $class The walker class to use. Default 'Walker_Nav_Menu_Edit'.
+ * @param int $menu_id The menu id, derived from $_POST['menu'].
+ */
$walker_class_name = apply_filters( 'wp_edit_nav_menu_walker', 'Walker_Nav_Menu_Edit', $_POST['menu'] );
if ( ! class_exists( $walker_class_name ) )
@@ -916,6 +979,7 @@ function wp_ajax_add_menu_item() {
);
echo walk_nav_menu_tree( $menu_items, 0, (object) $args );
}
+ wp_die();
}
function wp_ajax_add_meta() {
@@ -937,7 +1001,7 @@ function wp_ajax_add_meta() {
$_POST['post_type'] = $post->post_type;
$_POST['post_status'] = 'draft';
$now = current_time('timestamp', 1);
- $_POST['post_title'] = sprintf('Draft created on %s at %s', date(get_option('date_format'), $now), date(get_option('time_format'), $now));
+ $_POST['post_title'] = sprintf( __( 'Draft created on %1$s at %2$s' ), date( get_option( 'date_format' ), $now ), date( get_option( 'time_format' ), $now ) );
if ( $pid = edit_post() ) {
if ( is_wp_error( $pid ) ) {
@@ -969,8 +1033,8 @@ function wp_ajax_add_meta() {
) );
} else { // Update?
$mid = (int) key( $_POST['meta'] );
- $key = stripslashes( $_POST['meta'][$mid]['key'] );
- $value = stripslashes( $_POST['meta'][$mid]['value'] );
+ $key = wp_unslash( $_POST['meta'][$mid]['key'] );
+ $value = wp_unslash( $_POST['meta'][$mid]['value'] );
if ( '' == trim($key) )
wp_die( __( 'Please provide a custom field name.' ) );
if ( '' == trim($value) )
@@ -1018,123 +1082,24 @@ function wp_ajax_add_user( $action ) {
) );
$x->send();
}
- $user_object = new WP_User( $user_id );
+ $user_object = get_userdata( $user_id );
$wp_list_table = _get_list_table('WP_Users_List_Table');
+ $role = current( $user_object->roles );
+
$x = new WP_Ajax_Response( array(
'what' => 'user',
'id' => $user_id,
- 'data' => $wp_list_table->single_row( $user_object, '', $user_object->roles[0] ),
+ 'data' => $wp_list_table->single_row( $user_object, '', $role ),
'supplemental' => array(
'show-link' => sprintf(__( 'User %s added' ), "user-$user_id", $user_object->user_login),
- 'role' => $user_object->roles[0]
+ 'role' => $role,
)
) );
$x->send();
}
-function wp_ajax_autosave() {
- global $login_grace_period;
-
- define( 'DOING_AUTOSAVE', true );
-
- $nonce_age = check_ajax_referer( 'autosave', 'autosavenonce' );
-
- $_POST['post_category'] = explode(",", $_POST['catslist']);
- if ( $_POST['post_type'] == 'page' || empty($_POST['post_category']) )
- unset($_POST['post_category']);
-
- $do_autosave = (bool) $_POST['autosave'];
- $do_lock = true;
-
- $data = $alert = '';
- /* translators: draft saved date format, see http://php.net/date */
- $draft_saved_date_format = __('g:i:s a');
- /* translators: %s: date and time */
- $message = sprintf( __('Draft saved at %s.'), date_i18n( $draft_saved_date_format ) );
-
- $supplemental = array();
- if ( isset($login_grace_period) )
- $alert .= sprintf( __('Your login has expired. Please open a new browser window and log in again . '), add_query_arg( 'interim-login', 1, wp_login_url() ) );
-
- $id = $revision_id = 0;
-
- $post_ID = (int) $_POST['post_ID'];
- $_POST['ID'] = $post_ID;
- $post = get_post($post_ID);
- if ( 'auto-draft' == $post->post_status )
- $_POST['post_status'] = 'draft';
-
- if ( $last = wp_check_post_lock( $post->ID ) ) {
- $do_autosave = $do_lock = false;
-
- $last_user = get_userdata( $last );
- $last_user_name = $last_user ? $last_user->display_name : __( 'Someone' );
- $data = __( 'Autosave disabled.' );
-
- $supplemental['disable_autosave'] = 'disable';
- $alert .= sprintf( __( '%s is currently editing this article. If you update it, you will overwrite the changes.' ), esc_html( $last_user_name ) );
- }
-
- if ( 'page' == $post->post_type ) {
- if ( !current_user_can('edit_page', $post_ID) )
- wp_die( __( 'You are not allowed to edit this page.' ) );
- } else {
- if ( !current_user_can('edit_post', $post_ID) )
- wp_die( __( 'You are not allowed to edit this post.' ) );
- }
-
- if ( $do_autosave ) {
- // Drafts and auto-drafts are just overwritten by autosave
- if ( 'auto-draft' == $post->post_status || 'draft' == $post->post_status ) {
- $id = edit_post();
- } else { // Non drafts are not overwritten. The autosave is stored in a special post revision.
- $revision_id = wp_create_post_autosave( $post->ID );
- if ( is_wp_error($revision_id) )
- $id = $revision_id;
- else
- $id = $post->ID;
- }
- $data = $message;
- } else {
- if ( ! empty( $_POST['auto_draft'] ) )
- $id = 0; // This tells us it didn't actually save
- else
- $id = $post->ID;
- }
-
- if ( $do_lock && empty( $_POST['auto_draft'] ) && $id && is_numeric( $id ) ) {
- $lock_result = wp_set_post_lock( $id );
- $supplemental['active-post-lock'] = implode( ':', $lock_result );
- }
-
- if ( $nonce_age == 2 ) {
- $supplemental['replace-autosavenonce'] = wp_create_nonce('autosave');
- $supplemental['replace-getpermalinknonce'] = wp_create_nonce('getpermalink');
- $supplemental['replace-samplepermalinknonce'] = wp_create_nonce('samplepermalink');
- $supplemental['replace-closedpostboxesnonce'] = wp_create_nonce('closedpostboxes');
- $supplemental['replace-_ajax_linking_nonce'] = wp_create_nonce( 'internal-linking' );
- if ( $id ) {
- if ( $_POST['post_type'] == 'post' )
- $supplemental['replace-_wpnonce'] = wp_create_nonce('update-post_' . $id);
- elseif ( $_POST['post_type'] == 'page' )
- $supplemental['replace-_wpnonce'] = wp_create_nonce('update-page_' . $id);
- }
- }
-
- if ( ! empty($alert) )
- $supplemental['alert'] = $alert;
-
- $x = new WP_Ajax_Response( array(
- 'what' => 'autosave',
- 'id' => $id,
- 'data' => $id ? $data : '',
- 'supplemental' => $supplemental
- ) );
- $x->send();
-}
-
function wp_ajax_closed_postboxes() {
check_ajax_referer( 'closedpostboxes', 'closedpostboxesnonce' );
$closed = isset( $_POST['closed'] ) ? explode( ',', $_POST['closed']) : array();
@@ -1208,7 +1173,16 @@ function wp_ajax_menu_get_metabox() {
}
if ( ! empty( $_POST['item-object'] ) && isset( $items[$_POST['item-object']] ) ) {
- $item = apply_filters( 'nav_menu_meta_box_object', $items[ $_POST['item-object'] ] );
+ $menus_meta_box_object = $items[ $_POST['item-object'] ];
+ /**
+ * Filter a nav menu meta box object.
