Commit Graph

51305 Commits

Author SHA1 Message Date
dmsnell
a9661d650c Formatting: Rely on _wp_can_use_pcre_u() to detect UTF-8 PCRE support.
The `sanitize_file_name()` function attempts to detect UTF-8 PCRE support, but WordPress already provides a more robust method. It then caches its check in a static var, which WordPress already does in the canonical function `_wp_can_use_pcre_u()`.

This patch refactors `sanitize_file_name()` to call `_wp_can_use_pcre_u()` directly instead of (mostly) recreating and recaching Core’s detection algorithm.

Developed in https://github.com/WordPress/wordpress-develop/pull/9678
Discussed in https://core.trac.wordpress.org/ticket/63863

Follow-up to [60694].

Props dmsnell.
See #63863.

Built from https://develop.svn.wordpress.org/trunk@60695


git-svn-id: http://core.svn.wordpress.org/trunk@60031 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-31 06:05:30 +00:00
dmsnell
5fa2d232eb Compat: Replace warning-suppression in _wp_can_use_pcre_u()
This patch replaces the use of the problematic error-suppresssion operator with a specific error-handler to catch and report Unicode PCRE support without raising the related issues of error-suppression: notably conflating errors and failing to prevent completely the logging of the warnings.

In this case, the WPCS rule against using error-suppression was actually helpful in pointing out the risk, but the code was left in place with an “ignore” comment to silence the violation; this patch addresses the risk and removes the need for the comment.

Developed in https://github.com/WordPress/wordpress-develop/pull/9576
Discussed in https://core.trac.wordpress.org/ticket/63865

Follow-up to: [45611].

Props dmsnell.
Fixes #63865.

Built from https://develop.svn.wordpress.org/trunk@60694


git-svn-id: http://core.svn.wordpress.org/trunk@60030 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-30 20:53:31 +00:00
Sergey Biryukov
a1ff962773 Build/Test Tools: Check if PHPUnit classes exist before calling class_alias().
This resolves `Class not found` warnings when running the tests in PHPUnit 10 or later.

Follow-up to [40536], [51570].

Props danielmorell, devasheeshkaul, SergeyBiryukov.
Fixes #63833.
Built from https://develop.svn.wordpress.org/trunk@60693


git-svn-id: http://core.svn.wordpress.org/trunk@60029 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-30 14:01:29 +00:00
desrosj
3ba0c58c13 Build/Test Tools: Update third-party GitHub Actions.
This updates the following third-party actions to their latest versions:
`actions/checkout` from `4.2.2` to `5.0.0`
`shivammathur/setup-php` from `2.32.0` to `2.35.3`
`actions/setup-node` from `4.3.0` to `4.4.0`
`ramsey/composer-install` from `3.1.0` to `3.1.1`
`actions/cache` from `4.2.3` to `4.2.4`
`actions/download-artifact` from `4.2.1` to `5.0.0`
`codecov/codecov-action` from `5.4.0` to `5.4.3`
`slackapi/slack-github-action` from `2.0.0` to `2.1.1`

See #63170.
Built from https://develop.svn.wordpress.org/trunk@60692


git-svn-id: http://core.svn.wordpress.org/trunk@60028 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-30 00:13:29 +00:00
desrosj
4a58a4c6fd Security: Update composer/ca-bundle to version 1.5.8.
See #63165.
Built from https://develop.svn.wordpress.org/trunk@60691


git-svn-id: http://core.svn.wordpress.org/trunk@60027 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-29 23:59:30 +00:00
jonsurrell
2c4aab7e8c Script Loader: Revert sourceURL addition.
It was discovered that these changes cause some issues in the customizer when `SCRIPT_DEBUG` is `false`.

Reverts [60685] and [60686].

Developed in https://github.com/WordPress/wordpress-develop/pull/9671

Props jonsurrell, wildworks, tyxla.
See #63887.

Built from https://develop.svn.wordpress.org/trunk@60690


git-svn-id: http://core.svn.wordpress.org/trunk@60026 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-29 17:18:28 +00:00
Sergey Biryukov
7b891912c7 Tests: Correct @covers tags for term_exists() tests.
Includes moving the tag to the class DocBlock, as this test class covers a single function.

