* Split long concatenated lines using `sprintf()`. This aims to improve readability and avoid multiple `esc_attr()` calls for the same value.
* Escape the form `name` and `id` attributes.
Follow-up to [12696], [18444], [19033].
Props sabbirshouvo, mukesh27, audrasjb, henry.wright, SergeyBiryukov.
Fixes#54279.
git-svn-id: https://develop.svn.wordpress.org/trunk@51926 602fd350-edb4-49c9-b593-d223f7449a82
This commit adds the `public` visibility keyword to each method which did not have an explicit visibility keyword.
Why `public`?
With no visibility previously declared, these methods are implicitly `public` and available for use. Changing them to anything else would be a backwards-compatibility break.
Props costdev, jrf.
See #54177.
git-svn-id: https://develop.svn.wordpress.org/trunk@51919 602fd350-edb4-49c9-b593-d223f7449a82
[51916] fixed a bug where `array( `false` )` was added to the cron array when `_get_cron_array()` returned `false`.
This commit:
* Removes any `false` values from the cron array when upgrading to 5.9+.
* Bumps the database version.
Follow-up to [44917], [51916].
Props peterwilsoncc, jrf.
See #53950.
git-svn-id: https://develop.svn.wordpress.org/trunk@51917 602fd350-edb4-49c9-b593-d223f7449a82
In `wp_schedule_single_event()`, the cron info array is retrieved via a call to `_get_cron_array()` and straight away cast to an array. But as the documentation for that function (correctly) states, the return type of that function is `array|false`, where `false` is returned for a site where no cron jobs have been scheduled (yet).
In the case that `_get_cron_array()` would return `false`, this would now unintentionally create an array with a single entry with key `0` and as the value `false`.
This is a bug. Fixed now by adding validation to the output of `_get_cron_array()` and initializing `$crons` to an empty array if `false` was returned.
Tests added first to prove the bug (a) was introduced in #44818 [44917] and (b) is now fixed.
Follow-up to [44917].
Props jrf, peterwilsoncc.
Fixes#53950.
git-svn-id: https://develop.svn.wordpress.org/trunk@51916 602fd350-edb4-49c9-b593-d223f7449a82
The `get_attached_file()` function is supposed to return the path to the file, but could:
1. Return `false` if the file doesn't exist.
2. Return literally anything else, as a filter is being applied to the value on return.
As the `clean_dirsize_cache()` now has input validation, passing anything but a non-empty string to `clean_dirsize_cache()` will result in a PHP error notice.
This was exposed by the `Tests_Post_GetPostStatus::wpSetUpBeforeClass()` method which started generating unexpected output (the doing it wrong message) during the test run.
While this indicates that there is a flaw in the mocking being done in the test suite, debugging that is outside of the scope of the current patch.
At the same time, as based on the above point, this ''could'' potentially happen in a real-world situation as well, adding additional conditions to the `if` in the `wp_delete_attachment()` function before calling the `clean_dirsize_cache()` function, is warranted.
As there are no tests for the `wp_delete_attachment()` function at all at this time, we're not adding a test specifically for this change for now. This should however be addressed in the future, when tests will be added to cover the `wp_delete_attachment()` function completely.
Follow-up to [32619], [49212], [51910].
Props jrf, hellofromTonya.
See #52241.
git-svn-id: https://develop.svn.wordpress.org/trunk@51912 602fd350-edb4-49c9-b593-d223f7449a82
>PHP natively allows for autovivification (auto-creation of arrays from falsey values). This feature is very useful and used in a lot of PHP projects, especially if the variable is undefined. However, there is a little oddity that allows creating an array from a `false` and `null` value.
The above quote is from the PHP 8.1 RFC and the (accepted) RFC changes the behaviour described above to deprecated auto creation of arrays from `false`. As it is deprecated, it _will_ still work for the time being, but as of PHP 9.0, this will become a Fatal Error, so we may as well fix it now.
The `recurse_dirsize()` function retrieves a transient and places it in the `$directory_cache` variable, but the `get_transient()` function in WP returns `false` when the transient doesn't exist, which subsequently can lead to the above mentioned deprecation notice.
By verifying that the `$directory_cache` variable is an array before assigning to it and initializing it to an empty array, if it's not, we prevent the deprecation notice, as well as harden the function against potentially corrupted transients where this transient would not return the expected array format, but some other variable type.
Includes adding dedicated unit tests for both the PHP 8.1 issue, as well as the hardening against corrupted transients.
Includes some girl-scouting: touching up a parameter description and some code layout.
Refs:
* https://wiki.php.net/rfc/autovivification_false
* https://developer.wordpress.org/reference/functions/get_transient/
Follow-up to [49212], [49744].