+ *
+ * @since 3.0.0
+ *
+ * @param object $menus_meta_box_object A nav menu meta box object, such as Page,
+ * Post, Category, Tag, etc.
+ */
+ $item = apply_filters( 'nav_menu_meta_box_object', $menus_meta_box_object );
ob_start();
call_user_func_array($callback, array(
null,
@@ -1237,7 +1211,7 @@ function wp_ajax_wp_link_ajax() {
$args = array();
if ( isset( $_POST['search'] ) )
- $args['s'] = stripslashes( $_POST['search'] );
+ $args['s'] = wp_unslash( $_POST['search'] );
$args['pagenum'] = ! empty( $_POST['page'] ) ? absint( $_POST['page'] ) : 1;
require(ABSPATH . WPINC . '/class-wp-editor.php');
@@ -1328,8 +1302,6 @@ function wp_ajax_inline_save() {
wp_die( __( 'You are not allowed to edit this post.' ) );
}
- set_current_screen( $_POST['screen'] );
-
if ( $last = wp_check_post_lock( $post_ID ) ) {
$last_user = get_userdata( $last );
$last_user_name = $last_user ? $last_user->display_name : __( 'Someone' );
@@ -1340,13 +1312,13 @@ function wp_ajax_inline_save() {
$data = &$_POST;
$post = get_post( $post_ID, ARRAY_A );
- $post = add_magic_quotes($post); //since it is from db
+ $post = wp_slash($post); //since it is from db
$data['content'] = $post['post_content'];
$data['excerpt'] = $post['post_excerpt'];
// rename
- $data['user_ID'] = $GLOBALS['user_ID'];
+ $data['user_ID'] = get_current_user_id();
if ( isset($data['post_parent']) )
$data['parent_id'] = $data['post_parent'];
@@ -1362,13 +1334,30 @@ function wp_ajax_inline_save() {
if ( empty($data['ping_status']) )
$data['ping_status'] = 'closed';
+ // Hack: wp_unique_post_slug() doesn't work for drafts, so we will fake that our post is published.
+ if ( ! empty( $data['post_name'] ) && in_array( $post['post_status'], array( 'draft', 'pending' ) ) ) {
+ $post['post_status'] = 'publish';
+ $data['post_name'] = wp_unique_post_slug( $data['post_name'], $post['ID'], $post['post_status'], $post['post_type'], $post['post_parent'] );
+ }
+
// update the post
edit_post();
- $wp_list_table = _get_list_table('WP_Posts_List_Table');
+ $wp_list_table = _get_list_table( 'WP_Posts_List_Table', array( 'screen' => $_POST['screen'] ) );
$mode = $_POST['post_view'];
- $wp_list_table->display_rows( array( get_post( $_POST['post_ID'] ) ) );
+
+ $level = 0;
+ $request_post = array( get_post( $_POST['post_ID'] ) );
+ $parent = $request_post[0]->post_parent;
+
+ while ( $parent > 0 ) {
+ $parent_post = get_post( $parent );
+ $parent = $parent_post->post_parent;
+ $level++;
+ }
+
+ $wp_list_table->display_rows( array( get_post( $_POST['post_ID'] ) ), $level );
wp_die();
}
@@ -1386,9 +1375,7 @@ function wp_ajax_inline_save_tax() {
if ( ! current_user_can( $tax->cap->edit_terms ) )
wp_die( -1 );
- set_current_screen( 'edit-' . $taxonomy );
-
- $wp_list_table = _get_list_table('WP_Terms_List_Table');
+ $wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => 'edit-' . $taxonomy ) );
if ( ! isset($_POST['tax_ID']) || ! ( $id = (int) $_POST['tax_ID'] ) )
wp_die( -1 );
@@ -1404,14 +1391,19 @@ function wp_ajax_inline_save_tax() {
wp_die( $tag->get_error_message() );
wp_die( __( 'Item not updated.' ) );
}
-
- echo $wp_list_table->single_row( $tag );
} else {
if ( is_wp_error($updated) && $updated->get_error_message() )
wp_die( $updated->get_error_message() );
wp_die( __( 'Item not updated.' ) );
}
-
+ $level = 0;
+ $parent = $tag->parent;
+ while ( $parent > 0 ) {
+ $parent_tag = get_term( $parent, $taxonomy );
+ $parent = $parent_tag->parent;
+ $level++;
+ }
+ $wp_list_table->single_row( $tag, $level );
wp_die();
}
@@ -1420,37 +1412,29 @@ function wp_ajax_find_posts() {
check_ajax_referer( 'find-posts' );
- if ( empty($_POST['ps']) )
- wp_die();
-
- if ( !empty($_POST['post_type']) && in_array( $_POST['post_type'], get_post_types() ) )
- $what = $_POST['post_type'];
- else
- $what = 'post';
-
- $s = stripslashes($_POST['ps']);
- preg_match_all('/".*?("|$)|((?<=[\\s",+])|^)[^\\s",+]+/', $s, $matches);
- $search_terms = array_map('_search_terms_tidy', $matches[0]);
+ $post_types = get_post_types( array( 'public' => true ), 'objects' );
+ unset( $post_types['attachment'] );
+ $s = wp_unslash( $_POST['ps'] );
$searchand = $search = '';
- foreach ( (array) $search_terms as $term ) {
- $term = esc_sql( like_escape( $term ) );
- $search .= "{$searchand}(($wpdb->posts.post_title LIKE '%{$term}%') OR ($wpdb->posts.post_content LIKE '%{$term}%'))";
- $searchand = ' AND ';
- }
- $term = esc_sql( like_escape( $s ) );
- if ( count($search_terms) > 1 && $search_terms[0] != $s )
- $search .= " OR ($wpdb->posts.post_title LIKE '%{$term}%') OR ($wpdb->posts.post_content LIKE '%{$term}%')";
+ $args = array(
+ 'post_type' => array_keys( $post_types ),
+ 'post_status' => 'any',
+ 'posts_per_page' => 50,
+ );
+ if ( '' !== $s )
+ $args['s'] = $s;
- $posts = $wpdb->get_results( "SELECT ID, post_title, post_status, post_date FROM $wpdb->posts WHERE post_type = '$what' AND post_status IN ('draft', 'publish') AND ($search) ORDER BY post_date_gmt DESC LIMIT 50" );
+ $posts = get_posts( $args );
- if ( ! $posts ) {
- $posttype = get_post_type_object($what);
- wp_die( $posttype->labels->not_found );
- }
+ if ( ! $posts )
+ wp_die( __('No items found.') );
- $html = ''.__('Title').' '.__('Date').' '.__('Status').' ';
+ $html = '';
- $x = new WP_Ajax_Response();
- $x->add( array(
- 'what' => $what,
- 'data' => $html
- ));
- $x->send();
-
+ wp_send_json_success( $html );
}
function wp_ajax_widgets_order() {
@@ -1530,9 +1509,22 @@ function wp_ajax_save_widget() {
unset( $_POST['savewidgets'], $_POST['action'] );
- do_action('load-widgets.php');
- do_action('widgets.php');
- do_action('sidebar_admin_setup');
+ /**
+ * Fires early when editing the widgets displayed in sidebars.