Follow-up to [52921], [60676].

See #63167.
Built from https://develop.svn.wordpress.org/trunk@60689


git-svn-id: http://core.svn.wordpress.org/trunk@60025 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-29 12:52:27 +00:00
Bernhard Reiter
c90da2b673 Block Hooks: Apply block hooks to plugin-registered templates.
As of WordPress 6.7.0, it is possible -- e.g. for plugins -- to register block templates via a new API, `register_block_template()`. Unlike block templates loaded from theme files or from the database, however, those block templates didn't have Block Hooks applied. This changeset rectifies this inconsistency.

Props iamadisingh, aljullu, bernhard-reiter.
Fixes #63808.
Built from https://develop.svn.wordpress.org/trunk@60688


git-svn-id: http://core.svn.wordpress.org/trunk@60024 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-28 19:10:33 +00:00
Sergey Biryukov
1de88be2d6 Docs: Improve grammar in some DocBlocks for more clarity and consistency.
Follow-up to [8215], [8598].

Props prab18hat, dhruvang21, swissspidy, SergeyBiryukov.
Fixes #63892.
Built from https://develop.svn.wordpress.org/trunk@60687


git-svn-id: http://core.svn.wordpress.org/trunk@60023 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-28 15:08:28 +00:00
jonsurrell
0213b11319 Script Loader: Remove "inline:" prefix from sourceURL.
The prefix may negatively impact some APIs such as the Long Animation Frames API.

Developed in https://github.com/WordPress/wordpress-develop/pull/9655.

Follow-up to [60685].

Props jonsurrell, swissspidy.
Fixes #63887.

Built from https://develop.svn.wordpress.org/trunk@60686


git-svn-id: http://core.svn.wordpress.org/trunk@60022 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-28 14:46:37 +00:00
jonsurrell
3b163e81c7 Script Loader: Add sourceURL to inline scripts and styles.
Improve the source locations referenced by developer tooling in supporting browsers. Inline source locations are named like `inline:handle-js-after` and appear in the developer tools "sources" panel.

Developed in https://github.com/WordPress/wordpress-develop/pull/9628.

Props jonsurrell, swissspidy, alshakero, westonruter.
Fixes #63887.

Built from https://develop.svn.wordpress.org/trunk@60685


git-svn-id: http://core.svn.wordpress.org/trunk@60021 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-28 07:56:30 +00:00
Bernhard Reiter
4f0cadf745 Block Bindings: Allow generically setting rich-text block attributes.
Replace the existing block-specific, hard-coded, logic in the `WP_Block` class with more generic code that is able to locate and replace a `rich-text` sourced attribute based on the `selector` definition in its `block.json`.

This should make it easier to add block bindings support for more block attributes.

Props bernhard-reiter, jonsurrell, gziolo, cbravobernal, dmsnell.
Fixes #63840.
Built from https://develop.svn.wordpress.org/trunk@60684


git-svn-id: http://core.svn.wordpress.org/trunk@60020 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-27 15:43:27 +00:00
Helen Hou-Sandí
3ffbc9770f Updates: Ensure theme screenshots are positioned correctly.
Underlying problem: the updates list tables inherit styles from classes named for plugins. This makes the intention much more explicit so we can actually maintain and make changes sanely going forward.

Fixes #63120.

Built from https://develop.svn.wordpress.org/trunk@60683


git-svn-id: http://core.svn.wordpress.org/trunk@60019 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-27 15:15:30 +00:00
Sergey Biryukov
1dc6a28e04 Docs: Correct the order of @since and @global tags in some files.
Follow-up to [9053], [13177], [16660], [32642], [37226], [54953], [59865], [60658].

Props viralsampat, shailu25, sandipsinh007.
Fixes #63879. See #63166.
Built from https://develop.svn.wordpress.org/trunk@60682


git-svn-id: http://core.svn.wordpress.org/trunk@60018 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-27 13:42:30 +00:00
jonsurrell
a8d180e55e Scripts: Use appropriate JSON encoding flags for script tags.
`wp_json_encode()` with default arguments is insufficient to safely escape JSON for script tags. Use `JSON_HEX_TAG | JSON_UNESCAPED_SLASHES` flags.

