Html css fuzz css token processor - #63
Draft
sirreal wants to merge 356 commits into
Draft
Conversation
This is a more appropriate name for the type of match. > `[att|=val]` Represents an element with the att attribute, its value > either being exactly "val" or beginning with "val" immediately > followed by "-" (U+002D). This is primarily intended to allow language > subcode matches (e.g., the hreflang attribute on the a element in > HTML) as described in BCP 47 ([BCP47]) or its successor.
Passing anything other than a struct as the fourth argument caused a fatal error, and because the struct was read before the login was attempted, an unauthenticated request was enough to trigger it. Read and validate the struct only once the request is authenticated and the `upload_files` capability is confirmed, as every other method on the server does, and reject a call with too few arguments using `minimum_args()`. The `name`, `type` and `bits` members must all be strings: a struct sent for `bits` reached `fwrite()` by way of `wp_upload_bits()` and threw a `TypeError`, while one sent for `type` survived `sanitize_mime_type()` to reach the database as the attachment's post MIME type. A `name` left empty by `sanitize_file_name()` is now reported as a malformed request too, rather than as the server failure `wp_upload_bits()` produced for it. The fourth argument is expanded into a nested hash in the documentation, covering the previously undocumented `post_id` member. Tests cover each rejected shape, the optional members that remain tolerated when absent, and the ordering of the login and capability checks ahead of the validation. Developed in WordPress#12482. Follow-up to r32579, r53881. Props josephscott, westonruter, mukesh27. See #65600. Fixes #65611. git-svn-id: https://develop.svn.wordpress.org/trunk@63006 602fd350-edb4-49c9-b593-d223f7449a82
The media editor modal rendered without its intended styles, because the stylesheet it relies on was never registered in core. Registering the handle makes the modal display as intended. Developed in WordPress#12813 Props afercia, andrewserong, gulamdastgir04, mdridipu, ramonopoly, softglaze, wildworks. Fixes #65794. git-svn-id: https://develop.svn.wordpress.org/trunk@63007 602fd350-edb4-49c9-b593-d223f7449a82
…otice. Follow-up to [https://mu.trac.wordpress.org/changeset/1968 mu:1968], [https://mu.trac.wordpress.org/changeset/2005 mu:2005], [13590]. Props bor0, realloc. Fixes #65792. git-svn-id: https://develop.svn.wordpress.org/trunk@63008 602fd350-edb4-49c9-b593-d223f7449a82
- Updates the toolbar items styling by adding a more prominent focus indicator. - Adjusts label and icon coloring selectors (including mobile-specific focus states). - Refines the 'Howdy menu' dropdown layout and focus styles. - Tweaks the responsive menu toggle item sizing. Props afercia, joedolson, sabernhardt, khokansardar, jns141191, iamraju, sukhendu2002, shamimmoeen, ugyensupport. Fixes #65445. Fixes #65765. git-svn-id: https://develop.svn.wordpress.org/trunk@63009 602fd350-edb4-49c9-b593-d223f7449a82
Adjust styling on privacy export and erasure tables for compatibility with the list table column changes in [62839]. Update the colors used to highlight confirmed or failed privacy requests following the admin color scheme changes in WordPress 7.0. Developed in WordPress#12803 Props r1k0, joedolson, masteradhoc, shailu25. Fixes #65787. git-svn-id: https://develop.svn.wordpress.org/trunk@63010 602fd350-edb4-49c9-b593-d223f7449a82
The margins were set to `0` for all inputs in the request form, breaking the alignment for the checkbox. Limit margin resetting to inputs of type text. Change labeling from implicit to explicit labelling, to better support voice control users. Developed in WordPress#11841 Props soyebsalar01, suryakantupadhyay, deepakprajapati, audrasjb, joedolson, adrianduffell, mukesh27, wildworks, masteradhoc. Fixes #65246. git-svn-id: https://develop.svn.wordpress.org/trunk@63011 602fd350-edb4-49c9-b593-d223f7449a82
Introduce `wp_notify_note_mentions()` on `rest_insert_comment`, alongside the existing post author notification, which parses those IDs out of the saved note and emails each mentioned user in their own locale with a link back to the post editor. Recipients are limited to users who can `edit_comment` the note, matching `WP_REST_Comments_Controller::check_read_permission()`, so an email cannot carry note content to someone who cannot see the note in the editor. The note's own author is skipped, as is the post author, who `wp_new_comment_via_rest_notify_postauthor()` already notifies about every note. Only note creation notifies, and the existing `wp_notes_notify` option turns the whole path off. See related Gutenberg pull request: WordPress/gutenberg#79606. Follow-up to [62832]. Props westonruter, mamaduka. Fixes #65639. git-svn-id: https://develop.svn.wordpress.org/trunk@63012 602fd350-edb4-49c9-b593-d223f7449a82
