ofco/medicalalert-web-reloaded
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

plugin updates

Browse Source
This commit is contained in:
Tony Volpe
2024-07-16 13:57:46 +00:00
parent 41f50eacc4
commit 8f93917880
1529 changed files with 259452 additions and 25451 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
wp/wp-includes/blocks.php
View File

@@ -1447,7 +1447,7 @@ function _filter_block_content_callback( $matches ) {
* @return array The filtered and sanitized block object result.
*/
function filter_block_kses( $block, $allowed_html, $allowed_protocols = array() ) {
$block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols );
$block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols, $block );
if ( is_array( $block['innerBlocks'] ) ) {
foreach ( $block['innerBlocks'] as $i => $inner_block ) {
@@ -1463,6 +1463,7 @@ function filter_block_kses( $block, $allowed_html, $allowed_protocols = array()
* non-allowable HTML.
*
* @since 5.3.1
* @since 6.5.5 Added the `$block_context` parameter.
*
* @param string[]|string $value The attribute value to filter.
* @param array[]|string $allowed_html An array of allowed HTML elements and attributes,
@@ -1470,13 +1471,18 @@ function filter_block_kses( $block, $allowed_html, $allowed_protocols = array()
* for the list of accepted context names.
* @param string[] $allowed_protocols Optional. Array of allowed URL protocols.
* Defaults to the result of wp_allowed_protocols().
* @param array $block_context Optional. The block the attribute belongs to, in parsed block array format.
* @return string[]|string The filtered and sanitized result.
*/
function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array() ) {
function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array(), $block_context = null ) {
if ( is_array( $value ) ) {
foreach ( $value as $key => $inner_value ) {
$filtered_key = filter_block_kses_value( $key, $allowed_html, $allowed_protocols );
$filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols );
$filtered_key = filter_block_kses_value( $key, $allowed_html, $allowed_protocols, $block_context );
$filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols, $block_context );
if ( isset( $block_context['blockName'] ) && 'core/template-part' === $block_context['blockName'] ) {
$filtered_value = filter_block_core_template_part_attributes( $filtered_value, $filtered_key, $allowed_html );
}
if ( $filtered_key !== $key ) {
unset( $value[ $key ] );
@@ -1491,6 +1497,28 @@ function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = ar
return $value;
}
/**
* Sanitizes the value of the Template Part block's `tagName` attribute.
*
* @since 6.5.5
*
* @param string $attribute_value The attribute value to filter.
* @param string $attribute_name The attribute name.
* @param array[]|string $allowed_html An array of allowed HTML elements and attributes,
* or a context name such as 'post'. See wp_kses_allowed_html()
* for the list of accepted context names.
* @return string The sanitized attribute value.
*/
function filter_block_core_template_part_attributes( $attribute_value, $attribute_name, $allowed_html ) {
if ( empty( $attribute_value ) || 'tagName' !== $attribute_name ) {
return $attribute_value;
}
if ( ! is_array( $allowed_html ) ) {
$allowed_html = wp_kses_allowed_html( $allowed_html );
}
return isset( $allowed_html[ $attribute_value ] ) ? $attribute_value : '';
}
/**
* Parses blocks out of a content string, and renders those appropriate for the excerpt.
*

2
wp/wp-includes/blocks/template-part.php
View File

@@ -157,7 +157,7 @@ function render_block_core_template_part( $attributes ) {
global $wp_embed;
$content = $wp_embed->autoembed( $content );
if ( empty( $attributes['tagName'] ) ) {
if ( empty( $attributes['tagName'] ) || tag_escape( $attributes['tagName'] ) !== $attributes['tagName'] ) {
$area_tag = 'div';
if ( $area_definition && isset( $area_definition['area_tag'] ) ) {
$area_tag = $area_definition['area_tag'];

2
wp/wp-includes/fonts.php
View File

@@ -228,7 +228,7 @@ function _wp_before_delete_font_face( $post_id, $post ) {
}
$font_files = get_post_meta( $post_id, '_wp_font_face_file', false );
$font_dir = wp_get_font_dir()['path'];
$font_dir = untrailingslashit( wp_get_font_dir()['basedir'] );
foreach ( $font_files as $font_file ) {
wp_delete_file( $font_dir . '/' . $font_file );

3
wp/wp-includes/formatting.php
View File

@@ -4802,12 +4802,13 @@ EOF;
* Escapes an HTML tag name.
*
* @since 2.5.0
* @since 6.5.5 Allow hyphens in tag names (i.e. custom elements).
*
* @param string $tag_name
* @return string
*/
function tag_escape( $tag_name ) {
$safe_tag = strtolower( preg_replace( '/[^a-zA-Z0-9_:]/', '', $tag_name ) );
$safe_tag = strtolower( preg_replace( '/[^a-zA-Z0-9-_:]/', '', $tag_name ) );
/**
* Filters a string cleaned and escaped for output as an HTML tag.
*

3
wp/wp-includes/functions.php
View File

@@ -6192,6 +6192,9 @@ function validate_file( $file, $allowed_files = array() ) {
return 0;
}
// Normalize path for Windows servers
$file = wp_normalize_path( $file );
// `../` on its own is not allowed:
if ( '../' === $file ) {
return 1;

9
wp/wp-includes/html-api/class-wp-html-tag-processor.php
View File

@@ -2968,7 +2968,14 @@ class WP_HTML_Tag_Processor {
if ( true === $value ) {
$updated_attribute = $name;
} else {
$escaped_new_value = esc_attr( $value );
$comparable_name = strtolower( $name );
/*
* Escape URL attributes.
*
* @see https://html.spec.whatwg.org/#attributes-3
*/
$escaped_new_value = in_array( $comparable_name, wp_kses_uri_attributes() ) ? esc_url( $value ) : esc_attr( $value );
$updated_attribute = "{$name}=\"{$escaped_new_value}\"";
}

4
wp/wp-includes/rest-api/endpoints/class-wp-rest-font-faces-controller.php
View File

@@ -916,8 +916,8 @@ class WP_REST_Font_Faces_Controller extends WP_REST_Posts_Controller {
$new_path = $path;
$fonts_dir = wp_get_font_dir();
if ( str_starts_with( $new_path, $fonts_dir['path'] ) ) {
$new_path = str_replace( $fonts_dir, '', $new_path );
if ( str_starts_with( $new_path, $fonts_dir['basedir'] ) ) {
$new_path = str_replace( $fonts_dir['basedir'], '', $new_path );
$new_path = ltrim( $new_path, '/' );
}

2
wp/wp-includes/version.php
View File

@@ -16,7 +16,7 @@
*
* @global string $wp_version
*/
$wp_version = '6.5.4';
$wp_version = '6.5.5';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.