# HG changeset patch # User ymh # Date 1571147293 -7200 # Node ID d255fe9cd479afc3e06dc9966117f73c3851d23c # Parent d8a8807227e48e9d0ac5eac1358a776b64d4549a Upgrade wordpress again diff -r d8a8807227e4 -r d255fe9cd479 wp/wp-admin/about.php --- a/wp/wp-admin/about.php Tue Oct 15 11:56:20 2019 +0200 +++ b/wp/wp-admin/about.php Tue Oct 15 15:48:13 2019 +0200 @@ -53,7 +53,27 @@

Version %s addressed some security issues.' ), + '5.2.4' + ); + ?> + the release notes.' ), + sprintf( + /* translators: %s: WordPress version */ + esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ), + sanitize_title( '5.2.4' ) + ) + ); + ?> +

+

+ Version %1$s addressed some security issues and fixed %2$s bug.', 'Version %1$s addressed some security issues and fixed %2$s bugs.', @@ -65,10 +85,10 @@ ?> the release notes.' ), sprintf( - /* translators: %s: WordPress version */ + /* translators: %s: WordPress version */ esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ), sanitize_title( '5.2.3' ) ) diff -r d8a8807227e4 -r d255fe9cd479 wp/wp-includes/class-wp-query.php --- a/wp/wp-includes/class-wp-query.php Tue Oct 15 11:56:20 2019 +0200 +++ b/wp/wp-includes/class-wp-query.php Tue Oct 15 15:48:13 2019 +0200 @@ -538,7 +538,6 @@ 'attachment', 'attachment_id', 'name', - 'static', 'pagename', 'page_id', 'second', @@ -802,7 +801,7 @@ // If year, month, day, hour, minute, and second are set, a single // post is being queried. $this->is_single = true; - } elseif ( '' != $qv['static'] || '' != $qv['pagename'] || ! empty( $qv['page_id'] ) ) { + } elseif ( '' != $qv['pagename'] || ! empty( $qv['page_id'] ) ) { $this->is_page = true; $this->is_single = false; } else { diff -r d8a8807227e4 -r d255fe9cd479 wp/wp-includes/class-wp.php --- a/wp/wp-includes/class-wp.php Tue Oct 15 11:56:20 2019 +0200 +++ b/wp/wp-includes/class-wp.php Tue Oct 15 15:48:13 2019 +0200 @@ -14,7 +14,7 @@ * @since 2.0.0 * @var string[] */ - public $public_query_vars = array( 'm', 'p', 'posts', 'w', 'cat', 'withcomments', 'withoutcomments', 's', 'search', 'exact', 'sentence', 'calendar', 'page', 'paged', 'more', 'tb', 'pb', 'author', 'order', 'orderby', 'year', 'monthnum', 'day', 'hour', 'minute', 'second', 'name', 'category_name', 'tag', 'feed', 'author_name', 'static', 'pagename', 'page_id', 'error', 'attachment', 'attachment_id', 'subpost', 'subpost_id', 'preview', 'robots', 'taxonomy', 'term', 'cpage', 'post_type', 'embed' ); + public $public_query_vars = array( 'm', 'p', 'posts', 'w', 'cat', 'withcomments', 'withoutcomments', 's', 'search', 'exact', 'sentence', 'calendar', 'page', 'paged', 'more', 'tb', 'pb', 'author', 'order', 'orderby', 'year', 'monthnum', 'day', 'hour', 'minute', 'second', 'name', 'category_name', 'tag', 'feed', 'author_name', 'pagename', 'page_id', 'error', 'attachment', 'attachment_id', 'subpost', 'subpost_id', 'preview', 'robots', 'taxonomy', 'term', 'cpage', 'post_type', 'embed' ); /** * Private query variables. diff -r d8a8807227e4 -r d255fe9cd479 wp/wp-includes/functions.php --- a/wp/wp-includes/functions.php Tue Oct 15 11:56:20 2019 +0200 +++ b/wp/wp-includes/functions.php Tue Oct 15 15:48:13 2019 +0200 @@ -1787,6 +1787,11 @@ return @is_dir( $target ); } + // Do not allow path traversals. + if ( false !