+ *
+ * @since 2.8.0
+ */
+ do_action( 'load-widgets.php' );
+
+ /**
+ * Fires early when editing the widgets displayed in sidebars.
+ *
+ * @since 2.8.0
+ */
+ do_action( 'widgets.php' );
+
+ /** This action is documented in wp-admin/widgets.php */
+ do_action( 'sidebar_admin_setup' );
$id_base = $_POST['id_base'];
$widget_id = $_POST['widget-id'];
@@ -1591,32 +1583,54 @@ function wp_ajax_save_widget() {
wp_die();
}
+function wp_ajax_update_widget() {
+ global $wp_customize;
+ $wp_customize->widgets->wp_ajax_update_widget();
+}
+
function wp_ajax_upload_attachment() {
check_ajax_referer( 'media-form' );
if ( ! current_user_can( 'upload_files' ) )
- wp_die( -1 );
+ wp_die();
if ( isset( $_REQUEST['post_id'] ) ) {
$post_id = $_REQUEST['post_id'];
if ( ! current_user_can( 'edit_post', $post_id ) )
- wp_die( -1 );
+ wp_die();
} else {
$post_id = null;
}
$post_data = isset( $_REQUEST['post_data'] ) ? $_REQUEST['post_data'] : array();
+ // If the context is custom header or background, make sure the uploaded file is an image.
+ if ( isset( $post_data['context'] ) && in_array( $post_data['context'], array( 'custom-header', 'custom-background' ) ) ) {
+ $wp_filetype = wp_check_filetype_and_ext( $_FILES['async-upload']['tmp_name'], $_FILES['async-upload']['name'], false );
+ if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) ) {
+ echo json_encode( array(
+ 'success' => false,
+ 'data' => array(
+ 'message' => __( 'The uploaded file is not a valid image. Please try again.' ),
+ 'filename' => $_FILES['async-upload']['name'],
+ )
+ ) );
+
+ wp_die();
+ }
+ }
+
$attachment_id = media_handle_upload( 'async-upload', $post_id, $post_data );
if ( is_wp_error( $attachment_id ) ) {
echo json_encode( array(
- 'type' => 'error',
- 'data' => array(
+ 'success' => false,
+ 'data' => array(
'message' => $attachment_id->get_error_message(),
'filename' => $_FILES['async-upload']['name'],
- ),
+ )
) );
+
wp_die();
}
@@ -1628,18 +1642,14 @@ function wp_ajax_upload_attachment() {
update_post_meta( $attachment_id, '_wp_attachment_is_custom_header', $post_data['theme'] );
}
- $post = get_post( $attachment_id );
+ if ( ! $attachment = wp_prepare_attachment_for_js( $attachment_id ) )
+ wp_die();
echo json_encode( array(
- 'type' => 'success',
- 'data' => array(
- 'id' => $attachment_id,
- 'title' => esc_attr( $post->post_title ),
- 'filename' => esc_html( basename( $post->guid ) ),
- 'url' => wp_get_attachment_url( $attachment_id ),
- 'meta' => wp_get_attachment_metadata( $attachment_id ),
- ),
+ 'success' => true,
+ 'data' => $attachment,
) );
+
wp_die();
}
@@ -1671,31 +1681,42 @@ function wp_ajax_image_editor() {
}
function wp_ajax_set_post_thumbnail() {
+ $json = ! empty( $_REQUEST['json'] ); // New-style request
+
$post_ID = intval( $_POST['post_id'] );
- if ( !current_user_can( 'edit_post', $post_ID ) )
+ if ( ! current_user_can( 'edit_post', $post_ID ) )
wp_die( -1 );
+
$thumbnail_id = intval( $_POST['thumbnail_id'] );
- check_ajax_referer( "set_post_thumbnail-$post_ID" );
+ if ( $json )
+ check_ajax_referer( "update-post_$post_ID" );
+ else
+ check_ajax_referer( "set_post_thumbnail-$post_ID" );
if ( $thumbnail_id == '-1' ) {
- if ( delete_post_thumbnail( $post_ID ) )
- wp_die( _wp_post_thumbnail_html( null, $post_ID ) );
- else
+ if ( delete_post_thumbnail( $post_ID ) ) {
+ $return = _wp_post_thumbnail_html( null, $post_ID );
+ $json ? wp_send_json_success( $return ) : wp_die( $return );
+ } else {
wp_die( 0 );
+ }
+ }
+
+ if ( set_post_thumbnail( $post_ID, $thumbnail_id ) ) {
+ $return = _wp_post_thumbnail_html( $thumbnail_id, $post_ID );
+ $json ? wp_send_json_success( $return ) : wp_die( $return );
}
- if ( set_post_thumbnail( $post_ID, $thumbnail_id ) )
- wp_die( _wp_post_thumbnail_html( $thumbnail_id, $post_ID ) );
wp_die( 0 );
}
function wp_ajax_date_format() {
- wp_die( date_i18n( sanitize_option( 'date_format', $_POST['date'] ) ) );
+ wp_die( date_i18n( sanitize_option( 'date_format', wp_unslash( $_POST['date'] ) ) ) );
}
function wp_ajax_time_format() {
- wp_die( date_i18n( sanitize_option( 'time_format', $_POST['date'] ) ) );
+ wp_die( date_i18n( sanitize_option( 'time_format', wp_unslash( $_POST['date'] ) ) ) );
}
function wp_ajax_wp_fullscreen_save_post() {
@@ -1711,20 +1732,12 @@ function wp_ajax_wp_fullscreen_save_post() {
elseif ( isset( $_POST['post_type'] ) && post_type_exists( $_POST['post_type'] ) )
$post_type = $_POST['post_type'];
- check_ajax_referer('update-' . $post_type . '_' . $post_id, '_wpnonce');
+ check_ajax_referer('update-post_' . $post_id, '_wpnonce');
$post_id = edit_post();
- if ( is_wp_error($post_id) ) {
- if ( $post_id->get_error_message() )
- $message = $post_id->get_error_message();
- else
- $message = __('Save failed');
-
- echo json_encode( array( 'message' => $message, 'last_edited' => '' ) );
- wp_die();
- } else {
- $message = __('Saved.');
+ if ( is_wp_error( $post_id ) ) {
+ wp_send_json_error();
}
if ( $post ) {
@@ -1735,15 +1748,14 @@ function wp_ajax_wp_fullscreen_save_post() {
$last_time = date_i18n( get_option('time_format') );
}
- if ( $last_id = get_post_meta($post_id, '_edit_last', true) ) {
- $last_user = get_userdata($last_id);
+ if ( $last_id = get_post_meta( $post_id, '_edit_last', true ) ) {
+ $last_user = get_userdata( $last_id );
$last_edited = sprintf( __('Last edited by %1$s on %2$s at %3$s'), esc_html( $last_user->display_name ), $last_date, $last_time );
} else {
$last_edited = sprintf( __('Last edited on %1$s at %2$s'), $last_date, $last_time );
}
- echo json_encode( array( 'message' => $message, 'last_edited' => $last_edited ) );
- wp_die();
+ wp_send_json_success( array( 'last_edited' => $last_edited ) );
}
function wp_ajax_wp_remove_post_lock() {
@@ -1753,7 +1765,7 @@ function wp_ajax_wp_remove_post_lock() {
if ( ! $post = get_post( $post_id ) )
wp_die( 0 );
- check_ajax_referer( 'update-' . $post->post_type . '_' . $post_id );
+ check_ajax_referer( 'update-post_' . $post_id );
if ( ! current_user_can( 'edit_post', $post_id ) )
wp_die( -1 );
@@ -1762,7 +1774,15 @@ function wp_ajax_wp_remove_post_lock() {
if ( $active_lock[1] != get_current_user_id() )
wp_die( 0 );
- $new_lock = ( time() - apply_filters( 'wp_check_post_lock_window', AUTOSAVE_INTERVAL * 2 ) + 5 ) . ':' . $active_lock[1];
+ /**
+ * Filter the post lock window duration.
