Update to WordPress 6.2.1. For more information, see https://wordpres…

…s.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/
pantheon-systems · May 16, 2023 · 0cd8ba5 · 0cd8ba5
1 parent 383e1ec
commit 0cd8ba5
Show file tree

Hide file tree

Showing 40 changed files with 937 additions and 954 deletions.
diff --git a/wp-admin/about.php b/wp-admin/about.php
@@ -42,9 +42,40 @@
 			<a href="privacy.php" class="nav-tab"><?php _e( 'Privacy' ); ?></a>
 		</nav>
 
+		<div class="about__section changelog">
+			<div class="column">
+				<h2><?php _e( 'Maintenance and Security Releases' ); ?></h2>
+				<p>
+					<?php
+					printf(
+						/* translators: 1: WordPress version number, 2: Plural number of bugs. More than one security issue. */
+						_n(
+							'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
+							'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.',
+							30
+						),
+						'6.2.1',
+						'30'
+					);
+					?>
+					<?php
+					printf(
+						/* translators: %s: HelpHub URL. */
+						__( 'For more information, see <a href="%s">the release notes</a>.' ),
+						sprintf(
+							/* translators: %s: WordPress version. */
+							esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+							sanitize_title( '6.2.1' )
+						)
+					);
+					?>
+				</p>
+			</div>
+		</div>
+
 		<div class="about__section">
 			<div class="column">
-				<h2 class="aligncenter">
+				<h2>
 					<?php
 					printf(
 						/* translators: %s: Version number. */
@@ -53,7 +84,7 @@
 					);
 					?>
 				</h2>
-				<p class="is-subheading aligncenter">
+				<p class="is-subheading">
 					<?php
 					printf(
 						/* translators: 1: Count of enhancements, 2: Count of bug fixes. */

diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php
@@ -2771,6 +2771,10 @@ function wp_ajax_set_attachment_thumbnail() {
 		wp_send_json_error();
 	}
 
+	if ( false === check_ajax_referer( 'set-attachment-thumbnail', '_ajax_nonce', false ) ) {
+		wp_send_json_error();
+	}
+
 	$post_ids = array();
 	// For each URL, try to find its corresponding post ID.
 	foreach ( $_POST['urls'] as $url ) {

diff --git a/wp-admin/includes/class-wp-importer.php b/wp-admin/includes/class-wp-importer.php
@@ -10,7 +10,7 @@ class WP_Importer {
 	public function __construct() {}
 
 	/**
-	 * Returns array with imported permalinks from WordPress database
+	 * Returns array with imported permalinks from WordPress database.
 	 *
 	 * @global wpdb $wpdb WordPress database abstraction object.
 	 *
@@ -47,7 +47,7 @@ public function get_imported_posts( $importer_name, $blog_id ) {
 	}
 
 	/**
-	 * Return count of imported permalinks from WordPress database
+	 * Returns count of imported permalinks from WordPress database.
 	 *
 	 * @global wpdb $wpdb WordPress database abstraction object.
 	 *
@@ -74,7 +74,7 @@ public function count_imported_posts( $importer_name, $blog_id ) {
 	}
 
 	/**
-	 * Set array with imported comments from WordPress database
+	 * Sets array with imported comments from WordPress database.
 	 *
 	 * @global wpdb $wpdb WordPress database abstraction object.
 	 *
@@ -176,7 +176,7 @@ public function set_user( $user_id ) {
 	}
 
 	/**
-	 * Sort by strlen, longest string first
+	 * Sorts by strlen, longest string first.
 	 *
 	 * @param string $a
 	 * @param string $b
@@ -214,7 +214,7 @@ public function get_page( $url, $username = '', $password = '', $head = false )
 	}
 
 	/**
-	 * Bump up the request timeout for http requests
+	 * Bumps up the request timeout for http requests.
 	 *
 	 * @param int $val
 	 * @return int
@@ -224,7 +224,7 @@ public function bump_request_timeout( $val ) {
 	}
 
 	/**
-	 * Check if user has exceeded disk quota
+	 * Checks if user has exceeded disk quota.
 	 *
 	 * @return bool
 	 */
@@ -239,7 +239,7 @@ public function is_user_over_quota() {
 	}
 
 	/**
-	 * Replace newlines, tabs, and multiple spaces with a single space.
+	 * Replaces newlines, tabs, and multiple spaces with a single space.
 	 *
 	 * @param string $text
 	 * @return string

diff --git a/wp-admin/nav-menus.php b/wp-admin/nav-menus.php
@@ -28,6 +28,9 @@
 	);
 }
 
