Update to WordPress 5.4.1. For more information, see https://wordpres…

…s.org/news/2020/04/wordpress-5-4-1/

wp-admin/about.php

@@ -40,6 +40,39 @@
 			</nav>
 		</div>
 
+		<div class="about__section changelog">
+			<div class="column">
+				<h2><?php _e( 'Maintenance and Security Releases' ); ?></h2>
+				<p>
+					<?php
+					printf(
+						/* translators: 1: WordPress version number, 2: plural number of bugs. More than one security issue. */
+						_n(
+							'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bug.',
+							'<strong>Version %1$s</strong> addressed some security issues and fixed %2$s bugs.',
+							11
+						),
+						'5.4.1',
+						number_format_i18n( 11 )
+					);
+					?>
+					<?php
+					printf(
+						/* translators: %s: HelpHub URL */
+						__( 'For more information, see <a href="%s">the release notes</a>.' ),
+						sprintf(
+							/* translators: %s: WordPress version */
+							esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+							sanitize_title( '5.4.1' )
+						)
+					);
+					?>
+				</p>
+			</div>
+		</div>
+
+		<hr />
+
 		<div class="about__section is-feature has-accent-background-color">
 			<h1><?php _e( 'Say hello to more and better.' ); ?></h1>
 

wp-admin/css/about-rtl.css

@@ -318,7 +318,8 @@
 	line-height: 1.4;
 }
 
-.about__container h3 {
+.about__container h3,
+.about__container h2.is-smaller-heading {
 	margin-top: 0;
 	font-size: 1em;
 }

wp-admin/css/about.css

@@ -317,7 +317,8 @@
 	line-height: 1.4;
 }
 
-.about__container h3 {
+.about__container h3,
+.about__container h2.is-smaller-heading {
 	margin-top: 0;
 	font-size: 1em;
 }

wp-admin/css/edit-rtl.css

@@ -449,7 +449,7 @@ form#tags-filter {
 #post-body #visibility:before,
 .curtime #timestamp:before,
 #post-body .misc-pub-revisions:before,
-#post-body .misc-pub-response-to:before, 
+#post-body .misc-pub-response-to:before,
 #post-body .misc-pub-comment-status:before {
 	color: #82878c;
 }
@@ -458,7 +458,7 @@ form#tags-filter {
 #post-body #visibility:before,
 .curtime #timestamp:before,
 #post-body .misc-pub-revisions:before,
-#post-body .misc-pub-response-to:before, 
+#post-body .misc-pub-response-to:before,
 #post-body .misc-pub-comment-status:before {
 	font: normal 20px/1 dashicons;
 	speak: none;
@@ -470,7 +470,7 @@ form#tags-filter {
 	-moz-osx-font-smoothing: grayscale;
 }
 
-#post-body .misc-pub-post-status:before, 
+#post-body .misc-pub-post-status:before,
 #post-body .misc-pub-comment-status:before {
 	content: "\f173";
 }
@@ -757,21 +757,32 @@ form#tags-filter {
 	margin-bottom: 1em;
 }
 
-.policy-text p:not(.privacy-policy-tutorial):not(.wp-policy-help) {
+.policy-text > *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help),
+.policy-text div > *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help) {
 	background-color: #fff;
 	margin: 0;
 	padding: 1em;
 }
 
-.policy-text p:not(.privacy-policy-tutorial):not(.wp-policy-help) + p:not(.privacy-policy-tutorial):not(.wp-policy-help) {
+.policy-text > *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help) + *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help),
+.policy-text div > *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help) + *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help) {
 	padding-top: 0;
 }
 
-.hide-privacy-policy-tutorial p:not(.privacy-policy-tutorial):not(.wp-policy-help) {
+.hide-privacy-policy-tutorial > *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help) {
 	margin: 1em 0;
 	padding: 0;
 }
 