+ *
+ * @since 3.3.0
+ *
+ * @param int $interval The interval in seconds the post lock duration
+ * should last, plus 5 seconds. Default 150.
+ */
+ $new_lock = ( time() - apply_filters( 'wp_check_post_lock_window', 150 ) + 5 ) . ':' . $active_lock[1];
update_post_meta( $post_id, '_edit_lock', $new_lock, implode( ':', $active_lock ) );
wp_die( 1 );
}
@@ -1785,3 +1805,447 @@ function wp_ajax_dismiss_wp_pointer() {
update_user_meta( get_current_user_id(), 'dismissed_wp_pointers', $dismissed );
wp_die( 1 );
}
+
+/**
+ * Get an attachment.
+ *
+ * @since 3.5.0
+ */
+function wp_ajax_get_attachment() {
+ if ( ! isset( $_REQUEST['id'] ) )
+ wp_send_json_error();
+
+ if ( ! $id = absint( $_REQUEST['id'] ) )
+ wp_send_json_error();
+
+ if ( ! $post = get_post( $id ) )
+ wp_send_json_error();
+
+ if ( 'attachment' != $post->post_type )
+ wp_send_json_error();
+
+ if ( ! current_user_can( 'upload_files' ) )
+ wp_send_json_error();
+
+ if ( ! $attachment = wp_prepare_attachment_for_js( $id ) )
+ wp_send_json_error();
+
+ wp_send_json_success( $attachment );
+}
+
+/**
+ * Query for attachments.
+ *
+ * @since 3.5.0
+ */
+function wp_ajax_query_attachments() {
+ if ( ! current_user_can( 'upload_files' ) )
+ wp_send_json_error();
+
+ $query = isset( $_REQUEST['query'] ) ? (array) $_REQUEST['query'] : array();
+ $query = array_intersect_key( $query, array_flip( array(
+ 's', 'order', 'orderby', 'posts_per_page', 'paged', 'post_mime_type',
+ 'post_parent', 'post__in', 'post__not_in',
+ ) ) );
+
+ $query['post_type'] = 'attachment';
+ $query['post_status'] = 'inherit';
+ if ( current_user_can( get_post_type_object( 'attachment' )->cap->read_private_posts ) )
+ $query['post_status'] .= ',private';
+
+ /**
+ * Filter the arguments passed to WP_Query during an AJAX
+ * call for querying attachments.
+ *
+ * @since 3.7.0
+ *
+ * @see WP_Query::parse_query()
+ *
+ * @param array $query An array of query variables.
+ */
+ $query = apply_filters( 'ajax_query_attachments_args', $query );
+ $query = new WP_Query( $query );
+
+ $posts = array_map( 'wp_prepare_attachment_for_js', $query->posts );
+ $posts = array_filter( $posts );
+
+ wp_send_json_success( $posts );
+}
+
+/**
+ * Save attachment attributes.
+ *
+ * @since 3.5.0
+ */
+function wp_ajax_save_attachment() {
+ if ( ! isset( $_REQUEST['id'] ) || ! isset( $_REQUEST['changes'] ) )
+ wp_send_json_error();
+
+ if ( ! $id = absint( $_REQUEST['id'] ) )
+ wp_send_json_error();
+
+ check_ajax_referer( 'update-post_' . $id, 'nonce' );
+
+ if ( ! current_user_can( 'edit_post', $id ) )
+ wp_send_json_error();
+
+ $changes = $_REQUEST['changes'];
+ $post = get_post( $id, ARRAY_A );
+
+ if ( 'attachment' != $post['post_type'] )
+ wp_send_json_error();
+
+ if ( isset( $changes['title'] ) )
+ $post['post_title'] = $changes['title'];
+
+ if ( isset( $changes['caption'] ) )
+ $post['post_excerpt'] = $changes['caption'];
+
+ if ( isset( $changes['description'] ) )
+ $post['post_content'] = $changes['description'];
+
+ if ( isset( $changes['alt'] ) ) {
+ $alt = wp_unslash( $changes['alt'] );
+ if ( $alt != get_post_meta( $id, '_wp_attachment_image_alt', true ) ) {
+ $alt = wp_strip_all_tags( $alt, true );
+ update_post_meta( $id, '_wp_attachment_image_alt', wp_slash( $alt ) );
+ }
+ }
+
+ wp_update_post( $post );
+ wp_send_json_success();
+}
+
+/**
+ * Save backwards compatible attachment attributes.
+ *
+ * @since 3.5.0
+ */
+function wp_ajax_save_attachment_compat() {
+ if ( ! isset( $_REQUEST['id'] ) )
+ wp_send_json_error();
+
+ if ( ! $id = absint( $_REQUEST['id'] ) )
+ wp_send_json_error();
+
+ if ( empty( $_REQUEST['attachments'] ) || empty( $_REQUEST['attachments'][ $id ] ) )
+ wp_send_json_error();
+ $attachment_data = $_REQUEST['attachments'][ $id ];
+
+ check_ajax_referer( 'update-post_' . $id, 'nonce' );
+
+ if ( ! current_user_can( 'edit_post', $id ) )
+ wp_send_json_error();
+
+ $post = get_post( $id, ARRAY_A );
+
+ if ( 'attachment' != $post['post_type'] )
+ wp_send_json_error();
+
+ /** This filter is documented in wp-admin/includes/media.php */
+ $post = apply_filters( 'attachment_fields_to_save', $post, $attachment_data );
+
+ if ( isset( $post['errors'] ) ) {
+ $errors = $post['errors']; // @todo return me and display me!
