Commit Graph

78 Commits

Author SHA1 Message Date
John Blackbourn
1b76bd6246 Introduce a $token argument to wp_set_auth_cookie() so session tokens can be reused by custom authentication implementations.
Props rmccue

Fixes 30247


git-svn-id: https://develop.svn.wordpress.org/trunk@32465 602fd350-edb4-49c9-b593-d223f7449a82
2015-05-09 00:27:11 +00:00
Gary Pendergast
ba24459a63 The UTF-8 regex can occasionally fail on very low memory machines. Reduce the amount of memory it uses.
See #32204.



git-svn-id: https://develop.svn.wordpress.org/trunk@32375 602fd350-edb4-49c9-b593-d223f7449a82
2015-05-06 06:57:44 +00:00
Sergey Biryukov
408cca2c54 Merge two different translator comments for the same string.
props pavelevap.
fixes #31999.

git-svn-id: https://develop.svn.wordpress.org/trunk@32210 602fd350-edb4-49c9-b593-d223f7449a82
2015-04-20 15:35:31 +00:00
Boone Gorges
bffb632183 Improve handling of incomplete From and Content-Type headers in wp_mail().
When an incomplete header is provided (eg, 'From' with an email address but no
name), ensure that the WP defaults are filled in properly.

Props valendesigns.
Fixes #30266.

git-svn-id: https://develop.svn.wordpress.org/trunk@32070 602fd350-edb4-49c9-b593-d223f7449a82
2015-04-07 20:09:46 +00:00
Drew Jaynes
c7518c36c4 Various inline documentation syntactical fixes in wp-includes/pluggable.php for 4.2 changes.
See #31888.


git-svn-id: https://develop.svn.wordpress.org/trunk@32045 602fd350-edb4-49c9-b593-d223f7449a82
2015-04-05 16:45:34 +00:00
Sergey Biryukov
3089244b6f Restore line breaks before comment text in comment notification emails.
fixes #31508.

git-svn-id: https://develop.svn.wordpress.org/trunk@31770 602fd350-edb4-49c9-b593-d223f7449a82
2015-03-13 18:28:52 +00:00
Helen Hou-Sandi
debd0092cb Gravatars: Remove redundant 1x srcset.
props miqrogroove.
see #22329.


git-svn-id: https://develop.svn.wordpress.org/trunk@31722 602fd350-edb4-49c9-b593-d223f7449a82
2015-03-11 16:55:22 +00:00
Helen Hou-Sandi
13c503d15a Gravatars: Enable HiDPI versions for browsers that support srcset.
props iseulde.
see #22329.


git-svn-id: https://develop.svn.wordpress.org/trunk@31721 602fd350-edb4-49c9-b593-d223f7449a82
2015-03-11 16:31:50 +00:00
Drew Jaynes
79a3048412 Adjust the description for the $extra_attr argument in the DocBlocks for get_avatar_data() and get_avatar().
See [31561]. See #31469.


git-svn-id: https://develop.svn.wordpress.org/trunk@31591 602fd350-edb4-49c9-b593-d223f7449a82
2015-03-01 07:18:42 +00:00
Gary Pendergast
d258490653 When sanitizing a URL to redirect to, UTF-8 characters can be URL encoded, instead of being removed.
While RFC 3986 does not specify which character sets are allowed in URIs, Section 2.5 states that octects matching UTF-8 character encoding should be percent-encoded, then unreserved octets outside of the UTF-8 range should be percent-encoded. As browsers tend to only implement support for UTF-8 in URLs, this change only implements the UTF-8 encoding part. We may revisit the second part if it becomes an issue.