+.policy-text ul li,
+.policy-text ol li {
+	margin-right: 2em;
+}
+
+.policy-text ul {
+	list-style: disc;
+}
+
 strong.wp-policy-help, /* For back-compat, see #49282 */
 strong.privacy-policy-tutorial {
 	display: block;

wp-admin/css/edit.css

@@ -448,7 +448,7 @@ form#tags-filter {
 #post-body #visibility:before,
 .curtime #timestamp:before,
 #post-body .misc-pub-revisions:before,
-#post-body .misc-pub-response-to:before, 
+#post-body .misc-pub-response-to:before,
 #post-body .misc-pub-comment-status:before {
 	color: #82878c;
 }
@@ -457,7 +457,7 @@ form#tags-filter {
 #post-body #visibility:before,
 .curtime #timestamp:before,
 #post-body .misc-pub-revisions:before,
-#post-body .misc-pub-response-to:before, 
+#post-body .misc-pub-response-to:before,
 #post-body .misc-pub-comment-status:before {
 	font: normal 20px/1 dashicons;
 	speak: none;
@@ -469,7 +469,7 @@ form#tags-filter {
 	-moz-osx-font-smoothing: grayscale;
 }
 
-#post-body .misc-pub-post-status:before, 
+#post-body .misc-pub-post-status:before,
 #post-body .misc-pub-comment-status:before {
 	content: "\f173";
 }
@@ -756,21 +756,32 @@ form#tags-filter {
 	margin-bottom: 1em;
 }
 
-.policy-text p:not(.privacy-policy-tutorial):not(.wp-policy-help) {
+.policy-text > *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help),
+.policy-text div > *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help) {
 	background-color: #fff;
 	margin: 0;
 	padding: 1em;
 }
 
-.policy-text p:not(.privacy-policy-tutorial):not(.wp-policy-help) + p:not(.privacy-policy-tutorial):not(.wp-policy-help) {
+.policy-text > *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help) + *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help),
+.policy-text div > *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help) + *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help) {
 	padding-top: 0;
 }
 
-.hide-privacy-policy-tutorial p:not(.privacy-policy-tutorial):not(.wp-policy-help) {
+.hide-privacy-policy-tutorial > *:not(h1):not(h2):not(h3):not(h4):not(h5):not(h6):not(div):not(.privacy-policy-tutorial):not(.wp-policy-help) {
 	margin: 1em 0;
 	padding: 0;
 }
 
+.policy-text ul li,
+.policy-text ol li {
+	margin-left: 2em;
+}
+
+.policy-text ul {
+	list-style: disc;
+}
+
 strong.wp-policy-help, /* For back-compat, see #49282 */
 strong.privacy-policy-tutorial {
 	display: block;

wp-admin/freedoms.php

@@ -64,22 +64,22 @@
 	<div class="about__section has-4-columns">
 		<div class="column">
 			<div class="freedoms-image"></div>
-			<h3><?php _e( 'The 1st Freedom' ); ?></h3>
+			<h2 class="is-smaller-heading"><?php _e( 'The 1st Freedom' ); ?></h2>
 			<p><?php _e( 'To run the program for any purpose.' ); ?></p>
 		</div>
 		<div class="column">
 			<div class="freedoms-image"></div>
-			<h3><?php _e( 'The 2nd Freedom' ); ?></h3>
+			<h2 class="is-smaller-heading"><?php _e( 'The 2nd Freedom' ); ?></h2>
 			<p><?php _e( 'To study how the program works and change it to make it do what you wish.' ); ?></p>
 		</div>
 		<div class="column">
 			<div class="freedoms-image"></div>
-			<h3><?php _e( 'The 3rd Freedom' ); ?></h3>
+			<h2 class="is-smaller-heading"><?php _e( 'The 3rd Freedom' ); ?></h2>
 			<p><?php _e( 'To redistribute.' ); ?></p>
 		</div>
 		<div class="column">
 			<div class="freedoms-image"></div>
-			<h3><?php _e( 'The 4th Freedom' ); ?></h3>
+			<h2 class="is-smaller-heading"><?php _e( 'The 4th Freedom' ); ?></h2>
 			<p><?php _e( 'To distribute copies of your modified versions to others.' ); ?></p>
 		</div>
 	</div>