+ unset( $post['errors'] );
+ }
+
+ wp_update_post( $post );
+
+ foreach ( get_attachment_taxonomies( $post ) as $taxonomy ) {
+ if ( isset( $attachment_data[ $taxonomy ] ) )
+ wp_set_object_terms( $id, array_map( 'trim', preg_split( '/,+/', $attachment_data[ $taxonomy ] ) ), $taxonomy, false );
+ }
+
+ if ( ! $attachment = wp_prepare_attachment_for_js( $id ) )
+ wp_send_json_error();
+
+ wp_send_json_success( $attachment );
+}
+
+function wp_ajax_save_attachment_order() {
+ if ( ! isset( $_REQUEST['post_id'] ) )
+ wp_send_json_error();
+
+ if ( ! $post_id = absint( $_REQUEST['post_id'] ) )
+ wp_send_json_error();
+
+ if ( empty( $_REQUEST['attachments'] ) )
+ wp_send_json_error();
+
+ check_ajax_referer( 'update-post_' . $post_id, 'nonce' );
+
+ $attachments = $_REQUEST['attachments'];
+
+ if ( ! current_user_can( 'edit_post', $post_id ) )
+ wp_send_json_error();
+
+ $post = get_post( $post_id, ARRAY_A );
+
+ foreach ( $attachments as $attachment_id => $menu_order ) {
+ if ( ! current_user_can( 'edit_post', $attachment_id ) )
+ continue;
+ if ( ! $attachment = get_post( $attachment_id ) )
+ continue;
+ if ( 'attachment' != $attachment->post_type )
+ continue;
+
+ wp_update_post( array( 'ID' => $attachment_id, 'menu_order' => $menu_order ) );
+ }
+
+ wp_send_json_success();
+}
+
+/**
+ * Generates the HTML to send an attachment to the editor.
+ * Backwards compatible with the media_send_to_editor filter and the chain
+ * of filters that follow.
+ *
+ * @since 3.5.0
+ */
+function wp_ajax_send_attachment_to_editor() {
+ check_ajax_referer( 'media-send-to-editor', 'nonce' );
+
+ $attachment = wp_unslash( $_POST['attachment'] );
+
+ $id = intval( $attachment['id'] );
+
+ if ( ! $post = get_post( $id ) )
+ wp_send_json_error();
+
+ if ( 'attachment' != $post->post_type )
+ wp_send_json_error();
+
+ if ( current_user_can( 'edit_post', $id ) ) {
+ // If this attachment is unattached, attach it. Primarily a back compat thing.
+ if ( 0 == $post->post_parent && $insert_into_post_id = intval( $_POST['post_id'] ) ) {
+ wp_update_post( array( 'ID' => $id, 'post_parent' => $insert_into_post_id ) );
+ }
+ }
+
+ $rel = $url = '';
+ $html = $title = isset( $attachment['post_title'] ) ? $attachment['post_title'] : '';
+ if ( ! empty( $attachment['url'] ) ) {
+ $url = $attachment['url'];
+ if ( strpos( $url, 'attachment_id') || get_attachment_link( $id ) == $url )
+ $rel = ' rel="attachment wp-att-' . $id . '"';
+ $html = '' . $html . ' ';
+ }
+
+ remove_filter( 'media_send_to_editor', 'image_media_send_to_editor' );
+
+ if ( 'image' === substr( $post->post_mime_type, 0, 5 ) ) {
+ $align = isset( $attachment['align'] ) ? $attachment['align'] : 'none';
+ $size = isset( $attachment['image-size'] ) ? $attachment['image-size'] : 'medium';
+ $alt = isset( $attachment['image_alt'] ) ? $attachment['image_alt'] : '';
+ $caption = isset( $attachment['post_excerpt'] ) ? $attachment['post_excerpt'] : '';
+ $title = ''; // We no longer insert title tags into tags, as they are redundant.
+ $html = get_image_send_to_editor( $id, $caption, $title, $align, $url, (bool) $rel, $size, $alt );
+ } elseif ( 'video' === substr( $post->post_mime_type, 0, 5 ) || 'audio' === substr( $post->post_mime_type, 0, 5 ) ) {
+ $html = stripslashes_deep( $_POST['html'] );
+ }
+
+ /** This filter is documented in wp-admin/includes/media.php */
+ $html = apply_filters( 'media_send_to_editor', $html, $id, $attachment );
+
+ wp_send_json_success( $html );
+}
+
+/**
+ * Generates the HTML to send a non-image embed link to the editor.
+ *
+ * Backwards compatible with the following filters:
+ * - file_send_to_editor_url
+ * - audio_send_to_editor_url
+ * - video_send_to_editor_url
+ *
+ * @since 3.5.0
+ */
+function wp_ajax_send_link_to_editor() {
+ check_ajax_referer( 'media-send-to-editor', 'nonce' );
+
+ if ( ! $src = wp_unslash( $_POST['src'] ) )
+ wp_send_json_error();
+
+ if ( ! strpos( $src, '://' ) )
+ $src = 'http://' . $src;
+
+ if ( ! $src = esc_url_raw( $src ) )
+ wp_send_json_error();
+
+ if ( ! $title = trim( wp_unslash( $_POST['title'] ) ) )
+ $title = wp_basename( $src );
+
+ $html = '';
+ if ( $title )
+ $html = '' . $title . ' ';
+
+ // Figure out what filter to run:
+ $type = 'file';
+ if ( ( $ext = preg_replace( '/^.+?\.([^.]+)$/', '$1', $src ) ) && ( $ext_type = wp_ext2type( $ext ) )
+ && ( 'audio' == $ext_type || 'video' == $ext_type ) )
+ $type = $ext_type;
+
+ /** This filter is documented in wp-admin/includes/media.php */
+ $html = apply_filters( $type . '_send_to_editor_url', $html, $src, $title );
+
+ wp_send_json_success( $html );
+}
+
+/**
+ * Heartbeat API (experimental)
+ *
+ * Runs when the user is logged in.
+ */
+function wp_ajax_heartbeat() {
+ if ( empty( $_POST['_nonce'] ) )
+ wp_send_json_error();
+
+ $response = array();
+
+ if ( false === wp_verify_nonce( $_POST['_nonce'], 'heartbeat-nonce' ) ) {
+ // User is logged in but nonces have expired.