Fixes #31486



git-svn-id: https://develop.svn.wordpress.org/trunk@31587 602fd350-edb4-49c9-b593-d223f7449a82
2015-02-28 02:20:52 +00:00
wonderboymusic
2f86fcd9a9 In get_avatar_data() and get_avatar(), allow height and width to be specified separately (both default to size). Also allow arbitrary attributes on the <img> via the extra_attr arg.
Props miqrogroove.
See #31469.


git-svn-id: https://develop.svn.wordpress.org/trunk@31561 602fd350-edb4-49c9-b593-d223f7449a82
2015-02-26 21:16:02 +00:00
Sergey Biryukov
45d5c5ddbe Remove src from duplicate hook comments for get_avatar and get_avatar_data.
see #21195.

git-svn-id: https://develop.svn.wordpress.org/trunk@31480 602fd350-edb4-49c9-b593-d223f7449a82
2015-02-19 14:58:40 +00:00
Sergey Biryukov
2175fbb21d Fix a typo in duplicate hook comment.
see [31107], #21195.

git-svn-id: https://develop.svn.wordpress.org/trunk@31479 602fd350-edb4-49c9-b593-d223f7449a82
2015-02-19 14:55:34 +00:00
Drew Jaynes
b325f149d8 Improve return and parameter documentation for check_admin_referer(), check_ajax_referer(), and wp_verify_nonce().
Also update and clarify docsfor the `check_admin_referer` and `check_ajax_referer` hooks.

Props johnbillion, DrewAPicture.
Fixes #31055.


git-svn-id: https://develop.svn.wordpress.org/trunk@31381 602fd350-edb4-49c9-b593-d223f7449a82
2015-02-09 04:56:42 +00:00
Scott Taylor
5acc6bdb58 In PHP 5.0.0, is_a() became deprecated in favour of the instanceof operator. Calling is_a() would result in an E_STRICT warning.
In PHP 5.3.0, `is_a()` is no longer deprecated, and will therefore no longer throw `E_STRICT` warnings.

To avoid warnings in PHP < 5.3.0, convert all `is_a()` calls to `$var instanceof WP_Class` calls.

`instanceof` does not throw any error if the variable being tested is not an object, it simply returns `false`.

Props markoheijnen, wonderboymusic.
Fixes #25672.


git-svn-id: https://develop.svn.wordpress.org/trunk@31188 602fd350-edb4-49c9-b593-d223f7449a82
2015-01-16 01:05:52 +00:00
Gary Pendergast
d0fab598e7 In get_avatar(), revert the <img> tag attributes to using single quotes, instead of double quotes. This behaviour was changed in [31107], but caused problems for code that attempted to parse the <img> tag.
See #21195



git-svn-id: https://develop.svn.wordpress.org/trunk@31152 602fd350-edb4-49c9-b593-d223f7449a82
2015-01-12 00:02:31 +00:00
Scott Taylor
c3bd2252f5 Use PHP_SAPI constant instead of php_sapi_name() in iis7_supports_permalinks(), wp_fix_server_vars(), and wp_redirect().
See #30799.


git-svn-id: https://develop.svn.wordpress.org/trunk@31120 602fd350-edb4-49c9-b593-d223f7449a82
2015-01-10 04:58:49 +00:00
Gary Pendergast
dec1cba410 Add get_avatar_url(), for retrieving just the URL of an avatar, rather than the entire <img> tag that get_avatar() produces.
Unlike `get_avatar()`, `get_avatar_url()` is not pluggable. It can be extended/or modified through the new filters included.

Fixes #21195.

Props mdawaffe, pento, pathawks, DrewAPicture



git-svn-id: https://develop.svn.wordpress.org/trunk@31107 602fd350-edb4-49c9-b593-d223f7449a82
2015-01-09 04:42:48 +00:00
Sergey Biryukov
76afa9f9a3 Remove space before comma in wp_notify_postauthor() and wp_notify_moderator().
see #30930.

git-svn-id: https://develop.svn.wordpress.org/trunk@31060 602fd350-edb4-49c9-b593-d223f7449a82
2015-01-06 17:16:17 +00:00
Sergey Biryukov
ca4df7ec0a Remove padding from the comment notification emails in wp_notify_moderator().
See [30015] for wp_notify_postauthor().