+// Used in the HTML title tag.
+$title = __( 'Menus' );
+
 wp_enqueue_script( 'nav-menu' );
 
 if ( wp_is_mobile() ) {

diff --git a/wp-admin/network/themes.php b/wp-admin/network/themes.php
@@ -375,7 +375,7 @@
 		/* translators: %s: Number of themes. */
 		$message = _n( '%s theme enabled.', '%s themes enabled.', $enabled );
 	}
-	echo '<div id="message" class="notice notice-updated is-dismissible"><p>' . sprintf( $message, number_format_i18n( $enabled ) ) . '</p></div>';
+	echo '<div id="message" class="notice notice-success is-dismissible"><p>' . sprintf( $message, number_format_i18n( $enabled ) ) . '</p></div>';
 } elseif ( isset( $_GET['disabled'] ) ) {
 	$disabled = absint( $_GET['disabled'] );
 	if ( 1 === $disabled ) {
@@ -384,7 +384,7 @@
 		/* translators: %s: Number of themes. */
 		$message = _n( '%s theme disabled.', '%s themes disabled.', $disabled );
 	}
-	echo '<div id="message" class="notice notice-updated is-dismissible"><p>' . sprintf( $message, number_format_i18n( $disabled ) ) . '</p></div>';
+	echo '<div id="message" class="notice notice-success is-dismissible"><p>' . sprintf( $message, number_format_i18n( $disabled ) ) . '</p></div>';
 } elseif ( isset( $_GET['deleted'] ) ) {
 	$deleted = absint( $_GET['deleted'] );
 	if ( 1 === $deleted ) {

diff --git a/wp-admin/user-edit.php b/wp-admin/user-edit.php
@@ -349,7 +349,7 @@
 					</tr>
 
 					<?php
-					$languages = get_available_languages();
+					$languages                = get_available_languages();
 					$can_install_translations = current_user_can( 'install_languages' ) && wp_can_install_language_pack();
 					?>
 					<?php if ( $languages || $can_install_translations ) : ?>
@@ -370,12 +370,12 @@
 
 							wp_dropdown_languages(
 								array(
-									'name'                        => 'locale',
-									'id'                          => 'locale',
-									'selected'                    => $user_locale,
-									'languages'                   => $languages,
+									'name'      => 'locale',
+									'id'        => 'locale',
+									'selected'  => $user_locale,
+									'languages' => $languages,
 									'show_available_translations' => $can_install_translations,
-									'show_option_site_default'    => true,
+									'show_option_site_default' => true,
 								)
 							);
 							?>

diff --git a/wp-content/mu-plugins/pantheon-mu-plugin/inc/pantheon-multisite-finalize.php b/wp-content/mu-plugins/pantheon-mu-plugin/inc/pantheon-multisite-finalize.php
@@ -1,16 +1,37 @@
 <?php
-/*
+/**
  * If a site has multisite enabled, but has not had the final installation
  * steps completed, alert the user and provide links.
+ *
+ * @package pantheon
  */
 
-function pantheon_multisite_install_finalize_message() {
-	?>
+/**
+ * Detects if a user is using the correct upstream and framework and give them appropriate next steps to finalize WPMS setup.
+ *
+ * @return void
+ */
+function pantheon_multisite_install_finalize_message() { ?>
 	<div class="notice notice-info is-dismissible">
-		<p><?php esc_html_e( 'Your WordPress Multisite is almost ready!', 'pantheon' ); ?></p>
-		<p><?php echo sprintf( __( 'Visit <a href="%s">Pantheon Multisite Configuration</a> for documentation on how to finalize configuration of your site network.', 'pantheon' ), 'https://pantheon.io/docs/guides/multisite/config/#install-the-wordpress-site-network' ); ?></p>
+		<?php
+		if ( isset( $_ENV['PANTHEON_ENVIRONMENT'] ) ) {
+			if ( getenv( 'FRAMEWORK' ) === 'wordpress_network' ) {
+				?>
+					<p><?php esc_html_e( 'Your WordPress Multisite is almost ready!', 'pantheon' ); ?></p>
+					<p><?php echo sprintf( __( 'Visit <a href="%s">Pantheon Multisite Configuration</a> for documentation on how to finalize configuration of your site network.', 'pantheon' ), 'https://pantheon.io/docs/guides/multisite/config/#install-the-wordpress-site-network' ); ?></p>
+				<?php
+			} else {
+				?>
+					<p><?php esc_html_e( 'You are trying to configure a WordPress Multisite with a wrong upstream!', 'pantheon' ); ?></p>
+					<p><?php echo sprintf( __( 'Make sure that you have the correct upstream configuration for WPMS. If you do not have that capability or check if you are eligible, please <a href="%s">Contact Support</a>.', 'pantheon' ), 'https://pantheon.io/support' ); ?></p>
+				<?php
+			}
+		}
+		?>
 	</div>
+
+
 	<?php
 }
 