+ $response['nonces_expired'] = true;
+ wp_send_json($response);
+ }
+
+ // screen_id is the same as $current_screen->id and the JS global 'pagenow'
+ if ( ! empty($_POST['screen_id']) )
+ $screen_id = sanitize_key($_POST['screen_id']);
+ else
+ $screen_id = 'front';
+
+ if ( ! empty($_POST['data']) ) {
+ $data = wp_unslash( (array) $_POST['data'] );
+
+ /**
+ * Filter the Heartbeat response received.
+ *
+ * @since 3.6.0
+ *
+ * @param array|object $response The Heartbeat response object or array.
+ * @param array $data The $_POST data sent.
+ * @param string $screen_id The screen id.
+ */
+ $response = apply_filters( 'heartbeat_received', $response, $data, $screen_id );
+ }
+
+ /**
+ * Filter the Heartbeat response sent.
+ *
+ * @since 3.6.0
+ *
+ * @param array|object $response The Heartbeat response object or array.
+ * @param string $screen_id The screen id.
+ */
+ $response = apply_filters( 'heartbeat_send', $response, $screen_id );
+
+ /**
+ * Fires when Heartbeat ticks in logged-in environments.
+ *
+ * Allows the transport to be easily replaced with long-polling.
+ *
+ * @since 3.6.0
+ *
+ * @param array|object $response The Heartbeat response object or array.
+ * @param string $screen_id The screen id.
+ */
+ do_action( 'heartbeat_tick', $response, $screen_id );
+
+ // Send the current time according to the server
+ $response['server_time'] = time();
+
+ wp_send_json($response);
+}
+
+function wp_ajax_get_revision_diffs() {
+ require ABSPATH . 'wp-admin/includes/revision.php';
+
+ if ( ! $post = get_post( (int) $_REQUEST['post_id'] ) )
+ wp_send_json_error();
+
+ if ( ! current_user_can( 'read_post', $post->ID ) )
+ wp_send_json_error();
+
+ // Really just pre-loading the cache here.
+ if ( ! $revisions = wp_get_post_revisions( $post->ID, array( 'check_enabled' => false ) ) )
+ wp_send_json_error();
+
+ $return = array();
+ @set_time_limit( 0 );
+
+ foreach ( $_REQUEST['compare'] as $compare_key ) {
+ list( $compare_from, $compare_to ) = explode( ':', $compare_key ); // from:to
+
+ $return[] = array(
+ 'id' => $compare_key,
+ 'fields' => wp_get_revision_ui_diff( $post, $compare_from, $compare_to ),
+ );
+ }
+ wp_send_json_success( $return );
+}
+
+/**
+ * Auto-save the selected color scheme for a user's own profile.
+ *
+ * @since 3.8.0
+ */
+function wp_ajax_save_user_color_scheme() {
+ global $_wp_admin_css_colors;
+
+ check_ajax_referer( 'save-color-scheme', 'nonce' );
+
+ $color_scheme = sanitize_key( $_POST['color_scheme'] );
+
+ if ( ! isset( $_wp_admin_css_colors[ $color_scheme ] ) ) {
+ wp_send_json_error();
+ }
+
+ update_user_meta( get_current_user_id(), 'admin_color', $color_scheme );
+ wp_send_json_success();
+}
+
+/**
+ * Get themes from themes_api().
+ *
+ * @since 3.9.0
+ */
+function wp_ajax_query_themes() {
+ global $themes_allowedtags, $theme_field_defaults;
+
+ if ( ! current_user_can( 'install_themes' ) ) {
+ wp_send_json_error();
+ }
+
+ $args = wp_parse_args( wp_unslash( $_REQUEST['request'] ), array(
+ 'per_page' => 20,
+ 'fields' => $theme_field_defaults
+ ) );
+
+ $old_filter = isset( $args['browse'] ) ? $args['browse'] : 'search';
+
+ /** This filter is documented in wp-admin/includes/class-wp-theme-install-list-table.php */
+ $args = apply_filters( 'install_themes_table_api_args_' . $old_filter, $args );
+
+ $api = themes_api( 'query_themes', $args );
+
+ if ( is_wp_error( $api ) ) {
+ wp_send_json_error();
+ }
+
+ $update_php = self_admin_url( 'update.php?action=install-theme' );
+ foreach ( $api->themes as &$theme ) {
+ $theme->install_url = add_query_arg( array(
+ 'theme' => $theme->slug,
+ '_wpnonce' => wp_create_nonce( 'install-theme_' . $theme->slug )
+ ), $update_php );
+
+ $theme->name = wp_kses( $theme->name, $themes_allowedtags );
+ $theme->author = wp_kses( $theme->author, $themes_allowedtags );
+ $theme->version = wp_kses( $theme->version, $themes_allowedtags );
+ $theme->description = wp_kses( $theme->description, $themes_allowedtags );
+ $theme->num_ratings = sprintf( _n( '(based on %s rating)', '(based on %s ratings)', $theme->num_ratings ), number_format_i18n( $theme->num_ratings ) );
+ }
+
+ wp_send_json_success( $api );
+}
diff --git a/wordpress/wp-admin/includes/bookmark.php b/wordpress/wp-admin/includes/bookmark.php
index 17a8229..3378596 100644
--- a/wordpress/wp-admin/includes/bookmark.php
+++ b/wordpress/wp-admin/includes/bookmark.php
@@ -55,12 +55,12 @@ function edit_link( $link_id = 0 ) {
function get_default_link_to_edit() {
$link = new stdClass;
if ( isset( $_GET['linkurl'] ) )
- $link->link_url = esc_url( $_GET['linkurl'] );
+ $link->link_url = esc_url( wp_unslash( $_GET['linkurl'] ) );
else
$link->link_url = '';
if ( isset( $_GET['name'] ) )
- $link->link_name = esc_attr( $_GET['name'] );
+ $link->link_name = esc_attr( wp_unslash( $_GET['name'] ) );
else
$link->link_name = '';
@@ -70,7 +70,7 @@ function get_default_link_to_edit() {
}
/**
- * Delete link specified from database
+ * Delete link specified from database.
*
* @since 2.0.0
*
@@ -79,13 +79,25 @@ function get_default_link_to_edit() {
*/
function wp_delete_link( $link_id ) {
global $wpdb;
-
+ /**
+ * Fires before a link is deleted.
+ *
+ * @since 2.0.0
+ *
+ * @param int $link_id ID of the link to delete.
+ */
do_action( 'delete_link', $link_id );
wp_delete_object_term_relationships( $link_id, 'link_category' );
$wpdb->delete( $wpdb->links, array( 'link_id' => $link_id ) );
-
+ /**
+ * Fires after a link has been deleted.
+ *
+ * @since 2.2.0
+ *
+ * @param int $link_id ID of the deleted link.