wp-admin/includes/deprecated.php

@@ -1563,19 +1563,4 @@ function __construct( $args ) {
  */
 function _wp_privacy_requests_screen_options() {
 	_deprecated_function( __FUNCTION__, '5.3.0' );
-}
-
-/**
- * Return the user request object for the specified request ID.
- *
- * @since 4.9.6
- * @deprecated 5.4.0 Use wp_get_user_request()
- * @see wp_get_user_request()
- *
- * @param int $request_id The ID of the user request.
- * @return WP_User_Request|false
- */
-function wp_get_user_request_data( $request_id ) {
-	_deprecated_function( __FUNCTION__, '5.4.0', 'wp_get_user_request()' );
-	return wp_get_user_request( $request_id );
 }

wp-includes/blocks/rss.php

@@ -92,7 +92,7 @@ function render_block_core_rss( $attributes ) {
 		$class .= ' ' . $attributes['className'];
 	}
 
-	return "<ul class='{$class}'>{$list_items}</ul>";
+	return sprintf( "<ul class='%s'>%s</ul>", esc_attr( $class ), $list_items );
 }
 
 /**

wp-includes/blocks/search.php

@@ -57,7 +57,7 @@ function render_block_core_search( $attributes ) {
 
 	return sprintf(
 		'<form class="%s" role="search" method="get" action="%s">%s</form>',
-		$class,
+		esc_attr( $class ),
 		esc_url( home_url( '/' ) ),
 		$label_markup . $input_markup . $button_markup
 	);

wp-includes/class-wp-customize-manager.php

@@ -2923,22 +2923,11 @@ function save_changeset_post( $args = array() ) {
 		add_filter( 'wp_save_post_revision_post_has_changed', array( $this, '_filter_revision_post_has_changed' ), 5, 3 );
 
 		/*
-		 * Update the changeset post. The publish_customize_changeset action
-		 * will cause the settings in the changeset to be saved via
-		 * WP_Customize_Setting::save().
+		 * Update the changeset post. The publish_customize_changeset action will cause the settings in the
+		 * changeset to be saved via WP_Customize_Setting::save(). Updating a post with publish status will
+		 * trigger WP_Customize_Manager::publish_changeset_values().
 		 */
-
-		// Prevent content filters from corrupting JSON in post_content.
-		$has_kses = ( false !== has_filter( 'content_save_pre', 'wp_filter_post_kses' ) );
-		if ( $has_kses ) {
-			kses_remove_filters();
-		}
-		$has_targeted_link_rel_filters = ( false !== has_filter( 'content_save_pre', 'wp_targeted_link_rel' ) );
-		if ( $has_targeted_link_rel_filters ) {
-			wp_remove_targeted_link_rel_filters();
-		}
-
-		// Note that updating a post with publish status will trigger WP_Customize_Manager::publish_changeset_values().
+		add_filter( 'wp_insert_post_data', array( $this, 'preserve_insert_changeset_post_content' ), 5, 3 );
 		if ( $changeset_post_id ) {
 			if ( $args['autosave'] && 'auto-draft' !== get_post_status( $changeset_post_id ) ) {
 				// See _wp_translate_postdata() for why this is required as it will use the edit_post meta capability.
@@ -2969,14 +2958,7 @@ function save_changeset_post( $args = array() ) {
 				$this->_changeset_post_id = $r; // Update cached post ID for the loaded changeset.
 			}
 		}
-
-		// Restore removed content filters.
-		if ( $has_kses ) {
-			kses_init_filters();
-		}
-		if ( $has_targeted_link_rel_filters ) {
-			wp_init_targeted_link_rel_filters();
-		}
+		remove_filter( 'wp_insert_post_data', array( $this, 'preserve_insert_changeset_post_content' ), 5 );
 
 		$this->_changeset_data = null; // Reset so WP_Customize_Manager::changeset_data() will re-populate with updated contents.
 
