Ensure logged out users are redirected to the media file when attachment pages are inactive. This removes the read_post capability check from the canonical redirects as anonymous users lack the permission.
This was previously committed in [57310] before being reverted in [57318]. This update includes a fix to cover instances where revealing a URL could be considered a data leak and greatly expands the unit tests to ensure that this is covered along with many other instances.
Follow-up to [56657], [56658], [56711], [57310], [57318].
Props peterwilsoncc, jorbin, afercia, aristath, chesio, joppuyo, jorbin, lakshmananphp, poena, sergeybiryukov, swissspidy, johnbillion.
Fixes#59866.
See #57913.
git-svn-id: https://develop.svn.wordpress.org/trunk@57357 602fd350-edb4-49c9-b593-d223f7449a82
Ensure logged out users are redirected to the media file when attachment pages are inactive. This removes the `read_post` capability check from the canonical redirects as anonymous users lack the permission.
Follow-up to [56657], [56658], [56711].
Props afercia, aristath, chesio, joppuyo, jorbin, lakshmananphp, poena, sergeybiryukov.
Fixes#59866.
See #57913.
git-svn-id: https://develop.svn.wordpress.org/trunk@57310 602fd350-edb4-49c9-b593-d223f7449a82
This avoids a PHP warning or error when viewing an author on the front end, while an array is passed as `$_GET['author']`.
Follow-up to [12034], [12040], [12202].
Props david.binda, antonvlasenko, azaozz, SergeyBiryukov.
Fixes#60059.
git-svn-id: https://develop.svn.wordpress.org/trunk@57232 602fd350-edb4-49c9-b593-d223f7449a82
This removes ignore annotations which are ignoring an error which would not be thrown for that code.
Includes tidying up the format of the ignore annotation:
* Customary one space between the `//` and the start of the comment.
* There should be no spaces in the comma-separated sniff list.
Follow-up to [45607], [47185], [49200], [53152].
Props jrf.
See #59161.
git-svn-id: https://develop.svn.wordpress.org/trunk@56738 602fd350-edb4-49c9-b593-d223f7449a82
This aims to make the login process more user-friendly.
Follow-up to [19875], [19880].
Props lancewillett, subrataemfluence, tejwanihemant, ankit-k-gupta, devmuhib, audrasjb, hellofromTonya, joemcgill.
Fixes#40762.
git-svn-id: https://develop.svn.wordpress.org/trunk@56718 602fd350-edb4-49c9-b593-d223f7449a82
WordPress creates attachment pages by default for every attachment uploaded. On the vast majority of sites, these attachment pages don't contain any meaningful information. They do however exist, get indexed by search engines, and sometimes even rank in search results, leading to bad results for users and site owners.
This commit introduces a `wp_attachment_pages_enabled` database option to control the attachment pages behavior:
* On existing sites, the option is set to `1` on upgrade, so that attachment pages continue to work as is.
* For new sites, the option is set to to `0` by default, which means attachment pages are redirected to the attachment URL.
* Sites that want to enable or disable the attachment pages can set the option to `1` or `0`, respectively.
Follow-up to [2958], [3303], [7149], [34690].
Props aristath, poena, afercia, joostdevalk, jonoaldersonwp, azaozz, johnbillion, joedolson, basiliskan, audrasjb, davelo, rilwis, manfcarlo, tyxla, garrett-eclipse, seedsca, eatingrules, matveb, antpb, zodiac1978, oglekler, zunaid321, costdev, SergeyBiryukov.
Fixes#57913.
git-svn-id: https://develop.svn.wordpress.org/trunk@56657 602fd350-edb4-49c9-b593-d223f7449a82
`str_contains()` was introduced in PHP 8.0 to perform a case-sensitive check indicating if the string to search in (haystack) contains the given substring (needle).
WordPress core includes a polyfill for `str_contains()` on PHP < 8.0 as of WordPress 5.9.
This commit replaces `false !== strpos( ... )` with `str_contains()` in core files, making the code more readable and consistent, as well as better aligned with modern development practices.
Follow-up to [55988], [55990], [56014], [56021], [56031], [56032], [56065], [56241].