+ */
do_action( 'deleted_link', $link_id );
clean_bookmark_cache( $link_id );
@@ -137,7 +149,7 @@ function wp_insert_link( $linkdata, $wp_error = false ) {
$linkdata = wp_parse_args( $linkdata, $defaults );
$linkdata = sanitize_bookmark( $linkdata, 'db' );
- extract( stripslashes_deep( $linkdata ), EXTR_SKIP );
+ extract( wp_unslash( $linkdata ), EXTR_SKIP );
$update = false;
@@ -206,11 +218,25 @@ function wp_insert_link( $linkdata, $wp_error = false ) {
wp_set_link_cats( $link_id, $link_category );
- if ( $update )
+ if ( $update ) {
+ /**
+ * Fires after a link was updated in the database.
+ *
+ * @since 2.0.0
+ *
+ * @param int $link_id ID of the link that was updated.
+ */
do_action( 'edit_link', $link_id );
- else
+ } else {
+ /**
+ * Fires after a link was added to the database.
+ *
+ * @since 2.0.0
+ *
+ * @param int $link_id ID of the link that was added.
+ */
do_action( 'add_link', $link_id );
-
+ }
clean_bookmark_cache( $link_id );
return $link_id;
@@ -251,7 +277,7 @@ function wp_update_link( $linkdata ) {
$link = get_bookmark( $link_id, ARRAY_A );
// Escape data pulled from DB.
- $link = add_magic_quotes( $link );
+ $link = wp_slash( $link );
// Passed link category list overwrites existing category list if not empty.
if ( isset( $linkdata['link_category'] ) && is_array( $linkdata['link_category'] )
@@ -266,3 +292,25 @@ function wp_update_link( $linkdata ) {
return wp_insert_link( $linkdata );
}
+
+/**
+ * @since 3.5.0
+ * @access private
+ */
+function wp_link_manager_disabled_message() {
+ global $pagenow;
+ if ( 'link-manager.php' != $pagenow && 'link-add.php' != $pagenow && 'link.php' != $pagenow )
+ return;
+
+ add_filter( 'pre_option_link_manager_enabled', '__return_true', 100 );
+ $really_can_manage_links = current_user_can( 'manage_links' );
+ remove_filter( 'pre_option_link_manager_enabled', '__return_true', 100 );
+
+ if ( $really_can_manage_links && current_user_can( 'install_plugins' ) ) {
+ $link = network_admin_url( 'plugin-install.php?tab=search&s=Link+Manager' );
+ wp_die( sprintf( __( 'If you are looking to use the link manager, please install the Link Manager plugin.' ), $link ) );
+ }
+
+ wp_die( __( 'You do not have sufficient permissions to edit the links for this site.' ) );
+}
+add_action( 'admin_page_access_denied', 'wp_link_manager_disabled_message' );
diff --git a/wordpress/wp-admin/includes/class-ftp-pure.php b/wordpress/wp-admin/includes/class-ftp-pure.php
index c947f44..bb7742a 100644
--- a/wordpress/wp-admin/includes/class-ftp-pure.php
+++ b/wordpress/wp-admin/includes/class-ftp-pure.php
@@ -3,13 +3,13 @@
* PemFTP - A Ftp implementation in pure PHP
*
* @package PemFTP
- * @since 2.5
+ * @since 2.5.0
*
* @version 1.0
* @copyright Alexey Dotsenko
* @author Alexey Dotsenko
* @link http://www.phpclasses.org/browse/package/1743.html Site
- * @license LGPL License http://www.opensource.org/licenses/lgpl-license.html
+ * @license LGPL http://www.opensource.org/licenses/lgpl-license.html
*/
/**
@@ -17,13 +17,13 @@
*
* @package PemFTP
* @subpackage Pure
- * @since 2.5
+ * @since 2.5.0
*
* @version 1.0
* @copyright Alexey Dotsenko
* @author Alexey Dotsenko
* @link http://www.phpclasses.org/browse/package/1743.html Site
- * @license LGPL License http://www.opensource.org/licenses/lgpl-license.html
+ * @license LGPL http://www.opensource.org/licenses/lgpl-license.html
*/
class ftp extends ftp_base {
diff --git a/wordpress/wp-admin/includes/class-ftp-sockets.php b/wordpress/wp-admin/includes/class-ftp-sockets.php
index 4026dd0..f9ea6cd 100644
--- a/wordpress/wp-admin/includes/class-ftp-sockets.php
+++ b/wordpress/wp-admin/includes/class-ftp-sockets.php
@@ -3,13 +3,13 @@
* PemFTP - A Ftp implementation in pure PHP
*
* @package PemFTP
- * @since 2.5
+ * @since 2.5.0
*
* @version 1.0
* @copyright Alexey Dotsenko
* @author Alexey Dotsenko
* @link http://www.phpclasses.org/browse/package/1743.html Site
- * @license LGPL License http://www.opensource.org/licenses/lgpl-license.html
+ * @license LGPL http://www.opensource.org/licenses/lgpl-license.html
*/
/**
@@ -17,13 +17,13 @@
*
* @package PemFTP
* @subpackage Socket
- * @since 2.5
+ * @since 2.5.0
*
* @version 1.0
* @copyright Alexey Dotsenko
* @author Alexey Dotsenko
* @link http://www.phpclasses.org/browse/package/1743.html Site
- * @license LGPL License http://www.opensource.org/licenses/lgpl-license.html
+ * @license LGPL http://www.opensource.org/licenses/lgpl-license.html
*/
class ftp extends ftp_base {
diff --git a/wordpress/wp-admin/includes/class-ftp.php b/wordpress/wp-admin/includes/class-ftp.php
index 1ae3e87..f068f15 100644
--- a/wordpress/wp-admin/includes/class-ftp.php
+++ b/wordpress/wp-admin/includes/class-ftp.php
@@ -9,7 +9,7 @@
* @copyright Alexey Dotsenko
* @author Alexey Dotsenko
* @link http://www.phpclasses.org/browse/package/1743.html Site
- * @license LGPL License http://www.opensource.org/licenses/lgpl-license.html
+ * @license LGPL http://www.opensource.org/licenses/lgpl-license.html
*/
/**
diff --git a/wordpress/wp-admin/includes/class-wp-comments-list-table.php b/wordpress/wp-admin/includes/class-wp-comments-list-table.php
index bb5a95e..c489efe 100644
--- a/wordpress/wp-admin/includes/class-wp-comments-list-table.php
+++ b/wordpress/wp-admin/includes/class-wp-comments-list-table.php
@@ -21,7 +21,7 @@ class WP_Comments_List_Table extends WP_List_Table {
var $pending_count = array();
- function __construct() {
+ function __construct( $args = array() ) {
global $post_id;
$post_id = isset( $_REQUEST['p'] ) ? absint( $_REQUEST['p'] ) : 0;
@@ -33,6 +33,7 @@ class WP_Comments_List_Table extends WP_List_Table {
'plural' => 'comments',
'singular' => 'comment',
'ajax' => true,
+ 'screen' => isset( $args['screen'] ) ? $args['screen'] : null,
) );
}
@@ -51,6 +52,8 @@ class WP_Comments_List_Table extends WP_List_Table {
$search = ( isset( $_REQUEST['s'] ) ) ? $_REQUEST['s'] : '';
+ $post_type = ( isset( $_REQUEST['post_type'] ) ) ? sanitize_key( $_REQUEST['post_type'] ) : '';
+
$user_id = ( isset( $_REQUEST['user_id'] ) ) ? $_REQUEST['user_id'] : '';
$orderby = ( isset( $_REQUEST['orderby'] ) ) ? $_REQUEST['orderby'] : '';
@@ -81,7 +84,8 @@ class WP_Comments_List_Table extends WP_List_Table {
$status_map = array(
'moderated' => 'hold',
- 'approved' => 'approve'
+ 'approved' => 'approve',
+ 'all' => '',
);
$args = array(
@@ -94,6 +98,7 @@ class WP_Comments_List_Table extends WP_List_Table {
'type' => $comment_type,
'orderby' => $orderby,
'order' => $order,
+ 'post_type' => $post_type,
);
$_comments = get_comments( $args );
@@ -122,6 +127,14 @@ class WP_Comments_List_Table extends WP_List_Table {
function get_per_page( $comment_status = 'all' ) {
$comments_per_page = $this->get_items_per_page( 'edit_comments_per_page' );
+ /**
+ * Filter the number of comments listed per page in the comments list table.
