wordpress-develop/src/wp-includes
Rachel Baker 25c3618138 REST API: Create the general wp_check_jsonp_callback() function for validating JSONP callback functions.
Move the REST API JSONP callback validation check into a separate function named `wp_check_jsonp_callback()`. This allows plugins to use the built-in validation when handling JSONP callbacks.
Extremely Important Note: If you send JSONP in your custom response, make sure you prefix the response with `/**/`. This will mitigate the Rosetta Flash exploit. You should also send the `X-Content-Type-Options:nosniff` header, or even better, use the REST API infrastructure.

Props rmccue.
Fixes #28523.

git-svn-id: https://develop.svn.wordpress.org/trunk@37646 602fd350-edb4-49c9-b593-d223f7449a82
2016-06-06 21:33:30 +00:00
..
certificates Docs: Standardize on 'backward compatibility/compatible' nomenclature in core inline docs. 2016-05-13 18:40:19 +00:00
css System font: The stack does not work with the font shorthand property. 2016-05-17 01:44:36 +00:00
customize Docs: Apply inline @see tags to hooks referenced in DocBlocks for core classes. 2016-05-23 18:53:05 +00:00
fonts Dashicons: Fix incorrect ID in SVG version of font. 2016-03-18 20:42:40 +00:00
ID3
images Embeds: Load the default site icon from the wp-includes directory. 2016-02-23 16:54:32 +00:00
js Editor: 'undefined' !== 'undefiend' 2016-06-03 04:53:21 +00:00
pomo Merge the changes to GlotPress's POMO from upstream to WordPress's copy. 2015-11-20 04:33:12 +00:00
random_compat Update Random_Compat from 1.1.6 to 1.2.1. 2016-03-08 17:14:52 +00:00
Requests HTTP API: Fix compatibility with cURL <7.22 2016-05-13 11:14:06 +00:00
rest-api REST API: Create the general wp_check_jsonp_callback() function for validating JSONP callback functions. 2016-06-06 21:33:30 +00:00
SimplePie Feeds: add CEST to $timezone in SimplePie_Parse_Date. 2015-10-20 05:56:59 +00:00
Text Fix the @author doc param encoding in Text/Diff/Engine/string so the file is recognized as UTF-8, not ISO-8859-1. 2015-10-24 22:44:36 +00:00
theme-compat Docs: Standardize DocBlock summaries for hooks that serve to "print" something to use third-person singular verbs. 2016-05-25 16:04:37 +00:00
widgets Docs: Standardize hook docs in wp-includes/widgets/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:05:54 +00:00
admin-bar.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 18:58:48 +00:00
atomlib.php External Libraries: After [37402], replace two more instances of split() with explode() in wp-includes/atomlib.php. 2016-05-19 00:05:02 +00:00
author-template.php Docs: Standardize filter docs in wp-includes/author-template.php to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:24:23 +00:00
bookmark-template.php Docs: Standardize filter docs in wp-includes/bookmark-template.php to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:23:31 +00:00
bookmark.php Docs: Improve formatting in the DocBlock for sanitize_bookmark_field(). 2016-05-27 17:15:58 +00:00
cache.php Docs: Fix an incorrect Codex link in the file header for wp-includes/cache.php. 2016-05-18 22:06:39 +00:00
canonical.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
capabilities.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
category-template.php Docs: Improve return descriptions for get_the_category() and get_the_term() to specifically notate that an array of WP_Term objects is returned on success. 2016-06-01 22:45:19 +00:00
category.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
class-feed.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
class-http.php Docs: Standardize filter docs in wp-includes/class-http.php to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:42:48 +00:00
class-IXR.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
class-json.php The the Docs: Fix the the dittography 2015-12-06 21:22:10 +00:00
class-oembed.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
class-phpass.php Remove closing PHP tag from wp-includes/class-phpass.php. 2015-10-06 23:44:20 +00:00
class-phpmailer.php Upgrade PHPMailer from 5.2.10 to 5.2.14. 2015-12-24 01:58:33 +00:00
class-pop3.php Docs: Put "it's" in its place (again). 2015-09-16 12:45:51 +00:00
class-requests.php HTTP API: Replace internals with Requests library. 2016-05-13 04:41:45 +00:00
class-simplepie.php Autoload: Introduce shim for SPL autoloading. 2016-06-06 03:23:38 +00:00
class-smtp.php Upgrade PHPMailer from 5.2.10 to 5.2.14. 2015-12-24 01:58:33 +00:00
class-snoopy.php Snoopy: use escapeshellarg instead of escapeshellcmd 2016-03-30 13:57:40 +00:00
class-walker-category-dropdown.php Docs: Improve inline documentation in property and method DocBlocks for Walker_CategoryDropdown. 2016-03-22 17:21:20 +00:00