See #58206.
git-svn-id: https://develop.svn.wordpress.org/trunk@56245 602fd350-edb4-49c9-b593-d223f7449a82
`str_contains()` was introduced in PHP 8.0 to perform a case-sensitive check indicating if the string to search in (haystack) contains the given substring (needle).
WordPress core includes a polyfill for `str_contains()` on PHP < 8.0 as of WordPress 5.9.
This commit replaces `false !== strpos( ... )` with `str_contains()` in core files, making the code more readable and consistent, as well as better aligned with modern development practices.
Follow-up to [52039], [52040], [52326], [55703], [55710], [55987].
Props Soean, spacedmonkey, costdev, dingo_d, azaozz, mikeschroder, flixos90, peterwilsoncc, SergeyBiryukov.
Fixes#58206.
git-svn-id: https://develop.svn.wordpress.org/trunk@55988 602fd350-edb4-49c9-b593-d223f7449a82
This aims to clarify a few inline comments related to removing percent-encoded characters and HTML entities.
Affected functions:
* `sanitize_user()`
* `sanitize_title_with_dashes()`
* `sanitize_html_class()`
* `_sanitize_text_fields()`
* `get_comments_number_text()`
Follow-up to [465], [3454], [11433], [12503], [37987].
Props ace100, tanjimtc71, codemonksuvro, SergeyBiryukov.
Fixes#57712.
git-svn-id: https://develop.svn.wordpress.org/trunk@55346 602fd350-edb4-49c9-b593-d223f7449a82
Prevent term `NOT EXISTS` queries causing `redirect_canonical()` to throw a fatal error in PHP 8 and above, or a warning in earlier versions.
This ensures the `tax_query`'s `terms` property both exists and is countable before attempting to count it.
Props codesdnc, SergeyBiryukov, kadamwhite, costdev, miguelaxcar.
Fixes#55955.
git-svn-id: https://develop.svn.wordpress.org/trunk@54785 602fd350-edb4-49c9-b593-d223f7449a82
In `redirect_guess_404_permalink()` search for posts using all publicly queryable statuses rather than limiting options to the `publish` status.
Props goaroundagain, costdev, htdat, audrasjb, chaion07.
Fixes#47911.
git-svn-id: https://develop.svn.wordpress.org/trunk@53043 602fd350-edb4-49c9-b593-d223f7449a82
This avoids an "Undefined index" PHP notice when a schemeless URI is passed.
Props dd32, SergeyBiryukov.
Fixes#55333.
git-svn-id: https://develop.svn.wordpress.org/trunk@52833 602fd350-edb4-49c9-b593-d223f7449a82
In [51118], an attempt was made to add pagination limits. The added tests need to be updated to ensure that they pass with the new changes.
Reverts [51118].
See #50233.
git-svn-id: https://develop.svn.wordpress.org/trunk@51125 602fd350-edb4-49c9-b593-d223f7449a82
Add check to `redirect_canonical()` to ensure private posts only redirect for logged in users.
Modifies the `read_post` mata capability to user `get_post_status()` rather than the post's `post_status` property to allow attachments to redirect based on the inherited post status.
Introduces `wp_force_ugly_post_permalink()` to unify the check to determine if an ugly link should be displayed in each of the functions used for determining permalinks: `get_permalink()`, `get_post_permalink()`, `_get_page_link()` and `get_attachment_link()`.
Improves logic of `get_attachment_link()` to validate parent post and resolution of inherited post status. This is an incomplete fix of #52373 to prevent the function returning links resulting in a file not found error. Required to unblock this ticket.
Props peterwilsoncc, TimothyBlynJacobs.
See #52373.
Fixes#5272.
git-svn-id: https://develop.svn.wordpress.org/trunk@50132 602fd350-edb4-49c9-b593-d223f7449a82
This avoids a PHP notice if the post type is no longer registered.
Follow-up to [14595], [35480].
Props bobbingwide, hareesh-pillai.