+ *
+ * @since 2.6.0
+ *
+ * @param int $comments_per_page The number of comments to list per page.
+ * @param string $comment_status The comment status name. Default 'All'.
+ */
$comments_per_page = apply_filters( 'comments_per_page', $comments_per_page, $comment_status );
return $comments_per_page;
}
@@ -168,7 +181,7 @@ class WP_Comments_List_Table extends WP_List_Table {
/*
// I toyed with this, but decided against it. Leaving it in here in case anyone thinks it is a good idea. ~ Mark
if ( !empty( $_REQUEST['s'] ) )
- $link = add_query_arg( 's', esc_attr( stripslashes( $_REQUEST['s'] ) ), $link );
+ $link = add_query_arg( 's', esc_attr( wp_unslash( $_REQUEST['s'] ) ), $link );
*/
$status_links[$status] = "" . sprintf(
translate_nooped_plural( $label, $num_comments->$status ),
@@ -176,6 +189,14 @@ class WP_Comments_List_Table extends WP_List_Table {
) . ' ';
}
+ /**
+ * Filter the comment status links.
+ *
+ * @since 2.5.0
+ *
+ * @param array $status_links An array of fully-formed status links. Default 'All'.
+ * Accepts 'All', 'Pending', 'Approved', 'Spam', and 'Trash'.
+ */
$status_links = apply_filters( 'comment_status_links', $status_links );
return $status_links;
}
@@ -212,8 +233,15 @@ class WP_Comments_List_Table extends WP_List_Table {
if ( 'top' == $which ) {
?>
-
+
__( 'Comments' ),
'pings' => __( 'Pings' ),
@@ -224,14 +252,27 @@ class WP_Comments_List_Table extends WP_List_Table {
?>
'post-query-submit' ) );
+ /**
+ * Fires just before the Filter submit button for comment types.
+ *
+ * @since 3.5.0
+ */
+ do_action( 'restrict_manage_comments' );
+ submit_button( __( 'Filter' ), 'button', false, false, array( 'id' => 'post-query-submit' ) );
}
if ( ( 'spam' == $comment_status || 'trash' == $comment_status ) && current_user_can( 'moderate_comments' ) ) {
wp_nonce_field( 'bulk-destroy', '_destroy_nonce' );
$title = ( 'spam' == $comment_status ) ? esc_attr__( 'Empty Spam' ) : esc_attr__( 'Empty Trash' );
- submit_button( $title, 'button-secondary apply', 'delete_all', false );
+ submit_button( $title, 'apply', 'delete_all', false );
}
+ /**
+ * Fires after the Filter submit button for comment types.
+ *
+ * @since 2.5.0
+ *
+ * @param string $comment_status The comment status name. Default 'All'.
+ */
do_action( 'manage_comments_nav', $comment_status );
echo '';
}
@@ -275,7 +316,7 @@ class WP_Comments_List_Table extends WP_List_Table {
$this->display_tablenav( 'top' );
?>
-
+
print_column_headers(); ?>
@@ -288,11 +329,11 @@ class WP_Comments_List_Table extends WP_List_Table {
-
-
@@ -305,36 +346,35 @@ class WP_Comments_List_Table extends WP_List_Table {
global $post, $comment;
$comment = $a_comment;
- $the_comment_class = join( ' ', get_comment_class( wp_get_comment_status( $comment->comment_ID ) ) );
+ $the_comment_class = wp_get_comment_status( $comment->comment_ID );
+ $the_comment_class = join( ' ', get_comment_class( $the_comment_class, $comment->comment_ID, $comment->comment_post_ID ) );
$post = get_post( $comment->comment_post_ID );
$this->user_can = current_user_can( 'edit_comment', $comment->comment_ID );
echo "\n";
}
function column_cb( $comment ) {
- if ( $this->user_can )
- echo " ";
+ if ( $this->user_can ) { ?>
+
+
+ user_can;
$comment_url = esc_url( get_comment_link( $comment->comment_ID ) );
$the_comment_status = wp_get_comment_status( $comment->comment_ID );
- $ptime = date( 'G', strtotime( $comment->comment_date ) );
- if ( ( abs( time() - $ptime ) ) < 86400 )
- $ptime = sprintf( __( '%s ago' ), human_time_diff( $ptime ) );
- else
- $ptime = mysql2date( __( 'Y/m/d \a\t g:i A' ), $comment->comment_date );
-
if ( $user_can ) {
$del_nonce = esc_html( '_wpnonce=' . wp_create_nonce( "delete-comment_$comment->comment_ID" ) );
$approve_nonce = esc_html( '_wpnonce=' . wp_create_nonce( "approve-comment_$comment->comment_ID" ) );
@@ -350,11 +390,17 @@ class WP_Comments_List_Table extends WP_List_Table {
$delete_url = esc_url( $url . "&action=deletecomment&$del_nonce" );
}
+ echo '';
+
echo '';
/* translators: 2: comment date, 3: comment time */
printf( __( 'Submitted on
%2$s at %3$s ' ), $comment_url,
- /* translators: comment date format. See http://php.net/date */ get_comment_date( __( 'Y/m/d' ) ),
- /* translators: comment time format. See http://php.net/date */ get_comment_date( get_option( 'time_format' ) ) );
+ /* translators: comment date format. See http://php.net/date */
+ get_comment_date( __( 'Y/m/d' ) ),
+ get_comment_date( get_option( 'time_format' ) )
+ );
if ( $comment->comment_parent ) {
$parent = get_comment( $comment->comment_parent );
@@ -367,7 +413,10 @@ class WP_Comments_List_Table extends WP_List_Table {
comment_text();
if ( $user_can ) { ?>