props pavelevap.
fixes #30930.

git-svn-id: https://develop.svn.wordpress.org/trunk@31059 602fd350-edb4-49c9-b593-d223f7449a82
2015-01-06 17:09:13 +00:00
John Blackbourn
cedecf8033 Allow brackets in a URL when it's sanitised for a redirect. Brackets are valid in query parameters.
Fixes #30308
Props voldemortensen


git-svn-id: https://develop.svn.wordpress.org/trunk@30684 602fd350-edb4-49c9-b593-d223f7449a82
2014-12-01 03:20:13 +00:00
John Blackbourn
b57c4ae165 Allow square brackets in a URL when it's sanitised for a redirect. Square brackets are valid in query parameters and IPv6 addresses.
Fixes #17052
Props voldemortensen


git-svn-id: https://develop.svn.wordpress.org/trunk@30683 602fd350-edb4-49c9-b593-d223f7449a82
2014-12-01 03:15:24 +00:00
Scott Taylor
4bf6ad11fb Improve the @param docs for src/wp-includes/pluggable*.
See #30224.


git-svn-id: https://develop.svn.wordpress.org/trunk@30667 602fd350-edb4-49c9-b593-d223f7449a82
2014-11-30 22:18:33 +00:00
Drew Jaynes (DrewAPicture)
f534936cfe Fix DocBlock formatting for wp_generate_password().
Props stevegrunwell for the initial patch.
Fixes #30509.


git-svn-id: https://develop.svn.wordpress.org/trunk@30580 602fd350-edb4-49c9-b593-d223f7449a82
2014-11-26 20:37:36 +00:00
ocean90
ebfa390ea1 Type cast $nonce to string in wp_verify_nonce().
props jesin.
fixes #29542.

git-svn-id: https://develop.svn.wordpress.org/trunk@30576 602fd350-edb4-49c9-b593-d223f7449a82
2014-11-26 19:18:02 +00:00
Drew Jaynes (DrewAPicture)
5f574c7ec8 Ensure inline code is markdown-escaped as such, HTML tags are removed from summaries, and that code snippets in descriptions are properly indented.
Affects DocBlocks for the following core elements:
* Markdown-indent a code snippet in the description for `wp_salt()`
* Backtick-escape inline code in the return description for `get_avatar()`
* Various markdown formatting in the description for `add_filter()`
* Markdown-indent a code snippet in the description for `apply_filters()`
* Backtick-escape inline code in the `@see` description for `apply_filters_ref_array()`
* Backtick-escape inline code in the description for `do_action()`
* Backtick-escape variables in the parameter and return descriptions for `do_action_ref_array()`
* Various markdown formatting in the description for `get_plugin_data()`

Props rarst.
See #30473.


git-svn-id: https://develop.svn.wordpress.org/trunk@30544 602fd350-edb4-49c9-b593-d223f7449a82
2014-11-24 06:04:10 +00:00
Andrew Nacin
cff531489f Use hash_equals() for old md5 hashes.
git-svn-id: https://develop.svn.wordpress.org/trunk@30412 602fd350-edb4-49c9-b593-d223f7449a82
2014-11-20 11:48:11 +00:00
Drew Jaynes (DrewAPicture)
239d04cfae Add missing documentation for the $password parameter, passed to the check_password hook.
Props coffee2code.
Fixes #30311.


git-svn-id: https://develop.svn.wordpress.org/trunk@30381 602fd350-edb4-49c9-b593-d223f7449a82
2014-11-18 18:55:01 +00:00
Drew Jaynes (DrewAPicture)
7cd15026bd Correct references of @uses $wpdb in core documentation to use @global.
See #30191, [30105].
Fixes #30217.


git-svn-id: https://develop.svn.wordpress.org/trunk@30122 602fd350-edb4-49c9-b593-d223f7449a82
2014-10-31 17:55:39 +00:00
Drew Jaynes (DrewAPicture)
3cc10d77a0 Remove redundant and erroneous @uses tag from most core inline documentation.
Per our inline documentation standards, no further use of the `@uses` tag is recommended as used and used-by relationships can be derived through other means. This removes most uses of the tag in core documentation, with remaining tags to be converted to `@global` or `@see` as they apply.