class-walker-category.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
class-walker-comment.php Comments: pass $comment to comment_text() in Walker_Comment::comment() instead of using a function which can skip the cache. 2016-04-29 15:46:39 +00:00
class-walker-nav-menu.php Nav Menus: Move the Walker_Nav_Menu class to its own file. 2016-06-06 15:17:46 +00:00
class-walker-page-dropdown.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
class-walker-page.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
class-wp-admin-bar.php Docs: Improve the DocBlock summary and add a missing initial @since version for WP_Admin_Bar::add_node(). 2016-03-03 15:57:46 +00:00
class-wp-ajax-response.php Docs: Remove/replace invalid inline @link tags in DocBlocks in wp-includes/*. 2016-05-22 17:39:00 +00:00
class-wp-comment-query.php Comments: Improve caching for hierarchical queries. 2016-06-02 18:27:43 +00:00
class-wp-comment.php Comments: Correct description of comment_author property in WP_Comment class. 2016-01-17 14:59:42 +00:00
class-wp-customize-control.php Docs: Standardize filter docs in the Customizer classes to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:09:59 +00:00
class-wp-customize-manager.php Docs: Apply inline @see tags to hooks referenced in DocBlocks for core classes. 2016-05-23 18:53:05 +00:00
class-wp-customize-nav-menus.php Docs: Standardize filter docs in the Customizer classes to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:09:59 +00:00
class-wp-customize-panel.php Docs: Standardize filter docs in the Customizer classes to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:09:59 +00:00
class-wp-customize-section.php Docs: Standardize filter docs in the Customizer classes to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:09:59 +00:00
class-wp-customize-setting.php Docs: Standardize filter docs in the Customizer classes to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:09:59 +00:00
class-wp-customize-widgets.php Docs: Apply inline @see tags to hooks referenced in DocBlocks for core classes. 2016-05-23 18:53:05 +00:00
class-wp-editor.php Docs: Standardize filter docs in core classes in wp-includes/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:14:19 +00:00
class-wp-embed.php Auto-embedding: 2016-06-02 21:23:43 +00:00
class-wp-error.php Docs: Remove/replace invalid inline @link tags in DocBlocks in wp-includes/*. 2016-05-22 17:39:00 +00:00
class-wp-http-cookie.php Docs: Standardize filter docs in core classes in wp-includes/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:14:19 +00:00
class-wp-http-curl.php Docs: Standardize filter docs in core classes in wp-includes/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:14:19 +00:00
class-wp-http-encoding.php Docs: Standardize filter docs in core classes in wp-includes/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:14:19 +00:00
class-wp-http-ixr-client.php Docs: Standardize filter docs in core classes in wp-includes/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:14:19 +00:00
class-wp-http-proxy.php Docs: Standardize filter docs in core classes in wp-includes/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:14:19 +00:00
class-wp-http-requests-response.php Docs: Standardize on 'backward compatibility/compatible' nomenclature in core inline docs. 2016-05-13 18:40:19 +00:00
class-wp-http-response.php HTTP/REST API: move WP_HTTP_Response to wp-includes/ with the rest (ha!) of the HTTP classes. This is PHP 5.2, so this class is global, and as per @rmccue, unrelated to REST specifically. 2015-10-08 19:26:44 +00:00
class-wp-http-streams.php Docs: Standardize filter docs in core classes in wp-includes/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:14:19 +00:00
class-wp-image-editor-gd.php Docs: Ensure hook and duplicate hook docs directly precede all instances of the image_memory_limit filter. 2016-05-30 02:13:57 +00:00
class-wp-image-editor-imagick.php Docs: Ensure hook and duplicate hook docs directly precede all instances of the image_memory_limit filter. 2016-05-30 02:13:57 +00:00
class-wp-image-editor.php Docs: Standardize filter docs in core classes in wp-includes/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:14:19 +00:00
class-wp-meta-query.php In WP_Meta_Query, don't cast meta_value to CHAR. 2016-05-30 04:35:16 +00:00
class-wp-metadata-lazyloader.php Docs: Apply inline @see tags to hooks referenced in DocBlocks for core classes. 2016-05-23 18:53:05 +00:00
class-wp-network.php Docs: Standardize filter docs in core classes in wp-includes/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:14:19 +00:00
class-wp-oembed-controller.php Docs: Add missing @access tags to methods in WP_oEmbed_Controller. 2016-05-25 19:21:11 +00:00