When a HEIC upload fails, the Media Library reported that "This image cannot be displayed in a web browser." That has not been accurate since [48288] introduced the string: Safari and other browsers render HEIC fine, and because the same message is sent to every browser it cannot describe what the visitor's own browser supports. The upload fails because the server's image editor cannot process the `image/heic` mime type, so the file is never converted to a web safe format - servers that do support HEIC convert it to JPEG, as of [58849]. Reword the message to name that cause and keep the existing suggestion to convert to JPEG. The `unsupported_image` string is only shown for queued HEIC files, so naming the format explicitly does not affect other uploads; WebP and AVIF continue to use `noneditable_image`. See related Gutenberg issue: WordPress/gutenberg#81123. Follow-up to [48288]. Props khokansardar, annezazu. Fixes #65800. git-svn-id: https://develop.svn.wordpress.org/trunk@63013 602fd350-edb4-49c9-b593-d223f7449a82
…sing. Disable the `big_image_size_threshold` filter alongside the existing client-side processing filters so the upload is stored untouched. The client's scaled sideload then keeps the plain `-scaled` name and records the untouched upload as `original_image`. Uploads that leave `generate_sub_sizes` enabled are unaffected. Props khokansardar, ianmjones. Fixes #65708. git-svn-id: https://develop.svn.wordpress.org/trunk@63014 602fd350-edb4-49c9-b593-d223f7449a82
Ensure upload limits are honored when fetching sideloaded image from URL. `WP_REST_Attachments_Controller::create_item_from_url()` only ran `check_upload_size()`, which returns early when `! is_multisite()`, so a single site had no ceiling at all on this path: `upload_max_filesize` and `post_max_size` bound a request body, not a fetch the server makes itself. Apply `wp_max_upload_size()` to the download, so a URL cannot bring in a file larger than the same site would accept as a direct upload, and pass that limit to the request as `limit_response_size` so an oversized file is not written to disk in full before being rejected. The multisite checks are unchanged and still run first, and no ceiling is applied when `wp_max_upload_size()` returns 0. Follow-up to [62659], [62841]. Props andrewserong, courane01. See #65517. git-svn-id: https://develop.svn.wordpress.org/trunk@63015 602fd350-edb4-49c9-b593-d223f7449a82
In `wp_ajax_autocomplete_user()`, unslash and sanitize the `term` request parameter before it is passed to `get_users()`. Unslashing fixes searching for an email address containing an apostrophe (valid per `is_email()`), which could previously never match because `wp_magic_quotes()` added a slash which `wpdb::esc_like()` then escaped as a literal. Note that the raw term was already safely handled in the user query, since `WP_User_Query` passes the search term through `wpdb::prepare()`, so this is a hardening and correctness fix rather than a security fix. Additionally, a missing, non-string, or empty term now short-circuits with a `0` response instead of returning an empty array, avoiding a PHP warning and needless user queries. Asterisks are also trimmed from the term given that wildcards are appended to it; a term consisting only of asterisks previously resulted in an empty search which matched all users on the network. Also introduce the `Tests_Ajax_wpAjaxAutocompleteUser` test class covering the Ajax action's search behavior, input handling, and capability checks. Developed in WordPress#11530. Follow-up to r19897, r20279. Props rajeshcp, wildworks, westonruter, liaison, gaurangsondagar, vgnavada, saadtajik. Fixes #65051. git-svn-id: https://develop.svn.wordpress.org/trunk@63016 602fd350-edb4-49c9-b593-d223f7449a82