Developed in https://github.com/WordPress/wordpress-develop/pull/9557.

Props devasheeshkaul, jonsurrell, siliconforks.
Fixes #63851.

Built from https://develop.svn.wordpress.org/trunk@60681


git-svn-id: http://core.svn.wordpress.org/trunk@60017 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-27 10:34:28 +00:00
Helen Hou-Sandí
698f5c3589 Plugins: Ensure only plugin icons are floated.
There's no reason not to add a semantic class to the plugin icons on the update screen instead of making our CSS more complex, so let's do that and ensure that the existing `.plugin-icon` styles are scoped to `.plugin-card` on the install screen.

Partially reverts [60673].
Fixes #63120.


Built from https://develop.svn.wordpress.org/trunk@60680


git-svn-id: http://core.svn.wordpress.org/trunk@60016 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-27 00:03:30 +00:00
Jeremy Felt
f0331ea047 Users: Improve documentation for edit_user_profile and show_user_profile actions.
This clarifies when and in which context these actions fire.

Props akshat2802.
Fixes #62062.

Built from https://develop.svn.wordpress.org/trunk@60679


git-svn-id: http://core.svn.wordpress.org/trunk@60015 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 23:55:31 +00:00
TimothyBlynJacobs
6e4a64047e Media: Fix playlist shortcodes not rendering correctly if the first playlist is broken.
The playlist shortcode has a base set of JavaScript that should only be loaded once. Previously, this JS was only loaded the first time a playlist shortcode was processed. If the first playlist was broken, because the media file was missing for instance, this would break all other playlists on the page.

This commit introduces a new static variable to keep track of whether the necessary JavaScript has been loaded instead.

Props iamadisingh, abcd95, justlevine, jorbin, rollybueno, Guido07111975.
Fixes #63583.

Built from https://develop.svn.wordpress.org/trunk@60678


git-svn-id: http://core.svn.wordpress.org/trunk@60014 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 23:21:32 +00:00
whyisjake
16212b44f5 Tests: Move Hello Dolly test data to match new plugin directory structure.
Moves the Hello Dolly test plugin file from `tests/phpunit/data/plugins/hello.php` to  `tests/phpunit/data/plugins/hello-dolly/hello.php` to match the updated plugin structure in the main codebase.

Fixes failing tests in Tests_Admin_IncludesPlugin that expect the plugin to be located in a hello-dolly directory.

Props jorbin, davidb, afragen.


Built from https://develop.svn.wordpress.org/trunk@60677


git-svn-id: http://core.svn.wordpress.org/trunk@60013 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 23:00:29 +00:00
davidbaumwald
fedf2c68a1 Taxonomy: Ensure term_exists respects $parent_term when $term is an integer.
This change updates `term_exists` by ensuring that any numeric value passed as the `$parent_term` argument is passed to the subsequent `get_terms` call when the `$term` argument is an integer.  This change includes unit tests to validate the fix.

Props spacedmonkey, lopo, lgadzhev, hugod, thehercules, nickbrazilian, audrasjb, vijendrajat, sachinrajcp123, bobbyleenoblestudios.
Fixes #55358.

Built from https://develop.svn.wordpress.org/trunk@60676


git-svn-id: http://core.svn.wordpress.org/trunk@60012 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 22:24:27 +00:00
whyisjake
69d09a70f0 Build/Test Tools: Revert svn:ignore property changes from [60666].
The svn:ignore property reorganization introduced in [60666] needs to be reverted to restore the  previous ignore pattern structure.

Brought the changes that were in: https://core.trac.wordpress.org/browser/trunk?rev=60665

Reviewed  by desrosj, jorbin.


Built from https://develop.svn.wordpress.org/trunk@60675


git-svn-id: http://core.svn.wordpress.org/trunk@60011 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 22:20:36 +00:00
Aaron Jorbin
f0fb60d28b Build/Test Tools: Update in-repo PHPUnit documentation to point to a single source of truth.
Props q0rban, ironprogrammer, desrosj, peterwilsoncc, juampick.
Fixes #62065.