Fixes #30191.


git-svn-id: https://develop.svn.wordpress.org/trunk@30105 602fd350-edb4-49c9-b593-d223f7449a82
2014-10-30 01:04:55 +00:00
John Blackbourn
d033be1f9d Remove padding from the comment notification emails which is from a bygone fixed-width font era. Prevents alignment issues in email clients which use vairable width fonts for plain text emails. Fixes #16721. Props DrewAPicture.
git-svn-id: https://develop.svn.wordpress.org/trunk@30015 602fd350-edb4-49c9-b593-d223f7449a82
2014-10-24 17:07:53 +00:00
Mark Jaquith
be8a0c6f89 Use HTTPS URLs for trac.wordpress.org (and use core.trac.wordpress.org)
see #27115

git-svn-id: https://develop.svn.wordpress.org/trunk@29789 602fd350-edb4-49c9-b593-d223f7449a82
2014-09-29 13:36:38 +00:00
Andrew Nacin
4c1462f2ff Add safeguards for when ext/hash is not compiled with PHP.
see #29518, for trunk.


git-svn-id: https://develop.svn.wordpress.org/trunk@29751 602fd350-edb4-49c9-b593-d223f7449a82
2014-09-20 17:27:46 +00:00
Andrew Nacin
e3345398aa Rename the public methods in the session tokens API.
Introduces a new get( $token ) method. get_token() would not have made sense and spurred the overall renaming. Public methods are now get, get_all, verify, create, update, destroy, destroy_others, and destroy_all.

The protected abstract methods designed for alternative implementations remain the same.

props mdawaffe.
see #20276.


git-svn-id: https://develop.svn.wordpress.org/trunk@29635 602fd350-edb4-49c9-b593-d223f7449a82
2014-08-27 02:06:53 +00:00
Andrew Nacin
bf0272c8b1 Require a non-empty $nonce value in wp_verify_nonce().
props ocean90.
fixes #29217.


git-svn-id: https://develop.svn.wordpress.org/trunk@29620 602fd350-edb4-49c9-b593-d223f7449a82
2014-08-26 07:38:51 +00:00
Drew Jaynes (DrewAPicture)
e8adffff96 s/does/does not in wp_set_password() docblock.
See [29461]. See #28316.


git-svn-id: https://develop.svn.wordpress.org/trunk@29462 602fd350-edb4-49c9-b593-d223f7449a82
2014-08-10 02:43:07 +00:00
Drew Jaynes (DrewAPicture)
5aef1c5aa5 Improve the wp_set_password() PHPDoc with a note to guard against executing the function on every page load, such as through a theme's functions.php file.
See #28316.


git-svn-id: https://develop.svn.wordpress.org/trunk@29461 602fd350-edb4-49c9-b593-d223f7449a82
2014-08-10 02:38:52 +00:00
Andrew Nacin
4984b04b81 Escape late in get_avatar().
git-svn-id: https://develop.svn.wordpress.org/trunk@29397 602fd350-edb4-49c9-b593-d223f7449a82
2014-08-06 07:49:30 +00:00
Andrew Nacin
b2d8983dcc Constant time for wp_verify_nonce().
git-svn-id: https://develop.svn.wordpress.org/trunk@29382 602fd350-edb4-49c9-b593-d223f7449a82
2014-08-06 05:25:03 +00:00
Andrew Nacin
97fcbef707 Tie cookies and nonces to user sessions so they may be invalidated upon logout.
Sessions are stored in usermeta via WP_User_Meta_Session_Tokens, which extends the abstract WP_Session_Tokens class. Extending WP_Session_Tokens can allow for alternative storage, such as a separate table or Redis.