The Media Library grid view renders attachments in the reverse of the order the server returned whenever the `order` query var is present but not uppercase, most commonly after sorting in list view and then clicking the grid view toggle, which carries `order=desc` over in the URL. `WP_Query` normalizes and defaults `order` server side, but the media models compare against the literal strings `'ASC'` and `'DESC'`, so a lowercase or invalid value flips the display. `wp.media.model.Query.get()` already normalized `order`, but `wp.media.model.Attachments.initialize()` did not, so a `Query` and the plain `Attachments` collection mirroring it could disagree about the sort direction. Normalizing at initialization instead gives every attachment collection a consistent `order` regardless of how it was constructed. Props trivedikavit, sabernhardt, mukesh27, shailu25, soyebsalar01, ozgursar, darshitrajyaguru97. Fixes #64467. git-svn-id: https://develop.svn.wordpress.org/trunk@63017 602fd350-edb4-49c9-b593-d223f7449a82
The `url`, `generate_sub_sizes`, and `convert_format` arguments for `POST /wp/v2/media` were only registered when client side media processing is enabled, but `create_item()` and `create_item_permissions_check()` honored all three either way. Since an unregistered argument skips the validation and sanitization its registration carries, an unsafe sideload `url` failed with a bare `http_request_failed` instead of a 400. Gating registration also made the schema depend on request context rather than site configuration, since `wp_is_client_side_media_processing_enabled()` is derived from `is_ssl()` and the host, so the same site could advertise different arguments depending on how it was reached. All three arguments are now registered unconditionally. None of them require the feature: sideloading from a URL works around a cross-origin fetch the browser cannot make, and skipping sub-size generation or format conversion is something the server can do on its own. One condition is kept: `generate_sub_sizes` of `false` no longer relaxes the unsupported image type check in `create_item_permissions_check()` unless client side media processing is enabled, since that check exists because the server cannot process the image and should only be relaxed when the client can. Behavior with client side media processing enabled is unchanged. Follow-up to [62659], [62841]. Props andrewserong, jeremyfelt. Fixes #65808. See #65517. git-svn-id: https://develop.svn.wordpress.org/trunk@63018 602fd350-edb4-49c9-b593-d223f7449a82
Level 1 adds detection of possibly undefined variables, and of unknown magic methods and properties on classes with `__call` and `__get`. The 494 errors this surfaces in existing code are recorded in baselines rather than being fixed here, so that new code is held to level 1 straight away while the existing reports are worked through separately. No files under `src` are changed. The `tests/phpstan/baseline.php` file is replaced by one baseline per error identifier under `tests/phpstan/baselines`, so that the remaining work on each kind of error is visible as a single file that should shrink to nothing and then be deleted. Every entry is scoped to the file which the error occurs in and carries an exact occurrence count, so that a new occurrence of an already baselined error is reported rather than absorbed. The consequence is that fixing a baselined error means regenerating its baseline in the same change, because the count no longer matches. PHPStan's own `--generate-baseline` captures every error a run reports, with no way to restrict it to one identifier, so `tests/phpstan/generate-baselines.php` is added to write the files instead, exposed as `composer phpstan:baselines` and as `npm run typecheck:php:baselines`. A run also deletes any baseline whose identifier no longer reports anything, and rewrites the list of baselines in `phpstan.neon.dist`. The `ignoreErrors` in that file now has a comment explaining how it is distinct from a baseline: an entry there is a decision that the code is right as written, whereas a baseline entry is work still to be done. The constants that `add_theme_support()` defines are declared in the configuration so that the errors around them are resolved rather than recorded, and `tests/phpstan/README.md` is updated throughout. Three problems in the static analysis GHA workflow are fixed as well. Fixing a baselined error makes PHPStan report an unmatched ignore, which surfaced only as an annotation reading like a complaint about a correct fix; the job now detects any `ignore.*` report and fails with an explanation of what to run. An analysis that did not finish passed as a green run, because the status of the pipeline was that of `cs2pr` rather than of PHPStan; that status is now recovered and a run that did not finish fails. The path filter deciding whether the workflow runs named only the old baseline file, so a pull request that merely regenerated the baselines would not have run the analysis that checks them. Developed in WordPress#11151. Follow-up to r61699. Props westonruter, sabernhardt, apermo, johnjamesjacoby, adamsilverstein, justlevine. See #61175. Fixes #64680. git-svn-id: https://develop.svn.wordpress.org/trunk@63019 602fd350-edb4-49c9-b593-d223f7449a82
