{Ninja-Shell}
Home
Info
Upload
Command
View /etc/passwd
cPanel Reset Password
Filename: /home/matthif/////www/////wp-content/plugins/uploads.tar
class-wp-customize-control.php 0000666 00000063007 15226557730 0012532 0 ustar 00 <?php /** * WordPress Customize Control classes * * @package WordPress * @subpackage Customize * @since 3.4.0 */ // Don't load directly. if ( ! defined( 'ABSPATH' ) ) { die( '-1' ); } /** * Customize Control class. * * @since 3.4.0 */ #[AllowDynamicProperties] class WP_Customize_Control { /** * Incremented with each new class instantiation, then stored in $instance_number. * * Used when sorting two instances whose priorities are equal. * * @since 4.1.0 * @var int */ protected static $instance_count = 0; /** * Order in which this instance was created in relation to other instances. * * @since 4.1.0 * @var int */ public $instance_number; /** * Customizer manager. * * @since 3.4.0 * @var WP_Customize_Manager */ public $manager; /** * Control ID. * * @since 3.4.0 * @var string */ public $id; /** * All settings tied to the control. * * @since 3.4.0 * @var array */ public $settings; /** * The primary setting for the control (if there is one). * * @since 3.4.0 * @var string|WP_Customize_Setting|null */ public $setting = 'default'; /** * Capability required to use this control. * * Normally this is empty and the capability is derived from the capabilities * of the associated `$settings`. * * @since 4.5.0 * @var string */ public $capability; /** * Order priority to load the control in Customizer. * * @since 3.4.0 * @var int */ public $priority = 10; /** * Section the control belongs to. * * @since 3.4.0 * @var string */ public $section = ''; /** * Label for the control. * * @since 3.4.0 * @var string */ public $label = ''; /** * Description for the control. * * @since 4.0.0 * @var string */ public $description = ''; /** * List of choices for 'radio' or 'select' type controls, where values are the keys, and labels are the values. * * @since 3.4.0 * @var array */ public $choices = array(); /** * List of custom input attributes for control output, where attribute names are the keys and values are the values. * * Not used for 'checkbox', 'radio', 'select', or 'dropdown-pages' control types. * * @since 4.0.0 * @var array */ public $input_attrs = array(); /** * Show UI for adding new content, currently only used for the dropdown-pages control. * * @since 4.7.0 * @var bool */ public $allow_addition = false; /** * @deprecated It is better to just call the json() method * @since 3.4.0 * @var array */ public $json = array(); /** * Control's Type. * * @since 3.4.0 * @var string */ public $type = 'text'; /** * Callback. * * @since 4.0.0 * * @see WP_Customize_Control::active() * * @var callable Callback is called with one argument, the instance of * WP_Customize_Control, and returns bool to indicate whether * the control is active (such as it relates to the URL * currently being previewed). */ public $active_callback = ''; /** * Constructor. * * Supplied `$args` override class property defaults. * * If `$args['settings']` is not defined, use the `$id` as the setting ID. * * @since 3.4.0 * * @param WP_Customize_Manager $manager Customizer bootstrap instance. * @param string $id Control ID. * @param array $args { * Optional. Array of properties for the new Control object. Default empty array. * * @type int $instance_number Order in which this instance was created in relation * to other instances. * @type WP_Customize_Manager $manager Customizer bootstrap instance. * @type string $id Control ID. * @type array $settings All settings tied to the control. If undefined, `$id` will * be used. * @type string $setting The primary setting for the control (if there is one). * Default 'default'. * @type string $capability Capability required to use this control. Normally this is empty * and the capability is derived from `$settings`. * @type int $priority Order priority to load the control. Default 10. * @type string $section Section the control belongs to. Default empty. * @type string $label Label for the control. Default empty. * @type string $description Description for the control. Default empty. * @type array $choices List of choices for 'radio' or 'select' type controls, where * values are the keys, and labels are the values. * Default empty array. * @type array $input_attrs List of custom input attributes for control output, where * attribute names are the keys and values are the values. Not * used for 'checkbox', 'radio', 'select', or 'dropdown-pages' * control types. Default empty array. * @type bool $allow_addition Show UI for adding new content, currently only used for the * dropdown-pages control. Default false. * @type array $json Deprecated. Use WP_Customize_Control::json() instead. * @type string $type Control type. Core controls include 'text', 'checkbox', * 'textarea', 'radio', 'select', and 'dropdown-pages'. Additional * input types such as 'email', 'url', 'number', 'hidden', and * 'date' are supported implicitly. Default 'text'. * @type callable $active_callback Active callback. * } */ public function __construct( $manager, $id, $args = array() ) { $keys = array_keys( get_object_vars( $this ) ); foreach ( $keys as $key ) { if ( isset( $args[ $key ] ) ) { $this->$key = $args[ $key ]; } } $this->manager = $manager; $this->id = $id; if ( empty( $this->active_callback ) ) { $this->active_callback = array( $this, 'active_callback' ); } self::$instance_count += 1; $this->instance_number = self::$instance_count; // Process settings. if ( ! isset( $this->settings ) ) { $this->settings = $id; } $settings = array(); if ( is_array( $this->settings ) ) { foreach ( $this->settings as $key => $setting ) { $settings[ $key ] = $this->manager->get_setting( $setting ); } } elseif ( is_string( $this->settings ) ) { $this->setting = $this->manager->get_setting( $this->settings ); $settings['default'] = $this->setting; } $this->settings = $settings; } /** * Enqueues control related scripts/styles. * * @since 3.4.0 */ public function enqueue() {} /** * Checks whether control is active to current Customizer preview. * * @since 4.0.0 * * @return bool Whether the control is active to the current preview. */ final public function active() { $control = $this; $active = call_user_func( $this->active_callback, $this ); /** * Filters response of WP_Customize_Control::active(). * * @since 4.0.0 * * @param bool $active Whether the Customizer control is active. * @param WP_Customize_Control $control WP_Customize_Control instance. */ $active = apply_filters( 'customize_control_active', $active, $control ); return $active; } /** * Default callback used when invoking WP_Customize_Control::active(). * * Subclasses can override this with their specific logic, or they may * provide an 'active_callback' argument to the constructor. * * @since 4.0.0 * * @return true Always true. */ public function active_callback() { return true; } /** * Fetches a setting's value. * Grabs the main setting by default. * * @since 3.4.0 * * @param string $setting_key * @return mixed The requested setting's value, if the setting exists. */ final public function value( $setting_key = 'default' ) { if ( isset( $this->settings[ $setting_key ] ) ) { return $this->settings[ $setting_key ]->value(); } } /** * Refreshes the parameters passed to the JavaScript via JSON. * * @since 3.4.0 */ public function to_json() { $this->json['settings'] = array(); foreach ( $this->settings as $key => $setting ) { $this->json['settings'][ $key ] = $setting->id; } $this->json['type'] = $this->type; $this->json['priority'] = $this->priority; $this->json['active'] = $this->active(); $this->json['section'] = $this->section; $this->json['content'] = $this->get_content(); $this->json['label'] = $this->label; $this->json['description'] = $this->description; $this->json['instanceNumber'] = $this->instance_number; if ( 'dropdown-pages' === $this->type ) { $this->json['allow_addition'] = $this->allow_addition; } } /** * Gets the data to export to the client via JSON. * * @since 4.1.0 * * @return array Array of parameters passed to the JavaScript. */ public function json() { $this->to_json(); return $this->json; } /** * Checks if the user can use this control. * * Returns false if the user cannot manipulate one of the associated settings, * or if one of the associated settings does not exist. Also returns false if * the associated section does not exist or if its capability check returns * false. * * @since 3.4.0 * * @return bool False if theme doesn't support the control or user doesn't have the required permissions, otherwise true. */ final public function check_capabilities() { if ( ! empty( $this->capability ) && ! current_user_can( $this->capability ) ) { return false; } foreach ( $this->settings as $setting ) { if ( ! $setting || ! $setting->check_capabilities() ) { return false; } } $section = $this->manager->get_section( $this->section ); if ( isset( $section ) && ! $section->check_capabilities() ) { return false; } return true; } /** * Gets the control's content for insertion into the Customizer pane. * * @since 4.1.0 * * @return string Contents of the control. */ final public function get_content() { ob_start(); $this->maybe_render(); return trim( ob_get_clean() ); } /** * Checks capabilities and render the control. * * @since 3.4.0 * @uses WP_Customize_Control::render() */ final public function maybe_render() { if ( ! $this->check_capabilities() ) { return; } /** * Fires just before the current Customizer control is rendered. * * @since 3.4.0 * * @param WP_Customize_Control $control WP_Customize_Control instance. */ do_action( 'customize_render_control', $this ); /** * Fires just before a specific Customizer control is rendered. * * The dynamic portion of the hook name, `$this->id`, refers to * the control ID. * * @since 3.4.0 * * @param WP_Customize_Control $control WP_Customize_Control instance. */ do_action( "customize_render_control_{$this->id}", $this ); $this->render(); } /** * Renders the control wrapper and calls $this->render_content() for the internals. * * @since 3.4.0 */ protected function render() { $id = 'customize-control-' . str_replace( array( '[', ']' ), array( '-', '' ), $this->id ); $class = 'customize-control customize-control-' . $this->type; printf( '<li id="%s" class="%s">', esc_attr( $id ), esc_attr( $class ) ); $this->render_content(); echo '</li>'; } /** * Gets the data link attribute for a setting. * * @since 3.4.0 * @since 4.9.0 Return a `data-customize-setting-key-link` attribute if a setting is not registered for the supplied setting key. * * @param string $setting_key * @return string Data link parameter, a `data-customize-setting-link` attribute if the `$setting_key` refers * to a pre-registered setting, and a `data-customize-setting-key-link` attribute if the setting * is not yet registered. */ public function get_link( $setting_key = 'default' ) { if ( isset( $this->settings[ $setting_key ] ) && $this->settings[ $setting_key ] instanceof WP_Customize_Setting ) { return 'data-customize-setting-link="' . esc_attr( $this->settings[ $setting_key ]->id ) . '"'; } else { return 'data-customize-setting-key-link="' . esc_attr( $setting_key ) . '"'; } } /** * Renders the data link attribute for the control's input element. * * @since 3.4.0 * @uses WP_Customize_Control::get_link() * * @param string $setting_key Default 'default'. */ public function link( $setting_key = 'default' ) { echo $this->get_link( $setting_key ); } /** * Renders the custom attributes for the control's input element. * * @since 4.0.0 */ public function input_attrs() { foreach ( $this->input_attrs as $attr => $value ) { echo $attr . '="' . esc_attr( $value ) . '" '; } } /** * Renders the control's content. * * Allows the content to be overridden without having to rewrite the wrapper in `$this::render()`. * * Supports basic input types `text`, `checkbox`, `textarea`, `radio`, `select` and `dropdown-pages`. * Additional input types such as `email`, `url`, `number`, `hidden` and `date` are supported implicitly. * * Control content can alternately be rendered in JS. See WP_Customize_Control::print_template(). * * @since 3.4.0 */ protected function render_content() { $input_id = '_customize-input-' . $this->id; $description_id = '_customize-description-' . $this->id; $describedby_attr = ( ! empty( $this->description ) ) ? ' aria-describedby="' . esc_attr( $description_id ) . '" ' : ''; switch ( $this->type ) { case 'checkbox': ?> <span class="customize-inside-control-row"> <input id="<?php echo esc_attr( $input_id ); ?>" <?php echo $describedby_attr; ?> type="checkbox" value="<?php echo esc_attr( $this->value() ); ?>" <?php $this->link(); ?> <?php checked( $this->value() ); ?