class-wp-post.php Docs: Add missing descriptions for the $wpdb global in DocBlocks all the places. 2015-10-14 23:43:10 +00:00
class-wp-rewrite.php Docs: Apply inline @see tags to hooks referenced in DocBlocks for core classes. 2016-05-23 18:53:05 +00:00
class-wp-role.php Docs: Standardize filter docs in core classes in wp-includes/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:14:19 +00:00
class-wp-roles.php Docs: Standardize on 'backward compatibility/compatible' nomenclature in core inline docs. 2016-05-13 18:40:19 +00:00
class-wp-site-query.php Multisite: Introduce WP_Site_Query 2016-05-20 22:03:52 +00:00
class-wp-site.php Multisite: Introduce get_site() 2016-05-20 04:40:39 +00:00
class-wp-tax-query.php Docs: Remove inline @see tags from function, class, and method references in inline docs. 2016-05-02 03:59:56 +00:00
class-wp-term-query.php Docs: Link up a reference to the get_terms_args filter in the hook doc for get_terms_defaults. 2016-05-26 15:16:26 +00:00
class-wp-term.php Docs: Various docblock corrections. 2016-01-10 01:25:44 +00:00
class-wp-theme.php Docs: Apply inline @see tags to hooks referenced in DocBlocks for core classes. 2016-05-23 18:53:05 +00:00
class-wp-user-query.php Docs: Standardize filter docs in core classes in wp-includes/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:14:19 +00:00
class-wp-user.php Docs: Standardize on 'backward compatibility/compatible' nomenclature in core inline docs. 2016-05-13 18:40:19 +00:00
class-wp-walker.php Docs: Standardize on 'backward compatibility/compatible' nomenclature in core inline docs. 2016-05-13 18:40:19 +00:00
class-wp-widget-factory.php Widgets: Provide PHP 5.2 fallback for spl_object_hash() if disabled in logic for registering and unregistering pre-instantiated widgets. 2016-04-30 22:35:27 +00:00
class-wp-widget.php Docs: Standardize filter docs in core classes in wp-includes/* to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:14:19 +00:00
class-wp-xmlrpc-server.php Docs: Apply inline @see tags to hooks referenced in DocBlocks for core classes. 2016-05-23 18:53:05 +00:00
class-wp.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 18:58:48 +00:00
class.wp-dependencies.php Docs: Re-add a @param that went missing in [36993]. 2016-03-14 22:38:53 +00:00
class.wp-scripts.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
class.wp-styles.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
comment-template.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 18:58:48 +00:00
comment.php Use clean_comment_cache() in wp_insert_comment(). 2016-06-01 21:55:19 +00:00
compat.php Autoload: Add missed @since tags to SPL shim. 2016-06-06 03:58:10 +00:00
cron.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 18:58:48 +00:00
date.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
default-constants.php Revert [35804]. This change has unintended side effects, notably that media URLs in the admin area now unexpectedly use the https scheme. A more comprehensive approach will be taken in 4.5. 2015-12-22 13:01:31 +00:00
default-filters.php HTTP API: Add browser compatibility hook for 3xx redirects. 2016-05-13 05:10:52 +00:00
default-widgets.php Docs: Clarify the file header summary for wp-includes/default-widgets.php, the top-level file for bringing in the core widget classes. 2015-09-22 13:35:41 +00:00
deprecated.php Docs: Ensure hook and duplicate hook docs directly precede all instances of the image_memory_limit filter. 2016-05-30 02:13:57 +00:00
embed-template.php Docs: Update the @deprecated tag comment for wp-includes/embed-template.php to reference the correct file path following [36693]. 2016-02-27 21:21:12 +00:00
embed.php Embeds: Ensure embed widths are integers. 2016-05-24 06:14:19 +00:00
feed-atom-comments.php Themes: Improve document title output. 2015-10-20 16:20:04 +00:00
feed-atom.php Feeds: <comments> is optional in RSS2, so don't include it when comments aren't present or open. Same for <wfw:commentRss> and <slash:comments> 2015-11-04 17:46:41 +00:00
feed-rdf.php Themes: Improve document title output. 2015-10-20 16:20:04 +00:00
feed-rss2-comments.php Themes: Improve document title output. 2015-10-20 16:20:04 +00:00
feed-rss2.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
feed-rss.php Themes: Improve document title output. 2015-10-20 16:20:04 +00:00
feed.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:00:41 +00:00
formatting.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:00:41 +00:00
functions.php REST API: Create the general wp_check_jsonp_callback() function for validating JSONP callback functions. 2016-06-06 21:33:30 +00:00
functions.wp-scripts.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:00:41 +00:00