Fixes#40309.
git-svn-id: https://develop.svn.wordpress.org/trunk@49924 602fd350-edb4-49c9-b593-d223f7449a82
This largely reverts [49563] due to attachment pages returning 404: File not found errors when they use the `inherit` status.
Permalink changes to attachment pages are retained when they are descendants of trashed or deleted posts.
Props Toro_Unit, helen, johnbillion, peterwilsoncc.
Fixes#51776.
See #5272.
git-svn-id: https://develop.svn.wordpress.org/trunk@49622 602fd350-edb4-49c9-b593-d223f7449a82
Add check to `redirect_canonical()` to ensure the destination post is not using a private post status.
Props dd32, Denis-de-Bernardy, donmhico, helen, nacin, peterwilsoncc, pishmishy, TimothyBlynJacobs, tzafrir, Viper007Bond, whyisjake.
Fixes#5272.
git-svn-id: https://develop.svn.wordpress.org/trunk@49563 602fd350-edb4-49c9-b593-d223f7449a82
Prevent `redirect_guess_404_permalink()` from throwing a notice when multiple post types are included in the `post_type` query.
Props junaidbhura.
Fixes#43056.
git-svn-id: https://develop.svn.wordpress.org/trunk@49200 602fd350-edb4-49c9-b593-d223f7449a82
Update `redirect_canonical()` to account for custom pagination and URL format used by sitemaps in order to follow standard practices.
Introduce the function `get_sitemap_url()` to simplify getting the index and provider URLs as needed.
Props jonathanstegall, pbiron, GamerZ, salvoaranzulla, peterwilsoncc.
Fixes#50910.
git-svn-id: https://develop.svn.wordpress.org/trunk@48872 602fd350-edb4-49c9-b593-d223f7449a82
The filter is the callback function added with `add_filter()`, therefore the hook passes a value to the filter, and the filter returns a value to change its behaviour.
The documentation is referring to the latter.
Props johnbillion.
See #49572, #16557.
git-svn-id: https://develop.svn.wordpress.org/trunk@48185 602fd350-edb4-49c9-b593-d223f7449a82
This improves the wording of the inline documentation for `redirect_guess_404_permalink()` and the related filters introduced in [47878].
Previously [47878,47885]
See #16557.
git-svn-id: https://develop.svn.wordpress.org/trunk@48182 602fd350-edb4-49c9-b593-d223f7449a82
While web crawlers are able to discover pages from links within the site and from other sites, XML sitemaps supplement this approach by allowing crawlers to quickly and comprehensively identify all URLs included in the sitemap and learn other signals about those URLs using the associated metadata.
See https://make.wordpress.org/core/2020/06/10/merge-announcement-extensible-core-sitemaps/ for more details.
This feature exposes the sitemap index via `/wp-sitemap.xml` and exposes a variety of new filters and hooks for developers to modify the behavior. Users can disable sitemaps completely by turning off search engine visibility in WordPress admin.
This change also introduces a new `esc_xml()` function to escape strings for output in XML, as well as XML support to `wp_kses_normalize_entities()`.
Props Adrian McShane, afragen, adamsilverstein, casiepa, flixos90, garrett-eclipse, joemcgill, kburgoine, kraftbj, milana_cap, pacifika, pbiron, pfefferle, Ruxandra Gradina, swissspidy, szepeviktor, tangrufus, tweetythierry.
Fixes#50117.
See #3670. See #19998.
git-svn-id: https://develop.svn.wordpress.org/trunk@48072 602fd350-edb4-49c9-b593-d223f7449a82
If a site is using `/%post_id%/%postname%/` as permalink structure, and is missing the `postname`, the site won't redirect to the appropriate URL. This change ensure that the redirect happens.
Fixes: #12456.
Props: Frank.Prendergast, dd32, Otto42, hlanggo, wonderboymusic, atimmer, seth17, calvin_ngan, Niresh12495, anbumz, SergeyBiryukov, donmhico.
git-svn-id: https://develop.svn.wordpress.org/trunk@47937 602fd350-edb4-49c9-b593-d223f7449a82
Improve filter documentation for consistency with other similar short-circuit filters in core.
Follow-up to [47878].