> /> <label for="<?php echo esc_attr( $input_id ); ?>"><?php echo esc_html( $this->label ); ?></label> <?php if ( ! empty( $this->description ) ) : ?> <span id="<?php echo esc_attr( $description_id ); ?>" class="description customize-control-description"><?php echo $this->description; ?></span> <?php endif; ?> </span> <?php break; case 'radio': if ( empty( $this->choices ) ) { return; } $name = '_customize-radio-' . $this->id; ?> <?php if ( ! empty( $this->label ) ) : ?> <span class="customize-control-title"><?php echo esc_html( $this->label ); ?></span> <?php endif; ?> <?php if ( ! empty( $this->description ) ) : ?> <span id="<?php echo esc_attr( $description_id ); ?>" class="description customize-control-description"><?php echo $this->description; ?></span> <?php endif; ?> <?php foreach ( $this->choices as $value => $label ) : ?> <span class="customize-inside-control-row"> <input id="<?php echo esc_attr( $input_id . '-radio-' . $value ); ?>" type="radio" <?php echo $describedby_attr; ?> value="<?php echo esc_attr( $value ); ?>" name="<?php echo esc_attr( $name ); ?>" <?php $this->link(); ?> <?php checked( $this->value(), $value ); ?> /> <label for="<?php echo esc_attr( $input_id . '-radio-' . $value ); ?>"><?php echo esc_html( $label ); ?></label> </span> <?php endforeach; ?> <?php break; case 'select': if ( empty( $this->choices ) ) { return; } ?> <?php if ( ! empty( $this->label ) ) : ?> <label for="<?php echo esc_attr( $input_id ); ?>" class="customize-control-title"><?php echo esc_html( $this->label ); ?></label> <?php endif; ?> <?php if ( ! empty( $this->description ) ) : ?> <span id="<?php echo esc_attr( $description_id ); ?>" class="description customize-control-description"><?php echo $this->description; ?></span> <?php endif; ?> <select id="<?php echo esc_attr( $input_id ); ?>" <?php echo $describedby_attr; ?> <?php $this->link(); ?>> <?php foreach ( $this->choices as $value => $label ) { echo '<option value="' . esc_attr( $value ) . '"' . selected( $this->value(), $value, false ) . '>' . esc_html( $label ) . '</option>'; } ?> </select> <?php break; case 'textarea': if ( ! array_key_exists( 'rows', $this->input_attrs ) ) { $this->input_attrs['rows'] = 5; } ?> <?php if ( ! empty( $this->label ) ) : ?> <label for="<?php echo esc_attr( $input_id ); ?>" class="customize-control-title"><?php echo esc_html( $this->label ); ?></label> <?php endif; ?> <?php if ( ! empty( $this->description ) ) : ?> <span id="<?php echo esc_attr( $description_id ); ?>" class="description customize-control-description"><?php echo $this->description; ?></span> <?php endif; ?> <textarea id="<?php echo esc_attr( $input_id ); ?>" <?php echo $describedby_attr; ?> <?php $this->input_attrs(); ?> <?php $this->link(); ?> ><?php echo esc_textarea( $this->value() ); ?></textarea> <?php break; case 'dropdown-pages': ?> <?php if ( ! empty( $this->label ) ) : ?> <label for="<?php echo esc_attr( $input_id ); ?>" class="customize-control-title"><?php echo esc_html( $this->label ); ?></label> <?php endif; ?> <?php if ( ! empty( $this->description ) ) : ?> <span id="<?php echo esc_attr( $description_id ); ?>" class="description customize-control-description"><?php echo $this->description; ?></span> <?php endif; ?> <?php $dropdown_name = '_customize-dropdown-pages-' . $this->id; $show_option_none = __( '— Select —' ); $option_none_value = '0'; $dropdown = wp_dropdown_pages( array( 'name' => $dropdown_name, 'echo' => 0, 'show_option_none' => $show_option_none, 'option_none_value' => $option_none_value, 'selected' => $this->value(), ) ); if ( empty( $dropdown ) ) { $dropdown = sprintf( '<select id="%1$s" name="%1$s">', esc_attr( $dropdown_name ) ); $dropdown .= sprintf( '<option value="%1$s">%2$s</option>', esc_attr( $option_none_value ), esc_html( $show_option_none ) ); $dropdown .= '</select>'; } // Hackily add in the data link parameter. $dropdown = str_replace( '<select', '<select ' . $this->get_link() . ' id="' . esc_attr( $input_id ) . '" ' . $describedby_attr, $dropdown ); /* * Even more hackily add auto-draft page stubs. * @todo Eventually this should be removed in favor of the pages being injected into the underlying get_pages() call. * See <https://github.com/xwp/wp-customize-posts/pull/250>. */ $nav_menus_created_posts_setting = $this->manager->get_setting( 'nav_menus_created_posts' ); if ( $nav_menus_created_posts_setting && current_user_can( 'publish_pages' ) ) { $auto_draft_page_options = ''; foreach ( $nav_menus_created_posts_setting->value() as $auto_draft_page_id ) { $post = get_post( $auto_draft_page_id ); if ( $post && 'page' === $post->post_type ) { $auto_draft_page_options .