functions.wp-styles.php I18N: Update translator comments after [37190]. 2016-04-13 04:29:25 +00:00
general-template.php Template: Pass $blog_id to the get_custom_logo filter. 2016-06-06 21:23:38 +00:00
http.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:00:41 +00:00
kses.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:00:41 +00:00
l10n.php Docs: Standardize filter docs in wp-includes/l10n.php to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:47:37 +00:00
link-template.php Docs: Update the return description for get_preview_post_link() to note that it can also return null. 2016-05-25 18:24:33 +00:00
load.php Introduce filters for skipping parts of the bootstrap process 2016-06-02 18:46:51 +00:00
locale.php Docs: Standardize on 'backward compatibility/compatible' nomenclature in core inline docs. 2016-05-13 18:40:19 +00:00
media-template.php Customizer, Site Icon preview: improve alt attributes and text accessibility. 2016-04-17 12:00:23 +00:00
media.php Docs: Standardize DocBlock summaries for hooks that serve to "print" something to use third-person singular verbs. 2016-05-25 16:04:37 +00:00
meta.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
ms-blogs.php Multisite: Bump last_changed cache on site update and creation 2016-06-02 00:58:40 +00:00
ms-default-constants.php I18N: Remove <code> tags from translatable string in wp-admin/network/site-new.php. 2016-02-29 03:16:45 +00:00
ms-default-filters.php Move new user notification emails to add_action() callbacks. 2015-09-16 22:18:33 +00:00
ms-deprecated.php Docs: Add some missing @param notations to various DocBlocks in wp-includes/ms-deprecated.php. 2016-02-26 09:15:45 +00:00
ms-files.php
ms-functions.php Multisite: Replace $wpdb->blog queries in ms-functions.php with get_sites() 2016-06-02 02:25:56 +00:00
ms-load.php Multisite: Replace $wpdb->blog queries in get_site_by_path() with get_sites() 2016-06-02 21:45:20 +00:00
ms-settings.php Multisite: Wrap the main bootstrap process in a function 2016-05-20 20:56:54 +00:00
nav-menu-template.php Nav Menus: Move the Walker_Nav_Menu class to its own file. 2016-06-06 15:17:46 +00:00
nav-menu.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
option.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:01:40 +00:00
pluggable-deprecated.php Users: Introduce _wp_get_current_user() for improved backward compatibility. 2016-02-23 22:25:32 +00:00
pluggable.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:01:40 +00:00
plugin.php Bootstrap/Load: Load plugin.php earlier in wp-settings.php 2016-05-27 19:19:12 +00:00
post-formats.php
post-template.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:01:40 +00:00
post-thumbnail-template.php Docs: Standardize filter docs in wp-includes/post-thumbnail-template.php to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:28:11 +00:00
post.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:01:40 +00:00
query.php Allow term meta lazy-loading to be selectively disabled in WP_Query. 2016-05-28 03:09:09 +00:00
registration-functions.php
registration.php
rest-api.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:01:40 +00:00
revision.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:01:40 +00:00
rewrite.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:01:40 +00:00
rss-functions.php
rss.php External Libraries: Replace split() with explode() in the deprecated Atom and MagpieRSS files. 2016-05-07 15:58:42 +00:00
script-loader.php External Libraries: Update jQuery to 1.12.4. 2016-05-23 08:59:07 +00:00
session.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:01:40 +00:00
shortcodes.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
taxonomy.php Taxonomy: No, really, don't pass results of 'count' query through 'get_terms' filter. 2016-06-04 12:19:15 +00:00
template-loader.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
template.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
theme.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:01:40 +00:00
update.php Upgrade: Allow update checks on upgrader_process_complete to be run during Ajax requests. 2016-05-25 19:35:07 +00:00
user.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:01:40 +00:00
vars.php Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP. 2016-05-22 18:49:05 +00:00
version.php Version bump. 2016-05-26 10:05:21 +00:00
widgets.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:01:40 +00:00
wlwmanifest.xml
wp-db.php Database: Split the logic of wpdb::init_charset() into a separate method. 2016-06-01 02:37:20 +00:00
wp-diff.php Docs: Apply inline @see tags to hooks referenced in DocBlocks in a variety of wp-includes/* files. 2016-05-23 19:01:40 +00:00