diff -r 34716fd837a4 -r be944660c56a wp/wp-admin/includes/media.php
--- a/wp/wp-admin/includes/media.php	Tue Dec 15 15:52:01 2020 +0100
+++ b/wp/wp-admin/includes/media.php	Wed Sep 21 18:19:35 2022 +0200
@@ -49,10 +49,10 @@
 		return $tabs;
 	}
 
-	$post_id = intval( $_REQUEST['post_id'] );
+	$post_id = (int) $_REQUEST['post_id'];
 
 	if ( $post_id ) {
-		$attachments = intval( $wpdb->get_var( $wpdb->prepare( "SELECT count(*) FROM $wpdb->posts WHERE post_type = 'attachment' AND post_status != 'trash' AND post_parent = %d", $post_id ) ) );
+		$attachments = (int) $wpdb->get_var( $wpdb->prepare( "SELECT count(*) FROM $wpdb->posts WHERE post_type = 'attachment' AND post_status != 'trash' AND post_parent = %d", $post_id ) );
 	}
 
 	if ( empty( $attachments ) ) {
@@ -125,8 +125,8 @@
  * @param string       $align   Image CSS alignment property.
  * @param string       $url     Optional. Image src URL. Default empty.
  * @param bool|string  $rel     Optional. Value for rel attribute or whether to add a default value. Default false.
- * @param string|array $size    Optional. Image size. Accepts any valid image size, or an array of width
- *                              and height values in pixels (in that order). Default 'medium'.
+ * @param string|int[] $size    Optional. Image size. Accepts any registered image size name, or an array of
+ *                              width and height values in pixels (in that order). Default 'medium'.
  * @param string       $alt     Optional. Image alt attribute. Default empty.
  * @return string The HTML output to insert into the editor.
  */
@@ -138,7 +138,7 @@
 		if ( is_string( $rel ) ) {
 			$rel = ' rel="' . esc_attr( $rel ) . '"';
 		} else {
-			$rel = ' rel="attachment wp-att-' . intval( $id ) . '"';
+			$rel = ' rel="attachment wp-att-' . (int) $id . '"';
 		}
 	} else {
 		$rel = '';
@@ -152,6 +152,7 @@
 	 * Filters the image HTML markup to send to the editor when inserting an image.
 	 *
 	 * @since 2.5.0
+	 * @since 5.6.0 The `$rel` parameter was added.
 	 *
 	 * @param string       $html    The image HTML markup to send.
 	 * @param int          $id      The attachment ID.
@@ -159,11 +160,12 @@
 	 * @param string       $title   The image title.
 	 * @param string       $align   The image alignment.
 	 * @param string       $url     The image source URL.
-	 * @param string|array $size    Size of image. Image size or array of width and height values
-	 *                              (in that order). Default 'medium'.
+	 * @param string|int[] $size    Requested image size. Can be any registered image size name, or
+	 *                              an array of width and height values in pixels (in that order).
 	 * @param string       $alt     The image alternative, or alt, text.
+	 * @param string       $rel     The image rel attribute.
 	 */
-	$html = apply_filters( 'image_send_to_editor', $html, $id, $caption, $title, $align, $url, $size, $alt );
+	$html = apply_filters( 'image_send_to_editor', $html, $id, $caption, $title, $align, $url, $size, $alt, $rel );
 
 	return $html;
 }
@@ -174,12 +176,12 @@
  * @since 2.6.0
  *
  * @param string  $html    The image HTML markup to send.
- * @param integer $id      Image attachment ID.
+ * @param int     $id      Image attachment ID.
  * @param string  $caption Image caption.
  * @param string  $title   Image title attribute (not used).
  * @param string  $align   Image CSS alignment property.
  * @param string  $url     Image source URL (not used).
- * @param string  $size    Image size (`thumbnail`, `medium`, `large`, `full`, or added with `add_image_size()`) (not used).
+ * @param string  $size    Image size (not used).
  * @param string  $alt     Image `alt` attribute (not used).
  * @return string The image HTML markup with caption shortcode.
  */
@@ -428,21 +430,23 @@
  * @since 2.6.0
  * @since 5.3.0 The `$post_id` parameter was made optional.
  *
- * @param array  $file_array Array similar to a `$_FILES` upload array.
- * @param int    $post_id    Optional. The post ID the media is associated with.
- * @param string $desc       Optional. Description of the side-loaded file. Default null.
- * @param array  $post_data  Optional. Post data to override. Default empty array.
+ * @param string[] $file_array Array that represents a `$_FILES` upload array.
+ * @param int      $post_id    Optional. The post ID the media is associated with.
+ * @param string   $desc       Optional. Description of the side-loaded file. Default null.
+ * @param array    $post_data  Optional. Post data to override. Default empty array.
  * @return int|WP_Error The ID of the attachment or a WP_Error on failure.
  */
 function media_handle_sideload( $file_array, $post_id = 0, $desc = null, $post_data = array() ) {
 	$overrides = array( 'test_form' => false );
 