This rule level includes: > unknown methods checked on all expressions (not just `$this`), validating PHPDocs Baselines are regenerated for errors at this level. Developed in WordPress#12852. Follow-up to r61699, r63019. Props westonruter, apermo. See #64680. git-svn-id: https://develop.svn.wordpress.org/trunk@63020 602fd350-edb4-49c9-b593-d223f7449a82
This rule level includes: > return types, types assigned to properties Baselines are regenerated for errors at this level. Follow-up to r61699, r63019, r63020. Props westonruter, apermo. See Core-64680. git-svn-id: https://develop.svn.wordpress.org/trunk@63021 602fd350-edb4-49c9-b593-d223f7449a82
Follow-up to r63021. See #64680. git-svn-id: https://develop.svn.wordpress.org/trunk@63022 602fd350-edb4-49c9-b593-d223f7449a82
This rule level includes: > basic dead code checking - always false `instanceof` and other type checks, dead `else` branches, unreachable code after return; etc. Baselines are regenerated for errors at this level. Developed in WordPress#12853. Follow-up to r61699, r63019, r63020, r63021, r63022. Props westonruter, apermo. See #64680. git-svn-id: https://develop.svn.wordpress.org/trunk@63023 602fd350-edb4-49c9-b593-d223f7449a82
This rule level includes: > checking types of arguments passed to methods and functions Baselines are regenerated for errors at this level. Developed in WordPress#12855. Follow-up to r61699, r63019, r63020, r63021, r63022, r63023. Props westonruter, apermo. See #64680. git-svn-id: https://develop.svn.wordpress.org/trunk@63024 602fd350-edb4-49c9-b593-d223f7449a82
This adds coverage for the personal data exports directory, verifying both the default location under the uploads directory and that the filter of the same name can override it. Developed in: WordPress#5553 Props desrosj, masteradhoc, mindctrl, pbearne, wildworks. Fixes #59710. git-svn-id: https://develop.svn.wordpress.org/trunk@63025 602fd350-edb4-49c9-b593-d223f7449a82
This updates the pinned commit hash of the Gutenberg repository from `fd715a6833679d098d9fee84b642f8f1bc27341b` to `f05e40e91c54f29c449b1f33d0db89f5166812d9`. A full list of changes included in this commit can be found on GitHub: WordPress/gutenberg@fd715a6...f05e40e - Writing flow: forward delete an empty paragraph without breaking apart the next block (WordPress/gutenberg#80813) - Upload Media: Fail the item when the /finalize request fails (WordPress/gutenberg#80725) - Fix template `modified` and `date` return value for file templates (WordPress/gutenberg#80733) - Boot: Adjust specificity of the image reset styles so components can size their own images (WordPress/gutenberg#80845) - Quote: Ensure paragraph placeholder appears after deleting nested blocks (WordPress/gutenberg#77151) - Block editor: make the Group action wrap blocks with a group transform (WordPress/gutenberg#80891) - Copy: preserve the block when its entire text is selected (WordPress/gutenberg#80994) - Add opt-out for block style state controls (WordPress/gutenberg#80956) (WordPress/gutenberg#81004) - Tabs: Support Home and End keys for keyboard navigation (WordPress/gutenberg#80912) - Rename blockStatesEnabled setting to blockStatesEditingEnabled (WordPress/gutenberg#81058) - [WP 7.1] Background: Fix the legacy gradient UI where a gradient cannot be selected (WordPress/gutenberg#81059) - Views: honor developer-defined view config overrides (WordPress/gutenberg#80832) - Playlist: Add track icon (WordPress/gutenberg#81078) - Remove the CODEOWNERS file from wp/7.1. (WordPress/gutenberg#81104) - Notes: Email users mentioned in a note (WordPress/gutenberg#79606) - Backport 81068 80744 80642 (WordPress/gutenberg#81135) - Site Editor: Add E2E coverage for view config extensibility (WordPress/gutenberg#80577) - change from WordPress/gutenberg#81068 (WordPress/gutenberg#81140) - Link Control: Restore the preview title underline (WordPress/gutenberg#81083) - Button: Suppress UA focus ring when focused and pressed (WordPress/gutenberg#81113) - View config: add reference docs (WordPress/gutenberg#81149) - Editor: Fix document tools button focus ring (WordPress/gutenberg#81115) - Interface: Increase footer breadcrumb height to prevent focus ring clipping (WordPress/gutenberg#81156) - Post editor: Add ThemeProvider for admin color schemes (WordPress/gutenberg#81112) - Pass Playlist controls to track blocks (WordPress/gutenberg#81158) - Theme: Omit color properties when neither provided nor inherited (WordPress/gutenberg#80600) (WordPress/gutenberg#81172) - Media: Improve the HEIC upload error and keep any upload errors up until dismissed (WordPress/gutenberg#81130) - Video: Hide settings for the GIF variation (WordPress/gutenberg#81142) - Video: clarify the Video variation description (WordPress/gutenberg#81181) - Button: turn on the width setting by default in theme.json (WordPress/gutenberg#81196) - Edit Widgets: Fix header toolbar button focus ring (WordPress/gutenberg#81176) - Build: Wrap script bundles in an IIFE to contain 'use strict' (WordPress/gutenberg#79792) - Customizer widgets: Add ThemeProvider for admin color schemes (WordPress/gutenberg#81174) - Fix: Tabs block: Start with empty tab labels with placeholders (WordPress/gutenberg#81197) - PanelColorSettings: Restore the missing space below the panel header (WordPress/gutenberg#81155) - Visual revisions: add shareable urls (WordPress/gutenberg#81205) - Notes: fix the mention notification email composition (WordPress/gutenberg#81187) - Fix ESLint warnings for 'navigateRegionsProps' spread (WordPress/gutenberg#81208) - Widgets editor: Add ThemeProvider for admin color schemes (WordPress/gutenberg#81173) - Remove the editableRoot opt-in from the paragraph block (WordPress/gutenberg#81184) - Media Attached to: Fix issue with the popover unexpectedly flipping, tweak wording (WordPress/gutenberg#81206) - Ensure device preview is always accurate when window is zoomed in (WordPress/gutenberg#81215) Props wildworks. See #65529. git-svn-id: https://develop.svn.wordpress.org/trunk@63026 602fd350-edb4-49c9-b593-d223f7449a82
This resolves a WPCS warning:
{{{
Equals sign not aligned with surrounding assignments
}}}
Follow-up to [62590], [62838].
Props Soean.
See #64897.
git-svn-id: https://develop.svn.wordpress.org/trunk@63027 602fd350-edb4-49c9-b593-d223f7449a82
This adds coverage for the personal data exports directory URL, verifying both the default location under the uploads directory and that the filter of the same name can override it. Developed in: WordPress#5551 Follow-up to [63025]. Props desrosj, masteradhoc, mindctrl, pbearne, wildworks. Fixes #59709. git-svn-id: https://develop.svn.wordpress.org/trunk@63028 602fd350-edb4-49c9-b593-d223f7449a82
Two positioning issues: on desktop, the active spinner appeared off screen, generating a scrollbar in the media toolbar. In the attachment details modal, the spinner overlapped with the `Saved` confirmation. On desktop, limit some positioning assignments to only apply with the media modal. In the attachment details, apply `display: flex` to prevent overlapping. Developed in WordPress#12797 Props afercia, rcorrales, joedolson. Fixes #65778. git-svn-id: https://develop.svn.wordpress.org/trunk@63029 602fd350-edb4-49c9-b593-d223f7449a82
Follow-up to [6873], [10888], [31059]. Props khokansardar, jorbin, audrasjb, rcorrales, SergeyBiryukov. See #64899. git-svn-id: https://develop.svn.wordpress.org/trunk@63030 602fd350-edb4-49c9-b593-d223f7449a82
This adds the icon files removed during the 7.1 release to the `$_old_files` list. Follow up to [62738], [62739]. Props courane01, wiildworks. Fixes #65489. See #65813. git-svn-id: https://develop.svn.wordpress.org/trunk@63031 602fd350-edb4-49c9-b593-d223f7449a82
The `wp-includes/js/dist/sync.js` and `wp-includes/js/dist/sync.min.js` files were removed in 7.0.2 and added to the `$_old_files` list (see [62778]), but they are present again in `trunk`. [62783] marked these files as reintroduced, but this comment should be moved above the file list added for 7.1. Follow up to [62777], [62783], [63031]. See #65813, #65325. git-svn-id: https://develop.svn.wordpress.org/trunk@63032 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/trunk@63033 602fd350-edb4-49c9-b593-d223f7449a82
git-svn-id: https://develop.svn.wordpress.org/trunk@63034 602fd350-edb4-49c9-b593-d223f7449a82
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
18 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Trac ticket:
Use of AI Tools
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.