= sprintf( '<option value="%1$s">%2$s</option>', esc_attr( $post->ID ), esc_html( $post->post_title ) ); } } if ( $auto_draft_page_options ) { $dropdown = str_replace( '</select>', $auto_draft_page_options . '</select>', $dropdown ); } } echo $dropdown; ?> <?php if ( $this->allow_addition && current_user_can( 'publish_pages' ) && current_user_can( 'edit_theme_options' ) ) : // Currently tied to menus functionality. ?> <button type="button" class="button-link add-new-toggle"> <?php /* translators: %s: Add Page label. */ printf( __( '+ %s' ), get_post_type_object( 'page' )->labels->add_new_item ); ?> </button> <div class="new-content-item-wrapper"> <label for="create-input-<?php echo esc_attr( $this->id ); ?>"><?php _e( 'New page title' ); ?></label> <div class="new-content-item"> <input type="text" id="create-input-<?php echo esc_attr( $this->id ); ?>" class="create-item-input form-required"> <button type="button" class="button add-content"><?php _e( 'Add' ); ?></button> </div> <span id="create-input-<?php echo esc_attr( $this->id ); ?>-error" class="create-item-error error-message" style="display: none;"><?php _e( 'Please enter a page title' ); ?></span> </div> <?php endif; ?> <?php break; default: ?> <?php if ( ! empty( $this->label ) ) : ?> <label for="<?php echo esc_attr( $input_id ); ?>" class="customize-control-title"><?php echo esc_html( $this->label ); ?></label> <?php endif; ?> <?php if ( ! empty( $this->description ) ) : ?> <span id="<?php echo esc_attr( $description_id ); ?>" class="description customize-control-description"><?php echo $this->description; ?></span> <?php endif; ?> <input id="<?php echo esc_attr( $input_id ); ?>" type="<?php echo esc_attr( $this->type ); ?>" <?php echo $describedby_attr; ?> <?php $this->input_attrs(); ?> <?php if ( ! isset( $this->input_attrs['value'] ) ) : ?> value="<?php echo esc_attr( $this->value() ); ?>" <?php endif; ?> <?php $this->link(); ?> /> <?php break; } } /** * Renders the control's JS template. * * This function is only run for control types that have been registered with * WP_Customize_Manager::register_control_type(). * * In the future, this will also print the template for the control's container * element and be override-able. * * @since 4.1.0 */ final public function print_template() { ?> <script type="text/html" id="tmpl-customize-control-<?php echo esc_attr( $this->type ); ?>-content"> <?php $this->content_template(); ?> </script> <?php } /** * An Underscore (JS) template for this control's content (but not its container). * * Class variables for this control class are available in the `data` JS object; * export custom variables by overriding WP_Customize_Control::to_json(). * * @see WP_Customize_Control::print_template() * * @since 4.1.0 */ protected function content_template() {} } /** * WP_Customize_Color_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-color-control.php'; /** * WP_Customize_Media_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-media-control.php'; /** * WP_Customize_Upload_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-upload-control.php'; /** * WP_Customize_Image_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-image-control.php'; /** * WP_Customize_Background_Image_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-background-image-control.php'; /** * WP_Customize_Background_Position_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-background-position-control.php'; /** * WP_Customize_Cropped_Image_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-cropped-image-control.php'; /** * WP_Customize_Site_Icon_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-site-icon-control.php'; /** * WP_Customize_Header_Image_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-header-image-control.php'; /** * WP_Customize_Theme_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