Props jrf, hellofromTonya.
See #53635.
git-svn-id: https://develop.svn.wordpress.org/trunk@51911 602fd350-edb4-49c9-b593-d223f7449a82
When the PHP native `dirname()` function is used on a Windows disk name - i.e. `C:\`-, it will return the same, i.e, it will return `C:\` again.
The `clean_dirsize_cache()` function didn't have guard clause against this, which meant that on Windows based systems and IIS servers, this function would result in WordPress getting stuck into an infinite loop.
The adjustment to the `while` part of the function fix this by checking if the return value of the `dirname()` function call is the same as the original path passed to `dirname()`, which effectively fixes the infinite loop.
A number of other improvements made:
1. Add input validation for the `$path` parameter to guard against invalid variable types being passed into the function.
2. Guard against an empty `$path` parameter, which would result in an infinite loop on both Windows as well as *nix based systems.
In both these cases, a PHP notice will now be thrown.
3. When a non-empty string, which isn't a path would previously be passed, the `dirname()` function would transform that to a `.` and the `.` key in the transient cache would be cleared out.
This was a bug as there is no relation between a non-path string and the root directory of file system.
This bug has been fixed by checking that something could actually be a path and handling received non-empty, non-path input parameters in a special way, i.e only removing the cache key for the passed string and bowing out from further processing.
Unfortunately, no tests can be added to guard against the infinite loop.
For the other fixes, we have added appropriate unit tests.
Follow-up up [49212], [49616], [49744].
Props jrf, hellofromTonya, raubvogel, sergeybiryukov, codezen8, sjlevy, drosmog, teachlynx, ekojr, bartoszgrzesik, joegasper, janthiel, josephdickson, ocean90, audrasjb.
Fixes#52241.
git-svn-id: https://develop.svn.wordpress.org/trunk@51910 602fd350-edb4-49c9-b593-d223f7449a82
Remove outdated list of accepted column name values, add a reference to `WP_Date_Query::validate_column()` and the `date_query_valid_columns` filter instead for a more detailed description.
Follow-up to [25139], [25860], [29933], [29934], [29938], [37477], [51905].
Props dimadin, johnjamesjacoby.
Fixes#54248.
git-svn-id: https://develop.svn.wordpress.org/trunk@51906 602fd350-edb4-49c9-b593-d223f7449a82
Add a `@since` note for `registered` and `last_updated` as default recognized date query columns.
Follow-up to [25139], [25860], [29933], [29934], [29938], [37477].
Props dimadin, johnjamesjacoby.
See #54248.
git-svn-id: https://develop.svn.wordpress.org/trunk@51905 602fd350-edb4-49c9-b593-d223f7449a82
* Audio
* Video
* Unattached
This allows for more homogeneous translations in languages where keeping a plural form is important.
Follow-up to [6910], [7397], [8901], [9556], [11749], [13100], [12110], [15491], [15578], [22743], [29426], [29625], [34256], [45651], [46437].
Props jdy68, audrasjb, SergeyBiryukov.
Fixes#54238.
git-svn-id: https://develop.svn.wordpress.org/trunk@51903 602fd350-edb4-49c9-b593-d223f7449a82
* Document the post statuses global as an array of `stdClass` objects
* Document the taxonomies global as an array of `WP_Taxonomy` objects
* Document the return value of the post count functions as `stdClass` objects
* Fix some typos
See #53399
git-svn-id: https://develop.svn.wordpress.org/trunk@51885 602fd350-edb4-49c9-b593-d223f7449a82
> The currently recommended certificate chain as presented to Let’s Encrypt ACME clients when new certificates are issued contains an intermediate certificate (ISRG Root X1) that is signed by an old DST Root CA X3 certificate that expires on 2021-09-30. In some cases the OpenSSL 1.0.2 version will regard the certificates issued by the Let’s Encrypt CA as having an expired trust chain.
>
> Most up-to-date CA cert trusted bundles, as provided by operating systems, contain this soon-to-be-expired certificate. The current CA cert bundles also contain an ISRG Root X1 self-signed certificate. This means that clients verifying certificate chains can find the alternative non-expired path to the ISRG Root X1 self-signed certificate in their trust store.
>
> Unfortunately this does not apply to OpenSSL 1.0.2 which always prefers the untrusted chain and if that chain contains a path that leads to an expired trusted root certificate (DST Root CA X3), it will be selected for the certificate verification and the expiration will be reported.
References:
* [https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/ Old Let’s Encrypt Root Certificate Expiration and OpenSSL 1.0.2]
* [https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ DST Root CA X3 Expiration (September 2021)]
Follow-up to [25224], [25426], [25569], [27307], [30491], [30765], [34283], [35919], [36570], [46094].