-add_action('admin_notices', 'pantheon_multisite_install_finalize_message');
+add_action( 'admin_notices', 'pantheon_multisite_install_finalize_message' );
diff --git a/wp-content/mu-plugins/pantheon-mu-plugin/pantheon.php b/wp-content/mu-plugins/pantheon-mu-plugin/pantheon.php
@@ -25,9 +25,6 @@
     if ( defined( 'WP_CLI' ) && WP_CLI ) {
         require_once 'inc/cli.php';
     }
-	if ( defined( 'MULTISITE' ) && defined( 'WP_ALLOW_MULTISITE' ) && WP_ALLOW_MULTISITE ) {
-		require_once 'inc/pantheon-network-setup.php';
-	}
 	if ( ! defined( 'FS_METHOD' ) ) {
 		/**
 		 * When this constant is not set, WordPress writes and then deletes a
@@ -45,6 +42,9 @@
     if ( getenv( 'FRAMEWORK' ) === 'wordpress_network' && ! defined( 'WP_ALLOW_MULTISITE' ) ) {
         define( 'WP_ALLOW_MULTISITE', true );
     }
+    if ( defined( 'MULTISITE' ) && defined( 'WP_ALLOW_MULTISITE' ) && WP_ALLOW_MULTISITE ) {
+	require_once 'inc/pantheon-network-setup.php';
+    }
     if ( defined( 'WP_ALLOW_MULTISITE' ) && ( ! defined( 'MULTISITE' ) || empty( MULTISITE ) ) ) {
         require_once 'inc/pantheon-multisite-finalize.php';
     }

diff --git a/wp-includes/assets/script-loader-packages.min.php b/wp-includes/assets/script-loader-packages.min.php
diff --git a/wp-includes/assets/script-loader-packages.php b/wp-includes/assets/script-loader-packages.php
diff --git a/wp-includes/block-template-utils.php b/wp-includes/block-template-utils.php
@@ -1338,9 +1338,9 @@ function get_template_hierarchy( $slug, $is_custom = false, $template_prefix = '
 		if ( $slug !== $type ) {
 			$template_hierarchy[] = $type;
 		}
-	} else if ( preg_match( '/^(author|category|archive|tag|page)-.+$/', $slug, $matches ) ) {
+	} elseif ( preg_match( '/^(author|category|archive|tag|page)-.+$/', $slug, $matches ) ) {
 		$template_hierarchy[] = $matches[1];
-	} else if ( preg_match( '/^(taxonomy|single)-(.+)$/', $slug, $matches ) ) {
+	} elseif ( preg_match( '/^(taxonomy|single)-(.+)$/', $slug, $matches ) ) {
 		$type           = $matches[1];
 		$slug_remaining = $matches[2];
 

diff --git a/wp-includes/block-template.php b/wp-includes/block-template.php
@@ -240,9 +240,7 @@ function get_the_block_template_html() {
 	$content = do_blocks( $content );
 	$content = wptexturize( $content );
 	$content = convert_smilies( $content );
-	$content = shortcode_unautop( $content );
 	$content = wp_filter_content_tags( $content, 'template' );
-	$content = do_shortcode( $content );
 	$content = str_replace( ']]>', ']]&gt;', $content );
 
 	// Wrap block template in .wp-site-blocks to allow for specific descendant styles

diff --git a/wp-includes/blocks.php b/wp-includes/blocks.php
@@ -260,7 +260,11 @@ function register_block_style_handle( $metadata, $field_name, $index = 0 ) {
 	if ( $has_style_file ) {
 		wp_style_add_data( $style_handle, 'path', $style_path_norm );
 
-		$rtl_file = str_replace( "{$suffix}.css", "-rtl{$suffix}.css", $style_path_norm );
+		if ( $is_core_block ) {
+			$rtl_file = str_replace( "{$suffix}.css", "-rtl{$suffix}.css", $style_path_norm );
+		} else {
+			$rtl_file = str_replace( '.css', '-rtl.css', $style_path_norm );
+		}
 
 		if ( is_rtl() && file_exists( $rtl_file ) ) {
 			wp_style_add_data( $style_handle, 'rtl', 'replace' );
@@ -794,6 +798,10 @@ function serialize_blocks( $blocks ) {
 function filter_block_content( $text, $allowed_html = 'post', $allowed_protocols = array() ) {
 	$result = '';
 