-theme-control.php'; /** * WP_Widget_Area_Customize_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-widget-area-customize-control.php'; /** * WP_Widget_Form_Customize_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-widget-form-customize-control.php'; /** * WP_Customize_Nav_Menu_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-control.php'; /** * WP_Customize_Nav_Menu_Item_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-item-control.php'; /** * WP_Customize_Nav_Menu_Location_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-location-control.php'; /** * WP_Customize_Nav_Menu_Name_Control class. * * As this file is deprecated, it will trigger a deprecation notice if instantiated. In a subsequent * release, the require_once here will be removed and _deprecated_file() will be called if file is * required at all. * * @deprecated 4.9.0 This file is no longer used due to new menu creation UX. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-name-control.php'; /** * WP_Customize_Nav_Menu_Locations_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-locations-control.php'; /** * WP_Customize_Nav_Menu_Auto_Add_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-auto-add-control.php'; /** * WP_Customize_Date_Time_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-customize-date-time-control.php'; /** * WP_Sidebar_Block_Editor_Control class. */ require_once ABSPATH . WPINC . '/customize/class-wp-sidebar-block-editor-control.php'; https-migration.php 0000666 00000011205 15226557730 0010425 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } class-wp-session-tokens.php 0000666 00000016227 15226557730 0012020 0 ustar 00 <?php /** * Session API: WP_Session_Tokens class * * @package WordPress * @subpackage Session * @since 4.7.0 */ /** * Abstract class for managing user session tokens. * * @since 4.0.0 */ #[AllowDynamicProperties] abstract class WP_Session_Tokens { /** * User ID. * * @since 4.0.0 * @var int User ID. */ protected $user_id; /** * Protected constructor. Use the `get_instance()` method to get the instance. * * @since 4.0.0 * * @param int $user_id User whose session to manage. */ protected function __construct( $user_id ) { $this->user_id = $user_id; } /** * Retrieves a session manager instance for a user. * * This method contains a {@see 'session_token_manager'} filter, allowing a plugin to swap out * the session manager for a subclass of `WP_Session_Tokens`. * * @since 4.0.0 * * @param int $user_id User whose session to manage. * @return WP_Session_Tokens The session object, which is by default an instance of * the `WP_User_Meta_Session_Tokens` class. */ final public static function get_instance( $user_id ) { /** * Filters the class name for the session token manager. * * @since 4.0.0 * * @param string $session Name of class to use as the manager. * Default 'WP_User_Meta_Session_Tokens'. */ $manager = apply_filters( 'session_token_manager', 'WP_User_Meta_Session_Tokens' ); return new $manager( $user_id ); } /** * Hashes the given session token for storage. * * @since 4.0.0 * * @param string $token Session token to hash. * @return string A hash of the session token (a verifier). */ private function hash_token( $token ) { return hash( 'sha256', $token ); } /** * Retrieves a user's session for the given token. * * @since 4.0.0 * * @param string $token Session token. * @return array|null The session, or null if it does not exist. */ final public function get( $token ) { $verifier = $this->hash_token( $token ); return $this->get_session( $verifier ); } /** * Validates the given session token for authenticity and validity. * * Checks that the given token is present and hasn't expired. * * @since 4.0.0 * * @param string $token Token to verify. * @return bool Whether the token is valid for the user. */ final public function verify( $token ) { $verifier = $this->hash_token( $token ); return (bool) $this->get_session( $verifier ); } /** * Generates a session token and attaches session information to it. * * A session token is a long, random string. It is used in a cookie * to link that cookie to an expiration time and to ensure the cookie * becomes invalidated when the user logs out. * * This function generates a token