Built from https://develop.svn.wordpress.org/trunk@60674


git-svn-id: http://core.svn.wordpress.org/trunk@60010 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 21:54:29 +00:00
whyisjake
9bc78e7a7a Plugins: Fix emoji positioning in plugin titles on plugins list table.
Prevents emojis in plugin titles from floating to the front of text when
WordPress uses emoji fallback rendering. When emoji feature detection fails,
WordPress replaces emoji characters with `<img>` elements that were incorrectly
affected by CSS float rules intended for plugin icons.

Updates CSS selectors to target specific icon types (dashicons, icon classes,
and data URI images) rather than all images, ensuring emoji images remain
inline with plugin title text while preserving proper layout for actual
plugin icons.

- Consolidates `.plugins .plugin-title img` and `.plugins .plugin-title .dashicons` rules
- Adds support for `img.dashicons`, `img[class*="icon"]`, and `img[src*="data:image"]` selectors
- Maintains 64px sizing and left float for legitimate plugin icons
- Fixes visual issue where "myplugin❤️wordpress" displayed as "❤️mypluginwordpress"

Props slimndap, ankitkumarshah, sandeepdahiya, sabernhardt, tomdevisser,
debarghyabanerjee, nusrat21, SirLouen, wpfy, hmbashar, klevismiho,
rollybueno, jamesgiroux, jorbin, whyisjake.

Fixes #63120.

Built from https://develop.svn.wordpress.org/trunk@60673


git-svn-id: http://core.svn.wordpress.org/trunk@60009 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 21:35:26 +00:00
Aaron Jorbin
783dd4b4f4 General: Add polyfills for new PHP 8.5 array functions: array_first and array_last.
This power couple of function is coming in PHP 8.5: array_first and array_last.

For more information on these functions, check out the PHP RFC at https://wiki.php.net/rfc/array_first_last.

Props tusharbharti, jorbin, peterwilsoncc, mukesh27, johnbillion.
Fixes #63853. See #63061.


Built from https://develop.svn.wordpress.org/trunk@60672


git-svn-id: http://core.svn.wordpress.org/trunk@60008 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 21:31:28 +00:00
TimothyBlynJacobs
d58780fc7d Formatting: Add 'white-space' as an allowed KSES CSS attribute.
The 'white-space' attribute is safe, has wide browser support, and is useful.

Props sukhendu2002, mukesh27, whyisjake..
Fixes #51707.

Built from https://develop.svn.wordpress.org/trunk@60671


git-svn-id: http://core.svn.wordpress.org/trunk@60007 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 21:08:17 +00:00
whyisjake
72e3ea8ed9 Upgrade/Install: Actually move Hello Dolly plugin to directory structure.
This fixes an issue from [60666] where I neglected to `svn move` the files. 

Follow-up to [60666].

Reviewed by jeremyfelt.

Props swissspidy.

See #53323.



Built from https://develop.svn.wordpress.org/trunk@60670


git-svn-id: http://core.svn.wordpress.org/trunk@60006 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 21:06:56 +00:00
Adam Silverstein
c0bb2a41c3 Media: improve doc blocks for PNG handling in Imagick.
These changes were inadvertently omitted from [60667].

Props adamsilverstein.


Built from https://develop.svn.wordpress.org/trunk@60669


git-svn-id: http://core.svn.wordpress.org/trunk@60005 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 21:05:30 +00:00
TimothyBlynJacobs
cd6b5eb48f Customize: Update input_attrs docs for the textarea control.
Props sabenhardt.
See [60662].

Built from https://develop.svn.wordpress.org/trunk@60668


git-svn-id: http://core.svn.wordpress.org/trunk@60004 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 20:59:22 +00:00
Adam Silverstein
08ef43f295 Media: improve Imagick handling of indexed PNG images with transparency.
Fix an issue where certain transparent PNG images experienced noticeable quality degradation when resized by Imagick. 

Follow up to [60246].

Props elvismdev, SirLouen, siliconforks, nosilver4u, iamshashank.

Fixes #63448.