-	$time = current_time( 'mysql' );
-	$post = get_post( $post_id );
-
-	if ( $post ) {
-		if ( substr( $post->post_date, 0, 4 ) > 0 ) {
+	if ( isset( $post_data['post_date'] ) && substr( $post_data['post_date'], 0, 4 ) > 0 ) {
+		$time = $post_data['post_date'];
+	} else {
+		$post = get_post( $post_id );
+		if ( $post && substr( $post->post_date, 0, 4 ) > 0 ) {
 			$time = $post->post_date;
+		} else {
+			$time = current_time( 'mysql' );
 		}
 	}
 
@@ -529,8 +533,8 @@
 
 	?>
 	<script type="text/javascript">
-	addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
-	var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
+	addLoadEvent = function(func){if(typeof jQuery!=='undefined')jQuery(document).ready(func);else if(typeof wpOnload!=='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
+	var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
 	isRtl = <?php echo (int) is_rtl(); ?>;
 	</script>
 	<?php
@@ -603,7 +607,7 @@
 	do_action( 'admin_print_footer_scripts' );
 
 	?>
-	<script type="text/javascript">if(typeof wpOnload=='function')wpOnload();</script>
+	<script type="text/javascript">if(typeof wpOnload==='function')wpOnload();</script>
 	</body>
 	</html>
 	<?php
@@ -692,9 +696,14 @@
 	 * The dynamic portion of the hook name, `$type`, refers to the type
 	 * of media uploaded.
 	 *
+	 * Possible hook names include:
+	 *
+	 *  - `image_upload_iframe_src`
+	 *  - `media_upload_iframe_src`
+	 *
 	 * @since 3.0.0
 	 *
-	 * @param string $upload_iframe_src The upload iframe source URL by type.
+	 * @param string $upload_iframe_src The upload iframe source URL.
 	 */
 	$upload_iframe_src = apply_filters( "{$type}_upload_iframe_src", $upload_iframe_src );
 
@@ -889,6 +898,12 @@
 			 * The dynamic portion of the hook name, `$type`, refers to the type
 			 * of media being sent.
 			 *
+			 * Possible hook names include:
+			 *
+			 *  - `audio_send_to_editor_url`
+			 *  - `file_send_to_editor_url`
+			 *  - `video_send_to_editor_url`
+			 *
 			 * @since 3.3.0
 			 *
 			 * @param string $html  HTML markup sent to the editor.
@@ -958,11 +973,11 @@
 }
 
 /**
- * Downloads an image from the specified URL and attaches it to a post.
+ * Downloads an image from the specified URL, saves it as an attachment, and optionally attaches it to a post.
  *
  * @since 2.6.0
  * @since 4.2.0 Introduced the `$return` parameter.
- * @since 4.8.0 Introduced the 'id' option within the `$return` parameter.
+ * @since 4.8.0 Introduced the 'id' option for the `$return` parameter.
  * @since 5.3.0 The `$post_id` parameter was made optional.
  * @since 5.4.0 The original URL of the attachment is stored in the `_source_url`
  *              post meta value.
@@ -972,13 +987,35 @@
  * @param string $desc    Optional. Description of the image.
  * @param string $return  Optional. Accepts 'html' (image tag html) or 'src' (URL),
  *                        or 'id' (attachment ID). Default 'html'.
- * @return string|WP_Error Populated HTML img tag on success, WP_Error object otherwise.
+ * @return string|int|WP_Error Populated HTML img tag, attachment ID, or attachment source
+ *                             on success, WP_Error object otherwise.
  */
 function media_sideload_image( $file, $post_id = 0, $desc = null, $return = 'html' ) {
 	if ( ! empty( $file ) ) {
 