== strpos( $target, '../' ) || false !== strpos( $target, '..' . DIRECTORY_SEPARATOR ) ) { + return false; + } + // We need to find the permissions of the parent folder that exists and inherit that. $target_parent = dirname( $target ); while ( '.' != $target_parent && ! is_dir( $target_parent ) && dirname( $target_parent ) !== $target_parent ) { diff -r d8a8807227e4 -r d255fe9cd479 wp/wp-includes/http.php --- a/wp/wp-includes/http.php Tue Oct 15 11:56:20 2019 +0200 +++ b/wp/wp-includes/http.php Tue Oct 15 15:48:13 2019 +0200 @@ -555,7 +555,7 @@ } else { $ip = gethostbyname( $host ); if ( $ip === $host ) { // Error condition for gethostbyname() - $ip = false; + return false; } } if ( $ip ) { diff -r d8a8807227e4 -r d255fe9cd479 wp/wp-includes/pluggable.php --- a/wp/wp-includes/pluggable.php Tue Oct 15 11:56:20 2019 +0200 +++ b/wp/wp-includes/pluggable.php Tue Oct 15 15:48:13 2019 +0200 @@ -1092,7 +1092,7 @@ * 0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago. */ function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) { - if ( -1 == $action ) { + if ( -1 === $action ) { _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2.0' ); } @@ -1111,7 +1111,7 @@ */ do_action( 'check_admin_referer', $action, $result ); - if ( ! $result && ! ( -1 == $action && strpos( $referer, $adminurl ) === 0 ) ) { + if ( ! $result && ! ( -1 === $action && strpos( $referer, $adminurl ) === 0 ) ) { wp_nonce_ays( $action ); die(); } @@ -1400,6 +1400,7 @@ $path = ''; if ( ! empty( $_SERVER['REQUEST_URI'] ) ) { $path = dirname( parse_url( 'http://placeholder' . $_SERVER['REQUEST_URI'], PHP_URL_PATH ) . '?' ); + $path = wp_normalize_path( $path ); } $location = '/' . ltrim( $path . '/', '/' ) . $location; } diff -r d8a8807227e4 -r d255fe9cd479 wp/wp-includes/rest-api.php --- a/wp/wp-includes/rest-api.php Tue Oct 15 11:56:20 2019 +0200 +++ b/wp/wp-includes/rest-api.php Tue Oct 15 15:48:13 2019 +0200 @@ -587,6 +587,8 @@ header( 'Access-Control-Allow-Origin: ' . $origin ); header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' ); header( 'Access-Control-Allow-Credentials: true' ); + header( 'Vary: Origin', false ); + } elseif ( ! headers_sent() && 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) { header( 'Vary: Origin' ); } diff -r d8a8807227e4 -r d255fe9cd479 wp/wp-includes/script-loader.php --- a/wp/wp-includes/script-loader.php Tue Oct 15 11:56:20 2019 +0200 +++ b/wp/wp-includes/script-loader.php Tue Oct 15 15:48:13 2019 +0200 @@ -1178,8 +1178,6 @@ ) ); - $scripts->add( 'wp-sanitize', "/wp-includes/js/wp-sanitize$suffix.js", array( 'jquery' ), false, 1 ); - $scripts->add( 'wp-backbone', "/wp-includes/js/wp-backbone$suffix.js", array( 'backbone', 'wp-util' ), false, 1 ); $scripts->add( 'revisions', "/wp-admin/js/revisions$suffix.js", array( 'wp-backbone', 'jquery-ui-slider', 'hoverIntent' ), false, 1 ); diff -r d8a8807227e4 -r d255fe9cd479 wp/wp-includes/version.php --- a/wp/wp-includes/version.php Tue Oct 15 11:56:20 2019 +0200 +++ b/wp/wp-includes/version.php Tue Oct 15 15:48:13 2019 +0200 @@ -13,7 +13,7 @@ * * @global string $wp_version */ -$wp_version = '5.2.3'; +$wp_version = '5.2.4'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.