Introduces some simple APIs for session listing and destruction, such as wp_get_active_sessions() and wp_destroy_all_sessions().

This invalidates all existing authentication cookies, as a new segment (the session token) has been added to them.

props duck_, nacin, mdawaffe.
see #20276.


git-svn-id: https://develop.svn.wordpress.org/trunk@29221 602fd350-edb4-49c9-b593-d223f7449a82
2014-07-18 09:12:05 +00:00
Sergey Biryukov
92a7523362 Asterisk is an allowed character in a URI and should not be stripped out by wp_sanitize_redirect().
fixes #28362.

git-svn-id: https://develop.svn.wordpress.org/trunk@28939 602fd350-edb4-49c9-b593-d223f7449a82
2014-07-01 15:55:04 +00:00
Scott Taylor
dcd7ff837d Use the WPINC constant when loading class-phpass.php
Props wojtek.szkutnik
See #14157.


git-svn-id: https://develop.svn.wordpress.org/trunk@28903 602fd350-edb4-49c9-b593-d223f7449a82
2014-06-29 22:11:44 +00:00
Andrew Nacin
18d069703b Fix documentation for wp_create_nonce() which wrongly suggests these tokens are actually numbers used once.
git-svn-id: https://develop.svn.wordpress.org/trunk@28793 602fd350-edb4-49c9-b593-d223f7449a82
2014-06-20 20:46:13 +00:00
Scott Taylor
0675902ec8 Don't use variable variables in wp_salt().
See #27881.


git-svn-id: https://develop.svn.wordpress.org/trunk@28741 602fd350-edb4-49c9-b593-d223f7449a82
2014-06-11 18:35:42 +00:00
Drew Jaynes (DrewAPicture)
1da8a18e5f Update the $secure_logged_in_cookie variable in the 'secure_logged_in_cookie' hook docs following [28627].
See #15330.


git-svn-id: https://develop.svn.wordpress.org/trunk@28628 602fd350-edb4-49c9-b593-d223f7449a82
2014-05-30 15:19:29 +00:00
Andrew Nacin
8d980de0ee Use a secure logged_in_cookie when the home URL is forced HTTPS (see #27954).
see #15330.


git-svn-id: https://develop.svn.wordpress.org/trunk@28627 602fd350-edb4-49c9-b593-d223f7449a82
2014-05-30 15:07:18 +00:00
Scott Taylor
6dd449551e Eliminate the use of extract() in wp_mail(). Check the filtered array for each value before re-setting variables.
See #22400.


git-svn-id: https://develop.svn.wordpress.org/trunk@28425 602fd350-edb4-49c9-b593-d223f7449a82
2014-05-15 06:16:34 +00:00
Scott Taylor
3c418d4b57 Eliminate the use of extract() in wp_validate_auth_cookie().
Don't do anything fancy here, just set the 4 returned properties to variables. This function is semi-important.
	
See #22400.


git-svn-id: https://develop.svn.wordpress.org/trunk@28424 602fd350-edb4-49c9-b593-d223f7449a82
2014-05-15 06:10:21 +00:00
Andrew Nacin
3234ade164 Harden HMAC verification. props duck_.
git-svn-id: https://develop.svn.wordpress.org/trunk@28053 602fd350-edb4-49c9-b593-d223f7449a82
2014-04-08 18:05:42 +00:00
Drew Jaynes (DrewAPicture)
c765ed8832 Inline documentation fixes related to the determine_current_user filter
See #26706, #27700.


git-svn-id: https://develop.svn.wordpress.org/trunk@28007 602fd350-edb4-49c9-b593-d223f7449a82
2014-04-07 21:17:44 +00:00