@@ -2994,6 +2976,51 @@ function save_changeset_post( $args = array() ) {
 		return $response;
 	}
 
+	/**
+	 * Preserve the initial JSON post_content passed to save into the post.
+	 *
+	 * This is needed to prevent KSES and other {@see 'content_save_pre'} filters
+	 * from corrupting JSON data.
+	 *
+	 * Note that WP_Customize_Manager::validate_setting_values() have already
+	 * run on the setting values being serialized as JSON into the post content
+	 * so it is pre-sanitized.
+	 *
+	 * Also, the sanitization logic is re-run through the respective
+	 * WP_Customize_Setting::sanitize() method when being read out of the
+	 * changeset, via WP_Customize_Manager::post_value(), and this sanitized
+	 * value will also be sent into WP_Customize_Setting::update() for
+	 * persisting to the DB.
+	 *
+	 * Multiple users can collaborate on a single changeset, where one user may
+	 * have the unfiltered_html capability but another may not. A user with
+	 * unfiltered_html may add a script tag to some field which needs to be kept
+	 * intact even when another user updates the changeset to modify another field
+	 * when they do not have unfiltered_html.
+	 *
+	 * @since 5.4.1
+	 *
+	 * @param array $data                An array of slashed and processed post data.
+	 * @param array $postarr             An array of sanitized (and slashed) but otherwise unmodified post data.
+	 * @param array $unsanitized_postarr An array of slashed yet *unsanitized* and unprocessed post data as originally passed to wp_insert_post().
+	 * @return array Filtered post data.
+	 */
+	public function preserve_insert_changeset_post_content( $data, $postarr, $unsanitized_postarr ) {
+		if (
+			isset( $data['post_type'] ) &&
+			isset( $unsanitized_postarr['post_content'] ) &&
+			'customize_changeset' === $data['post_type'] ||
+			(
+				'revision' === $data['post_type'] &&
+				! empty( $data['post_parent'] ) &&
+				'customize_changeset' === get_post_type( $data['post_parent'] )
+			)
+		) {
+			$data['post_content'] = $unsanitized_postarr['post_content'];
+		}
+		return $data;
+	}
+
 	/**
 	 * Trash or delete a changeset post.
 	 *

wp-includes/class-wp-object-cache.php

@@ -441,7 +441,7 @@ public function stats() {
 		echo '</p>';
 		echo '<ul>';
 		foreach ( $this->cache as $group => $cache ) {
-			echo "<li><strong>Group:</strong> $group - ( " . number_format( strlen( serialize( $cache ) ) / KB_IN_BYTES, 2 ) . 'k )</li>';
+			echo '<li><strong>Group:</strong> ' . esc_html( $group ) . ' - ( ' . number_format( strlen( serialize( $cache ) ) / KB_IN_BYTES, 2 ) . 'k )</li>';
 		}
 		echo '</ul>';
 	}

wp-includes/class-wp-query.php

@@ -811,10 +811,6 @@ public function parse_query( $query = '' ) {
 			$this->is_single = true;
 		} elseif ( $qv['p'] ) {
 			$this->is_single = true;
-		} elseif ( ( '' !== $qv['hour'] ) && ( '' !== $qv['minute'] ) && ( '' !== $qv['second'] ) && ( '' != $qv['year'] ) && ( '' != $qv['monthnum'] ) && ( '' != $qv['day'] ) ) {
-			// If year, month, day, hour, minute, and second are set,
-			// a single post is being queried.
-			$this->is_single = true;
 		} elseif ( '' != $qv['pagename'] || ! empty( $qv['page_id'] ) ) {
 			$this->is_page   = true;
 			$this->is_single = false;

wp-includes/css/dist/block-directory/style-rtl.css

@@ -10,6 +10,10 @@
 /**
  * Often re-used variables
  */
+/**
+ * Grid System.
+ * https://make.wordpress.org/design/2019/10/31/proposal-a-consistent-spacing-system-for-wordpress/
+ */
 /**
  * Breakpoint mixins
  */

wp-includes/css/dist/block-directory/style.css

@@ -10,6 +10,10 @@
 /**
  * Often re-used variables
  */
+/**
+ * Grid System.
+ * https://make.wordpress.org/design/2019/10/31/proposal-a-consistent-spacing-system-for-wordpress/
+ */
 /**
  * Breakpoint mixins
  */

wp-includes/css/dist/block-editor/style-rtl.css

@@ -10,6 +10,10 @@
 /**
  * Often re-used variables
  */
+/**
+ * Grid System.
+ * https://make.wordpress.org/design/2019/10/31/proposal-a-consistent-spacing-system-for-wordpress/
+ */
 /**
  * Breakpoint mixins
  */