+		$allowed_extensions = array( 'jpg', 'jpeg', 'jpe', 'png', 'gif', 'webp' );
+
+		/**
+		 * Filters the list of allowed file extensions when sideloading an image from a URL.
+		 *
+		 * The default allowed extensions are:
+		 *
+		 *  - `jpg`
+		 *  - `jpeg`
+		 *  - `jpe`
+		 *  - `png`
+		 *  - `gif`
+		 *
+		 * @since 5.6.0
+		 *
+		 * @param string[] $allowed_extensions Array of allowed file extensions.
+		 * @param string   $file               The URL of the image to download.
+		 */
+		$allowed_extensions = apply_filters( 'image_sideload_extensions', $allowed_extensions, $file );
+		$allowed_extensions = array_map( 'preg_quote', $allowed_extensions );
+
 		// Set variables for storage, fix file filename for query strings.
-		preg_match( '/[^\?]+\.(jpe?g|jpe|gif|png)\b/i', $file, $matches );
+		preg_match( '/[^\?]+\.(' . implode( '|', $allowed_extensions ) . ')\b/i', $file, $matches );
 
 		if ( ! $matches ) {
 			return new WP_Error( 'image_sideload_failed', __( 'Invalid image URL.' ) );
@@ -1115,7 +1152,7 @@
 			" /><label for='image-align-{$name}-{$post->ID}' class='align image-align-{$name}-label'>$label</label>";
 	}
 
-	return join( "\n", $out );
+	return implode( "\n", $out );
 }
 
 /**
@@ -1192,7 +1229,7 @@
 	return array(
 		'label' => __( 'Size' ),
 		'input' => 'html',
-		'html'  => join( "\n", $out ),
+		'html'  => implode( "\n", $out ),
 	);
 }
 
@@ -1317,7 +1354,7 @@
  * @since 2.5.0
  *
  * @param string  $html
- * @param integer $attachment_id
+ * @param int     $attachment_id
  * @param array   $attachment
  * @return string
  */
@@ -1421,7 +1458,7 @@
 			$values[] = $term->slug;
 		}
 
-		$t['value'] = join( ', ', $values );
+		$t['value'] = implode( ', ', $values );
 
 		$form_fields[ $taxonomy ] = $t;
 	}
@@ -1547,7 +1584,7 @@
 	global $redir_tab;
 
 	$thumb_url     = false;
-	$attachment_id = intval( $attachment_id );
+	$attachment_id = (int) $attachment_id;
 
 	if ( $attachment_id ) {
 		$thumb_url = wp_get_attachment_image_src( $attachment_id, 'thumbnail', true );
@@ -1781,7 +1818,7 @@
 		}
 
 		if ( ! empty( $field['helps'] ) ) {
-			$item .= "<p class='help'>" . join( "</p>\n<p class='help'>", array_unique( (array) $field['helps'] ) ) . '</p>';
+			$item .= "<p class='help'>" . implode( "</p>\n<p class='help'>", array_unique( (array) $field['helps'] ) ) . '</p>';
 		}
 		$item .= "</td>\n\t\t</tr>\n";
 
@@ -1880,7 +1917,7 @@
 				$values[] = $term->slug;
 			}
 
-			$t['value']    = join( ', ', $values );
+			$t['value']    = implode( ', ', $values );
 			$t['taxonomy'] = true;
 
 			$form_fields[ $taxonomy ] = $t;
@@ -1973,7 +2010,7 @@
 		}
 
 		if ( ! empty( $field['helps'] ) ) {
-			$item .= "<p class='help'>" . join( "</p>\n<p class='help'>", array_unique( (array) $field['helps'] ) ) . '</p>';
+			$item .= "<p class='help'>" . implode( "</p>\n<p class='help'>", array_unique( (array) $field['helps'] ) ) . '</p>';
 		}
 
 		$item .= "</td>\n\t\t</tr>\n";
@@ -2033,7 +2070,7 @@
  * @since 2.5.0
  */
 function media_upload_header() {
-	$post_id = isset( $_REQUEST['post_id'] ) ? intval( $_REQUEST['post_id'] ) : 0;
+	$post_id = isset( $_REQUEST['post_id'] ) ? (int) $_REQUEST['post_id'] : 0;
 
 	echo '<script type="text/javascript">post_id = ' . $post_id . ';</script>';
 
@@ -2069,7 +2106,7 @@
 	}
 
 	$upload_action_url = admin_url( 'async-upload.php' );
-	$post_id           = isset( $_REQUEST['post_id'] ) ? intval( $_REQUEST['post_id'] ) : 0;
+	$post_id           = isset( $_REQUEST['post_id'] ) ? (int) $_REQUEST['post_id'] : 0;
 	$_type             = isset( $type ) ? $type : '';
 	$_tab              = isset( $tab ) ? $tab : '';
 