Built from https://develop.svn.wordpress.org/trunk@60667


git-svn-id: http://core.svn.wordpress.org/trunk@60003 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 20:57:34 +00:00
whyisjake
f8f84a4173 Upgrade/Install: Move Hello Dolly plugin to directory structure.
Changes the Hello Dolly plugin from a single file structure to a proper plugin directory structure, moving from `hello.php` to `hello-dolly/hello.php` to align with Plugin Handbook Best Practices.

- Adds proper `Text Domain: hello-dolly` header to Hello Dolly plugin
- Updates core files to remove special case handling for `hello.php`
- Updates plugin dependency system to handle new directory structure
- Adds upgrade routine to migrate active plugin references and keep plugin active
- Updates all tests to use new plugin path format `hello-dolly/hello.php`
- Updates build configuration and .gitignore for new directory structure
- Adds `hello.php` to old files list for cleanup during core updates
- Adds `plugins/hello-dolly/` to new bundled directories list

Props afragen, SergeyBiryukov, peterwilsoncc, SirLouen, matt, davidbaumwald, desrosj, hellofromtonya, justinahinon,audrasjb, oglekler, whyisjake.
Fixes #53323.


Built from https://develop.svn.wordpress.org/trunk@60666


git-svn-id: http://core.svn.wordpress.org/trunk@60002 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 18:41:31 +00:00
nerrad
6096e1d2e5 HTML API: Reliably parse HTML in get_url_in_content()
As part of a larger effort in #63694, this utlizes `WP_HTML_Tag_Processor` instead of regex to parse the string passed into `get_url_in_content`.

As a benefit this also decodes the URL whereas the previous code didn’t, so strings like `http&#x3A;//` will be properly decoded as `http://`.

Developed in: https://github.com/WordPress/wordpress-develop/pull/9272
Discussed in: https://core.trac.wordpress.org/ticket/63694

Props dmsnell, jonsurrell, nerrad.
Fixes #63694.
Built from https://develop.svn.wordpress.org/trunk@60665


git-svn-id: http://core.svn.wordpress.org/trunk@60001 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 18:22:32 +00:00
TimothyBlynJacobs
025eab7b5a Coding Standards: Fix spacing in Customize Control.
Props dmsnell.
See [60662].

Built from https://develop.svn.wordpress.org/trunk@60664


git-svn-id: http://core.svn.wordpress.org/trunk@60000 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 18:18:25 +00:00
Jeremy Felt
634bfa325c Coding Standards: Properly align variable assignment in WP_Block
Removes a new line added as part of [60611] which impacted alignment of variable assignments in `process_block_bindings()`.

See #63168.

Built from https://develop.svn.wordpress.org/trunk@60663


git-svn-id: http://core.svn.wordpress.org/trunk@59999 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 18:16:32 +00:00
TimothyBlynJacobs
8bd447bc3f Customize: Allow specifying the number of rows for <textarea> inputs.
Previously, the textarea control was forced to use 5 rows. This commit instead applies a default value of 5, but allows for a developer to specify a different number of rows using the input_attrs arg.

Props sirlouen, timhavinga, celloexpressions, sainathpoojary. 
Fixes #47445.

Built from https://develop.svn.wordpress.org/trunk@60662


git-svn-id: http://core.svn.wordpress.org/trunk@59998 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 17:49:29 +00:00
Sergey Biryukov
1448dc5aa8 Taxonomy: Check the result of get_term() in WP_Term_Query::get_terms().
`get_term()` can return `WP_Error` or `null` on failure, so the result should be verified as a `WP_Term` instance before accessing the `count` property.

This commit prevents a PHP warning if `get_term()` returns `null` for a child term:
{{{
Warning: Attempt to read property "count" on null
}}}

Follow-up to [27458], [37572].

Props josephscott, coleatkinson1, kebbet, jakariaistauk, sabernhardt, westonruter, SergeyBiryukov.
Fixes #63877.
Built from https://develop.svn.wordpress.org/trunk@60661


git-svn-id: http://core.svn.wordpress.org/trunk@59997 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 17:26:29 +00:00
John Blackbourn
ce1c229570 Build/Test Tools: Temporarily pin the PHP 8.3 and 8.4 container images to an earlier digest to work around issues with the newer images.
This pins the images to PHP 8.3.10 and 8.4.11 on Debian Bullseye pending further investigation into the root cause of the certificate verification failure affecting the connection to the database containers.