See #16557.
git-svn-id: https://develop.svn.wordpress.org/trunk@47885 602fd350-edb4-49c9-b593-d223f7449a82
This avoids displaying duplicate content of the home page under different URLs with appended page numbers.
This change only affects the `<!--nextpage-->` pagination (`page` query variable) and not the regular multiple posts pagination (`paged` query variable).
The posts page does not support the `<!--nextpage-->` pagination, so requests for invalid page numbers should be redirected to the page permalink, applying the logic previously implemented for single posts or pages.
Follow-up to [34492], [47727].
Props jeremyfelt, sachit.tandukar, SergeyBiryukov.
Fixes#45337. See #40773, #28081, #11694.
git-svn-id: https://develop.svn.wordpress.org/trunk@47760 602fd350-edb4-49c9-b593-d223f7449a82
This avoids displaying duplicate content of the same post under different URLs and ensures the canonical URL is correct.
Previously, requests for invalid page numbers were only redirected to the post permalink if the post was actually paginated using the `<!--nextpage-->` marker.
Follow-up to [34492].
Props jeremyfelt, prografika, sachit.tandukar, subrataemfluence, hronak, ekatherine, henry.wright, chesio, dd32, SergeyBiryukov.
Fixes#40773. See #45337, #28081, #11694.
git-svn-id: https://develop.svn.wordpress.org/trunk@47727 602fd350-edb4-49c9-b593-d223f7449a82
Previously, the `@` operator was used to prevent possible warnings emitted by `parse_url()` in PHP < 5.3.3 when URL parsing failed.
Now that the minimum version of PHP required by WordPress is 5.6.20, this is no longer needed.
Props netpassprodsr, Howdy_McGee.
Fixes#49980. See #24780.
git-svn-id: https://develop.svn.wordpress.org/trunk@47617 602fd350-edb4-49c9-b593-d223f7449a82
This reduces the number of `WordPress.PHP.StrictInArray.MissingTrueStrict` issues from 486 to 50.
Includes minor code layout fixes for better readability.
See #49542.
git-svn-id: https://develop.svn.wordpress.org/trunk@47550 602fd350-edb4-49c9-b593-d223f7449a82
Previously, `wp_favicon_request()` was introduced in [13205] to avoid a performance hit of serving a full 404 page on every favicon request.
While working as intended, that implementation did not provide a way for theme or plugin authors to manage the behavior of favicon requests.
This changeset implements the following logic (only applied if WordPress is installed in the root directory):
* If there is a Site Icon set in Customizer, redirect `/favicon.ico` requests to that icon.
* Otherwise, use the WordPress logo as a default icon.
* If a physical `/favicon.ico` file exists, do nothing, let the server handle the request.
Handling `/favicon.ico` is now more consistent with handling `/robots.txt` requests.
New functions and hooks:
* Introduce `is_favicon()` conditional tag to complement `is_robots()`.
* Introduce `do_favicon` action to complement `do_robots` and use it in template loader.
* Introduce `do_favicon()` function, hooked to the above action by default, to complement `do_robots()`.
* Introduce `do_faviconico` action to complement `do_robotstxt`, for plugins to override the default behavior.
* Mark `wp_favicon_request()` as deprecated in favor of `do_favicon()`.
Props jonoaldersonwp, birgire, joostdevalk, mukesh27, SergeyBiryukov.
Fixes#47398.
git-svn-id: https://develop.svn.wordpress.org/trunk@47018 602fd350-edb4-49c9-b593-d223f7449a82
WPCS 1.0.0 includes a bunch of new auto-fixers, which drops the number of coding standards issues across WordPress significantly. Prior to running the auto-fixers, there were 15,312 issues detected. With this commit, we now drop to 4,769 issues.
This change includes three notable additions:
- Multiline function calls must now put each parameter on a new line.
- Auto-formatting files is now part of the `grunt precommit` script.
- Auto-fixable coding standards issues will now cause Travis failures.
Fixes#44600.
git-svn-id: https://develop.svn.wordpress.org/trunk@43571 602fd350-edb4-49c9-b593-d223f7449a82
Aaron Jorbin