@@ -2161,6 +2198,11 @@
 		$plupload_init['multi_selection'] = false;
 	}
 
+	// Check if WebP images can be edited.
+	if ( ! wp_image_editor_supports( array( 'mime_type' => 'image/webp' ) ) ) {
+		$plupload_init['webp_upload_error'] = true;
+	}
+
 	/**
 	 * Filters the default Plupload settings.
 	 *
@@ -2271,15 +2313,15 @@
  *
  * @since 2.5.0
  *
- * @param string  $type
- * @param object  $errors
- * @param integer $id
+ * @param string       $type
+ * @param array        $errors
+ * @param int|WP_Error $id
  */
 function media_upload_type_form( $type = 'file', $errors = null, $id = null ) {
 
 	media_upload_header();
 
-	$post_id = isset( $_REQUEST['post_id'] ) ? intval( $_REQUEST['post_id'] ) : 0;
+	$post_id = isset( $_REQUEST['post_id'] ) ? (int) $_REQUEST['post_id'] : 0;
 
 	$form_action_url = admin_url( "media-upload.php?type=$type&tab=type&post_id=$post_id" );
 
@@ -2347,7 +2389,7 @@
  *
  * @param string  $type
  * @param object  $errors
- * @param integer $id
+ * @param int     $id
  */
 function media_upload_type_url_form( $type = null, $errors = null, $id = null ) {
 	if ( null === $type ) {
@@ -2356,7 +2398,7 @@
 
 	media_upload_header();
 
-	$post_id = isset( $_REQUEST['post_id'] ) ? intval( $_REQUEST['post_id'] ) : 0;
+	$post_id = isset( $_REQUEST['post_id'] ) ? (int) $_REQUEST['post_id'] : 0;
 
 	$form_action_url = admin_url( "media-upload.php?type=$type&tab=type&post_id=$post_id" );
 	/** This filter is documented in wp-admin/includes/media.php */
@@ -2504,7 +2546,7 @@
 	$redir_tab = 'gallery';
 	media_upload_header();
 
-	$post_id         = intval( $_REQUEST['post_id'] );
+	$post_id         = (int) $_REQUEST['post_id'];
 	$form_action_url = admin_url( "media-upload.php?type=$type&tab=gallery&post_id=$post_id" );
 	/** This filter is documented in wp-admin/includes/media.php */
 	$form_action_url = apply_filters( 'media_upload_form_url', $form_action_url, $type );
@@ -2667,7 +2709,7 @@
 
 	media_upload_header();
 
-	$post_id = isset( $_REQUEST['post_id'] ) ? intval( $_REQUEST['post_id'] ) : 0;
+	$post_id = isset( $_REQUEST['post_id'] ) ? (int) $_REQUEST['post_id'] : 0;
 
 	$form_action_url = admin_url( "media-upload.php?type=$type&tab=library&post_id=$post_id" );
 	/** This filter is documented in wp-admin/includes/media.php */
@@ -2680,7 +2722,7 @@
 
 	$q                   = $_GET;
 	$q['posts_per_page'] = 10;
-	$q['paged']          = isset( $q['paged'] ) ? intval( $q['paged'] ) : 0;
+	$q['paged']          = isset( $q['paged'] ) ? (int) $q['paged'] : 0;
 	if ( $q['paged'] < 1 ) {
 		$q['paged'] = 1;
 	}
@@ -2982,9 +3024,9 @@
 
 	$post = get_post();
 	if ( $post ) {
-		$browser_uploader .= '&amp;post_id=' . intval( $post->ID );
+		$browser_uploader .= '&amp;post_id=' . (int) $post->ID;
 	} elseif ( ! empty( $GLOBALS['post_ID'] ) ) {
-		$browser_uploader .= '&amp;post_id=' . intval( $GLOBALS['post_ID'] );
+		$browser_uploader .= '&amp;post_id=' . (int) $GLOBALS['post_ID'];
 	}
 