This also removes memcached from the test matrix pending further investigation into the missing Memcached executable.

Props desrosj, bernhard-reiter, SirLouen, johnbillion.

See #63876
Built from https://develop.svn.wordpress.org/trunk@60660


git-svn-id: http://core.svn.wordpress.org/trunk@59996 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-26 16:55:31 +00:00
Sergey Biryukov
26312ee9a9 Code Modernization: Replace non-canonical scalar type casts with canonical versions.
PHP 8.5 deprecates four alternative scalar type names in favor of their canonical names:

* `boolean` → `bool`
* `double` → `float`
* `integer` → `int`
* `binary` → `string`

References:
* [https://php.watch/versions/8.5/boolean-double-integer-binary-casts-deprecated PHP.Watch: PHP 8.5: Non-canonical scalar type casts (boolean|double|integer|binary) deprecated]
* [https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_non-standard_cast_names PHP RFC: Deprecations for PHP 8.5: Deprecate non-standard cast names]

Follow-up to [1346], [11875].

Props TobiasBg, swissspidy, SergeyBiryukov.
See #63061.
Built from https://develop.svn.wordpress.org/trunk@60659


git-svn-id: http://core.svn.wordpress.org/trunk@59995 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-25 13:10:29 +00:00
Sergey Biryukov
58aee83106 Docs: Correct the order of @since and @global tags in some files.
Follow-up to [32642], [32643], [60416].

Props shailu25, mukesh27.
See #63166.
Built from https://develop.svn.wordpress.org/trunk@60658


git-svn-id: http://core.svn.wordpress.org/trunk@59994 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-24 13:44:32 +00:00
Sergey Biryukov
aeb1e8f940 Security: Set the frame-ancestors directive in send_frame_options_header().
The `X-Frame-Options` HTTP response header is a way of controlling whether and how a document may be loaded inside of a child navigable. For sites using `Content-Security-Policy`, the `frame-ancestors` directive provides more granular control over the same situations.

Includes adding a `headers_sent()` check before sending the headers.

References:
* [https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options MDN Web Docs: X-Frame-Options header]
* [https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors MDN Web Docs: Content-Security-Policy: frame-ancestors directive]

Follow-up to [17826].

Props danielbachhuber, killerbishop, callumbw95, josephscott, nacin, chriscct7, iandunn, SergeyBiryukov.
Fixes #29429.
Built from https://develop.svn.wordpress.org/trunk@60657


git-svn-id: http://core.svn.wordpress.org/trunk@59993 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-23 14:08:30 +00:00
Sergey Biryukov
41eb91c33b Docs: Correct the type for _WP_Dependency::$args property.
Follow-up to [7970], [25518], [48462].

Props marian1, iamadisingh.
Fixes #63857.
Built from https://develop.svn.wordpress.org/trunk@60656


git-svn-id: http://core.svn.wordpress.org/trunk@59992 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-22 15:43:44 +00:00
Sergey Biryukov
99744bd4ce XML-RPC: Update specUrl links in IXR_Server and IXR_IntrospectionServer.
As the original URLs are no longer accessible, this commit uses the latest available copy of the corresponding documentation from the Wayback Machine.

Follow-up to [1346], [56167].

Props mayur8991, panchalhimani711, SergeyBiryukov.
Fixes #63848.
Built from https://develop.svn.wordpress.org/trunk@60655


git-svn-id: http://core.svn.wordpress.org/trunk@59991 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-21 15:00:40 +00:00
Sergey Biryukov
6d1bd80da8 Posts, Post Types: Avoid an extra database query in WP_Post for a negative post ID.
Follow-up to [21559].