Props bradleyt, fierevere.
Fixes#54207. See #50828.
git-svn-id: https://develop.svn.wordpress.org/trunk@51883 602fd350-edb4-49c9-b593-d223f7449a82
The `_mb_substr()` function expects a string for the `$str` parameter, but does not do input validation. This function contains a `preg_match_all()` which also expects a string type for the given subject (i.e. `$str`).
Passing `null` to this parameter results in `preg_match_all(): Passing null to parameter #2 ($subject) of type string is deprecated` notice on PHP 8.1.
To maintain the same behaviour as before, a guard clause is added to bail out early when `$str` is passed as `null`. The outcome will, in that case, only ever be an empty string.
Note: this does mean that the `_mb_substr()` function now has a subtle difference in behaviour compared to the PHP native `mb_substr()` function as the latter ''will'' throw the deprecation notice.
The existing tests already cover this issue.
Follow-up to [17621], [36017], [32364].
Props jrf, hellofromTonya.
See #53635.
git-svn-id: https://develop.svn.wordpress.org/trunk@51853 602fd350-edb4-49c9-b593-d223f7449a82
This fixes minor issues that could cause PHP notices under the right conditions, and fixes some general incorrectness.
Props jrf, hellofromTonya for review
See #52217
git-svn-id: https://develop.svn.wordpress.org/trunk@51850 602fd350-edb4-49c9-b593-d223f7449a82
This fixes a `Variable "$processedHeaders" is not in valid snake_case format` WPCS warning.
Follow-up to [8620], [51823].
See #53359.
git-svn-id: https://develop.svn.wordpress.org/trunk@51826 602fd350-edb4-49c9-b593-d223f7449a82
This fixes a `Variable "$arrURL" is not in valid snake_case format` WPCS warning.
Follow-up to [8620], [10509], [25044], [25224], [45667], [51823], [51824].
See #53359.
git-svn-id: https://develop.svn.wordpress.org/trunk@51825 602fd350-edb4-49c9-b593-d223f7449a82
This fixes a `Variable "$arrURL" is not in valid snake_case format` WPCS warning.
Follow-up to [10509], [25044], [45667], [51823].
See #53359.
git-svn-id: https://develop.svn.wordpress.org/trunk@51824 602fd350-edb4-49c9-b593-d223f7449a82
This fixes a `Variable "$arrURL" is not in valid snake_case format` WPCS warning.
Follow-up to [10509], [45667].
See #53359.
git-svn-id: https://develop.svn.wordpress.org/trunk@51823 602fd350-edb4-49c9-b593-d223f7449a82
Global styles are used in a few different contexts (front, editor, customizer, the theme directory). In the last two contexts, it's important that switching themes immediately refreshes the global stylesheet, to avoid situations in which the styles of the previous theme load with the new one. This was brought up at WordPress/gutenberg#34531 (customizer) and at meta.trac.wordpress.org/ticket/5818 (theme directory).
This commit makes sure the stylesheet is regenerated upon switching themes.
Props oandregal, dd32.
See #53175.
git-svn-id: https://develop.svn.wordpress.org/trunk@51819 602fd350-edb4-49c9-b593-d223f7449a82
In all four of the `get_option()`, `add_option()`, `update_option()` and `delete_option()` functions, the `$option` parameter (i.e. the option name) is passed to the PHP native `trim()` function without prior input validation.
In PHP 8.1, this could lead to a `trim(): Passing null to parameter #1 ($string) of type string is deprecated` for each of these functions.
`trim()`:
- expects a text string and is only useful when ''passed'' a text string as no other variable type can contain whitespace.
- will always return a `string`, which means that in practice for any non-string values passed, it would effectively function as a type cast to string.
This commit:
- Adds a check to verify the `$option` name is a scalar before processing it with `trim()`.
- The "type cast" behavior is maintained.
- If the given `$option` name is not a scalar, such as `null`, the fix prevents the PHP 8.1 deprecation notice.
- Tests are added for valid but undesired option names to safeguard against regressions.
This issue is already covered by:
- the existing `Tests_Option_Option::test_bad_option_names()` test group.
- the new `test_valid_but_undesired_option_names()` tests.
Follow-up to [13858], [22633], [23510], [25002], [51817].
Props jrf, hellofromTonya, pbearne.
See #53635.
git-svn-id: https://develop.svn.wordpress.org/trunk@51818 602fd350-edb4-49c9-b593-d223f7449a82
The shortcode content is expected to be a string, not `null`. `do_shortcode()` expects a string for `$content`.