 	?>
@@ -3076,7 +3118,7 @@
 	}
 
 	$thumb_url     = false;
-	$attachment_id = intval( $post->ID );
+	$attachment_id = (int) $post->ID;
 
 	if ( $attachment_id ) {
 		$thumb_url = wp_get_attachment_image_src( $attachment_id, array( 900, 450 ), true );
@@ -3192,7 +3234,7 @@
 			/* translators: 1: Link to tutorial, 2: Additional link attributes, 3: Accessibility text. */
 			__( '<a href="%1$s" %2$s>Describe the purpose of the image%3$s</a>. Leave empty if the image is purely decorative.' ),
 			esc_url( 'https://www.w3.org/WAI/tutorials/images/decision-tree' ),
-			'target="_blank" rel="noopener noreferrer"',
+			'target="_blank" rel="noopener"',
 			sprintf(
 				'<span class="screen-reader-text"> %s</span>',
 				/* translators: Accessibility text. */
@@ -3264,12 +3306,48 @@
 
 	$att_url = wp_get_attachment_url( $attachment_id );
 
+	$author = new WP_User( $post->post_author );
+
+	$uploaded_by_name = __( '(no author)' );
+	$uploaded_by_link = '';
+
+	if ( $author->exists() ) {
+		$uploaded_by_name = $author->display_name ? $author->display_name : $author->nickname;
+		$uploaded_by_link = get_edit_user_link( $author->ID );
+	}
 	?>
+	<div class="misc-pub-section misc-pub-uploadedby">
+		<?php if ( $uploaded_by_link ) { ?>
+			<?php _e( 'Uploaded by:' ); ?> <a href="<?php echo $uploaded_by_link; ?>"><strong><?php echo $uploaded_by_name; ?></strong></a>
+		<?php } else { ?>
+			<?php _e( 'Uploaded by:' ); ?> <strong><?php echo $uploaded_by_name; ?></strong>
+		<?php } ?>
+	</div>
+
+	<?php
+	if ( $post->post_parent ) {
+		$post_parent = get_post( $post->post_parent );
+		if ( $post_parent ) {
+			$uploaded_to_title = $post_parent->post_title ? $post_parent->post_title : __( '(no title)' );
+			$uploaded_to_link  = get_edit_post_link( $post->post_parent, 'raw' );
+			?>
+			<div class="misc-pub-section misc-pub-uploadedto">
+				<?php if ( $uploaded_to_link ) { ?>
+					<?php _e( 'Uploaded to:' ); ?> <a href="<?php echo $uploaded_to_link; ?>"><strong><?php echo $uploaded_to_title; ?></strong></a>
+				<?php } else { ?>
+					<?php _e( 'Uploaded to:' ); ?> <strong><?php echo $uploaded_to_title; ?></strong>
+				<?php } ?>
+			</div>
+			<?php
+		}
+	}
+	?>
+
 	<div class="misc-pub-section misc-pub-attachment">
 		<label for="attachment_url"><?php _e( 'File URL:' ); ?></label>
 		<input type="text" class="widefat urlfield" readonly="readonly" name="attachment_url" id="attachment_url" value="<?php echo esc_attr( $att_url ); ?>" />
 		<span class="copy-to-clipboard-container">
-			<button type="button" class="button copy-attachment-url edit-media" data-clipboard-target="#attachment_url"><?php _e( 'Copy URL' ); ?></button>
+			<button type="button" class="button copy-attachment-url edit-media" data-clipboard-target="#attachment_url"><?php _e( 'Copy URL to clipboard' ); ?></button>
 			<span class="success hidden" aria-hidden="true"><?php _e( 'Copied!' ); ?></span>
 		</span>
 	</div>
@@ -3467,7 +3545,7 @@
  * @since 3.6.0
  *
  * @param string $file Path to file.
- * @return array|bool Returns array of metadata, if found.
+ * @return array|false Returns array of metadata, if found.
  */
 function wp_read_video_metadata( $file ) {
 	if ( ! file_exists( $file ) ) {
@@ -3578,7 +3656,7 @@
  * @since 3.6.0
  *
  * @param string $file Path to file.
- * @return array|bool Returns array of metadata, if found.
+ * @return array|false Returns array of metadata, if found.
  */
 function wp_read_audio_metadata( $file ) {
 	if ( ! file_exists( $file ) ) {
@@ -3647,8 +3725,8 @@
  * @link https://github.com/JamesHeinrich/getID3/blob/master/structure.txt
  *
  * @param array $metadata The metadata returned by getID3::analyze().
- * @return int|bool A UNIX timestamp for the media's creation date if available
- *                  or a boolean FALSE if a timestamp could not be determined.
+ * @return int|false A UNIX timestamp for the media's creation date if available
+ *                   or a boolean FALSE if a timestamp could not be determined.
  */
 function wp_get_media_creation_timestamp( $metadata ) {
 	$creation_date = false;