Props bor0, akeda, SergeyBiryukov.
Fixes #63850.
Built from https://develop.svn.wordpress.org/trunk@60654


git-svn-id: http://core.svn.wordpress.org/trunk@59990 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-20 15:01:31 +00:00
John Blackbourn
b745bbc180 Cron API: Correct the documented type and value of the $doing_wp_cron variable.
See #63166
Built from https://develop.svn.wordpress.org/trunk@60653


git-svn-id: http://core.svn.wordpress.org/trunk@59989 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-20 14:05:31 +00:00
John Blackbourn
3fface44ee HTTP API: Various improvements to the docblocks for HTTP functions.
See #63166

Built from https://develop.svn.wordpress.org/trunk@60652


git-svn-id: http://core.svn.wordpress.org/trunk@59988 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-20 12:55:28 +00:00
isabel_brison
92695c72b2 Editor: Include namespace in layout classname for non-core blocks.
Adds block namespace in layout classname so global styles can be built correctly.

Props isabel_brison, wildworks, peroks, rishabhwp.
Fixes #63844, #63839.

Built from https://develop.svn.wordpress.org/trunk@60651


git-svn-id: http://core.svn.wordpress.org/trunk@59987 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-20 03:38:33 +00:00
Peter Wilson
9dcb8c0599 Users: Throw specific warning when wp_insert_user() called without user_pass.
Modifies `wp_insert_user()` to throw the warning `The user_pass field is required when creating a new user. The user will need to reset their password before logging in.` when called without the `user_pass` argument defined.

This avoids a mix of warnings being thrown depending on the version of PHP the system is running on, anywhere between zero and three.

To retain backward compatibility the user is created with an empty password. As WordPress does not accept an empty password during authentication, this will require the newly created user complete the password reset process.

Props dd32, hbhalodia, iamadisingh, mindctrl, rollybueno, sheldorofazeroth, shilpaashokan94
Fixes #63770.

Built from https://develop.svn.wordpress.org/trunk@60650


git-svn-id: http://core.svn.wordpress.org/trunk@59986 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-19 23:31:31 +00:00
jonsurrell
0ac15a8b8c HTML API: Improve script tag escape state processing.
Addresses some edge cases parsing of script tag contents:

- "<!-->" remains in the unescaped state and does not enter the escaped state.
- Contents in the escaped state that end with "<script" do not enter double-escaped state.
- "\f" (Form Feed) was missing as a tag name terminating character.

Developed in https://github.com/WordPress/wordpress-develop/pull/9397 and https://github.com/WordPress/wordpress-develop/pull/9402.

Props jonsurrell, dmsnell.
See #63738.

Built from https://develop.svn.wordpress.org/trunk@60649


git-svn-id: http://core.svn.wordpress.org/trunk@59985 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-19 19:09:31 +00:00
jonsurrell
9ab3854c4c Editor: Ensure preloading middleware JSON is correctly encoded.
Adds the appropriate JSON flags to `wp_json_encode()` to safely encode data for use in script tags.

Developed in https://github.com/WordPress/wordpress-develop/pull/8145.

Props jonsurrell, bernhard-reiter, dmsnell, artpi, ankitkumarshah, abcd95, dilipbheda, sainathpoojary, shanemuir.
Fixes #62797.

Built from https://develop.svn.wordpress.org/trunk@60648


git-svn-id: http://core.svn.wordpress.org/trunk@59984 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-19 18:52:30 +00:00
jonsurrell
4f8fc714a4 HTML API: Fix typo in indicated_compatibility_mode.
Developed in https://github.com/WordPress/wordpress-develop/pull/9401.

Follow-up to [60540].

Props jonsurrell, dmsnell.
Fixes #63391.

Built from https://develop.svn.wordpress.org/trunk@60647


git-svn-id: http://core.svn.wordpress.org/trunk@59983 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-19 15:08:31 +00:00
Sergey Biryukov
69f8f6ecf6 Coding Standards: Sanitize input values in wp-trackback.php.
Follow-up to [4676], [12284], [23594], [53719].

Props utsav72640, mukesh27, ankitmaru, dhruvang21, SergeyBiryukov.
Fixes #58511.
Built from https://develop.svn.wordpress.org/trunk@60646


git-svn-id: http://core.svn.wordpress.org/trunk@59982 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-19 12:30:31 +00:00