The `img_caption_shortcode()` also expects a string for the `$content` parameter and is expected to return a string for the HTML content to display the caption.
Prior to this commit:
The default value for the `$content` parameter was set to `null`. If no `$content` was passed, the function:
- could return `null` when the `$atts['width'] < 1` or there was no caption
- else, it invoked `do_shortcode( $content )` passing `null` which on PHP 8.1+ triggers a deprecation notice:
{{{
strpos(): Passing null to parameter #1 ($haystack) of type string is deprecated
}}}
This commit:
- Fixes the default `$content` value to align to the expected shortcode content of `string`, not `null`.
- Fixes the PHP 8.1 deprecation notice when `null` was being passed to `do_shortcode()`.
- Changes the assertion in a couple of tests to check for the empty string instead of `null.
Follow-up to [8196], [8925], [8239], [26915], [31530], [42704].
Props jrf, hellofromTonya, azaozz, joedolson.
See #53635.
git-svn-id: https://develop.svn.wordpress.org/trunk@51816 602fd350-edb4-49c9-b593-d223f7449a82
The string refers to HTML code of the block, not an option that blocks HTML.
Follow-up to [50995].
Props Amieiro, NekoJonez, knutsp, johnbillion, namith.jawahar, SergeyBiryukov.
Fixes#54110.
git-svn-id: https://develop.svn.wordpress.org/trunk@51814 602fd350-edb4-49c9-b593-d223f7449a82
In addition to holding the version number, the WordPress version string is used to bust caches and to enable development mode for scripts when running from the `/src` directory.
Follow-up to [803], [2585], [6554], [47230].
Props muhammadfaizanhaidar, azaozz.
Fixes#53413.
git-svn-id: https://develop.svn.wordpress.org/trunk@51809 602fd350-edb4-49c9-b593-d223f7449a82
The `WP_Comment_Query::get_comment_ids()` method is supposed to handle `null` as a search query, but was throwing a `strlen(): Passing null to parameter #1 ($string) of type string is deprecated` notice on PHP 8.1.
Discovered via and already covered via the pre-existing `Tests_Comment_Query::test_search_null_should_be_ignored()` test method.
Follow-up to [36345], [48275].
Props jrf, hellofromTonya.
See #53635.
git-svn-id: https://develop.svn.wordpress.org/trunk@51806 602fd350-edb4-49c9-b593-d223f7449a82
The `Requests_Cookie` class expects valid - non-`null` - attributes to be passed, either as an array or as a `Requests_Utility_CaseInsensitiveDictionary` object.
However, the `WP_Http_Cookie::get_attributes()` explicitly sets the `expires`, `path` and `domain` index keys in an array with values which _may_ be `null`. This will cause `strtotime(): Passing null to parameter #1 ($datetime) of type string is deprecated`-like errors when the attributes are passed to the `Requests_Cookie` class.
Note: a `null` value for `path` would generate a similar deprecation notice, but for the `preg_match()` function.
Fixed by using `array_filter()` on the attributes to explicitly filter out `null` values before passing the attributes to `Requests_Cookie`.
Note: I'm choosing to explicitly only filter `null` values. Using `array_filter()` without a callback would filter out all "empty" values, but that may also remove values which are explicitly set to `false` or `0`, which may be valid values.
Fixes two errors in the `external-http` group in the WordPress Core test suite:
{{{
1) Tests_HTTP_Functions::test_get_response_cookies_with_wp_http_cookie_object
strtotime(): Passing null to parameter #1 ($datetime) of type string is deprecated
/var/www/src/wp-includes/Requests/Cookie.php:268
/var/www/src/wp-includes/Requests/Cookie.php:237
/var/www/src/wp-includes/Requests/Cookie.php:90
/var/www/src/wp-includes/class-http.php:460
/var/www/src/wp-includes/class-http.php:349
/var/www/src/wp-includes/class-http.php:624
/var/www/src/wp-includes/http.php:162
/var/www/tests/phpunit/tests/http/functions.php:156
2) Tests_HTTP_Functions::test_get_cookie_host_only
strtotime(): Passing null to parameter #1 ($datetime) of type string is deprecated
/var/www/src/wp-includes/Requests/Cookie.php:268
/var/www/src/wp-includes/Requests/Cookie.php:237
/var/www/src/wp-includes/Requests/Cookie.php:90
/var/www/src/wp-includes/class-http.php:460
/var/www/tests/phpunit/tests/http/functions.php:235
}}}
Follow-up to [38164], [45135], [51657].
Props jrf, hellofromTonya.
See #53635.
git-svn-id: https://develop.svn.wordpress.org/trunk@51801 602fd350-edb4-49c9-b593-d223f7449a82
Sergey Biryukov