+	if ( false !== strpos( $text, '<!--' ) && false !== strpos( $text, '--->' ) ) {
+		$text = preg_replace_callback( '%<!--(.*?)--->%', '_filter_block_content_callback', $text );
+	}
+
 	$blocks = parse_blocks( $text );
 	foreach ( $blocks as $block ) {
 		$block   = filter_block_kses( $block, $allowed_html, $allowed_protocols );
@@ -803,6 +811,19 @@ function filter_block_content( $text, $allowed_html = 'post', $allowed_protocols
 	return $result;
 }
 
+/**
+ * Callback used for regular expression replacement in filter_block_content().
+ *
+ * @private
+ * @since 6.2.1
+ *
+ * @param array $matches Array of preg_replace_callback matches.
+ * @return string Replacement string.
+ */
+function _filter_block_content_callback( $matches ) {
+	return '<!--' . rtrim( $matches[1], '-' ) . '-->';
+}
+
 /**
  * Filters and sanitizes a parsed block to remove non-allowable HTML
  * from block attribute values.

diff --git a/wp-includes/blocks/comment-template.php b/wp-includes/blocks/comment-template.php
@@ -58,11 +58,10 @@ function block_core_comment_template_render_comments( $comments, $block ) {
 				$block_content .= sprintf( '<ol>%1$s</ol>', $inner_content );
 				--$comment_depth;
 			} else {
-				$inner_content  = block_core_comment_template_render_comments(
+				$block_content .= block_core_comment_template_render_comments(
 					$children,
 					$block
 				);
-				$block_content .= sprintf( $inner_content );
 			}
 		}
 

diff --git a/wp-includes/class-wp-query.php b/wp-includes/class-wp-query.php
@@ -752,7 +752,7 @@ public function fill_query_vars( $query_vars ) {
 	 *                                                    return posts containing 'pillow' but not 'sofa'. The
 	 *                                                    character used for exclusion can be modified using the
 	 *                                                    the 'wp_query_search_exclusion_prefix' filter.
-	 *     @type array           $search_columns          Array of column names to be searched. Accepts 'post_title',
+	 *     @type string[]        $search_columns          Array of column names to be searched. Accepts 'post_title',
 	 *                                                    'post_excerpt' and 'post_content'. Default empty array.
 	 *     @type int             $second                  Second of the minute. Default empty. Accepts numbers 0-59.
 	 *     @type bool            $sentence                Whether to search by phrase. Default false.

diff --git a/wp-includes/class-wp-theme-json.php b/wp-includes/class-wp-theme-json.php
@@ -66,15 +66,13 @@ class WP_Theme_JSON {
 	 *
 	 * They are a unkeyed array of values such as:
 	 *
-	 * ```php
-	 * array(
-	 *   array(
-	 *     'slug'      => 'unique-name-within-the-set',
-	 *     'name'      => 'Name for the UI',
-	 *     <value_key> => 'value'
-	 *   ),
-	 * )
-	 * ```
+	 *     array(
+	 *       array(
+	 *         'slug'      => 'unique-name-within-the-set',
+	 *         'name'      => 'Name for the UI',
+	 *         <value_key> => 'value'
+	 *       ),
+	 *     )
 	 *
 	 * This contains the necessary metadata to process them:
 	 *
@@ -2531,19 +2529,17 @@ public function get_root_layout_rules( $selector, $block_metadata ) {
 	/**
 	 * For metadata values that can either be booleans or paths to booleans, gets the value.
 	 *
-	 * ```php
-	 * $data = array(
-	 *   'color' => array(
-	 *     'defaultPalette' => true
-	 *   )
-	 * );
+	 *     $data = array(
+	 *       'color' => array(
+	 *         'defaultPalette' => true
+	 *       )
+	 *     );
 	 *
-	 * static::get_metadata_boolean( $data, false );
-	 * // => false
+	 *     static::get_metadata_boolean( $data, false );
+	 *     // => false
 	 *
-	 * static::get_metadata_boolean( $data, array( 'color', 'defaultPalette' ) );
-	 * // => true
-	 * ```
+	 *     static::get_metadata_boolean( $data, array( 'color', 'defaultPalette' ) );
+	 *     // => true
 	 *
 	 * @since 6.0.0
 	 *

diff --git a/wp-includes/comment-template.php b/wp-includes/comment-template.php
@@ -1109,7 +1109,7 @@ function get_comment_time( $format = '', $gmt = false, $translate = true, $comme
  *                                   Default current comment.
  */
 function comment_time( $format = '', $comment_id = 0 ) {
-	echo get_comment_time( $format, $comment_id );
+	echo get_comment_time( $format, false, true, $comment_id );
 }
 
 /**