and stores it with the associated * expiration time (and potentially other session information via the * {@see 'attach_session_information'} filter). * * @since 4.0.0 * * @param int $expiration Session expiration timestamp. * @return string Session token. */ final public function create( $expiration ) { /** * Filters the information attached to the newly created session. * * Can be used to attach further information to a session. * * @since 4.0.0 * * @param array $session Array of extra data. * @param int $user_id User ID. */ $session = apply_filters( 'attach_session_information', array(), $this->user_id ); $session['expiration'] = $expiration; // IP address. if ( ! empty( $_SERVER['REMOTE_ADDR'] ) ) { $session['ip'] = $_SERVER['REMOTE_ADDR']; } // User-agent. if ( ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) { $session['ua'] = wp_unslash( $_SERVER['HTTP_USER_AGENT'] ); } // Timestamp. $session['login'] = time(); $token = wp_generate_password( 43, false, false ); $this->update( $token, $session ); return $token; } /** * Updates the data for the session with the given token. * * @since 4.0.0 * * @param string $token Session token to update. * @param array $session Session information. */ final public function update( $token, $session ) { $verifier = $this->hash_token( $token ); $this->update_session( $verifier, $session ); } /** * Destroys the session with the given token. * * @since 4.0.0 * * @param string $token Session token to destroy. */ final public function destroy( $token ) { $verifier = $this->hash_token( $token ); $this->update_session( $verifier, null ); } /** * Destroys all sessions for this user except the one with the given token (presumably the one in use). * * @since 4.0.0 * * @param string $token_to_keep Session token to keep. */ final public function destroy_others( $token_to_keep ) { $verifier = $this->hash_token( $token_to_keep ); $session = $this->get_session( $verifier ); if ( $session ) { $this->destroy_other_sessions( $verifier ); } else { $this->destroy_all_sessions(); } } /** * Determines whether a session is still valid, based on its expiration timestamp. * * @since 4.0.0 * * @param array $session Session to check. * @return bool Whether session is valid. */ final protected function is_still_valid( $session ) { return $session['expiration'] >= time(); } /** * Destroys all sessions for a user. * * @since 4.0.0 */ final public function destroy_all() { $this->destroy_all_sessions(); } /** * Destroys all sessions for all users. * * @since 4.0.0 */ final public static function destroy_all_for_all_users() { /** This filter is documented in wp-includes/class-wp-session-tokens.php */ $manager = apply_filters( 'session_token_manager', 'WP_User_Meta_Session_Tokens' ); call_user_func( array( $manager, 'drop_sessions' ) ); } /** * Retrieves all sessions for a user. * * @since 4.0.0 * * @return array Sessions for a user. */ final public function get_all() { return array_values( $this->get_sessions() ); } /** * Retrieves all sessions of the user. * * @since 4.0.0 * * @return array Sessions of the user. */ abstract protected function get_sessions(); /** * Retrieves a session based on its verifier (token hash). * * @since 4.0.0 * * @param string $verifier Verifier for the session to retrieve. * @return array|null The session, or null if it does not exist. */ abstract protected function get_session( $verifier ); /** * Updates a session based on its verifier (token hash). * * Omitting the second argument destroys the session. * * @since 4.0.0 * * @param string $verifier Verifier for the session to update. * @param array $session Optional. Session. Omitting this argument destroys the session. */ abstract protected function update_session( $verifier, $session = null ); /** * Destroys all sessions for this user, except the single session with the given verifier. * * @since 4.0.0 * * @param string $verifier Verifier of the session to keep. */ abstract protected function destroy_other_sessions( $verifier ); /** * Destroys all sessions for the user. * * @since 4.0.0 */ abstract protected function destroy_all_sessions(); /** * Destroys all sessions for all users. * * @since 4.0.0 */ public static function drop_sessions() {} } https-migration-20260606135927.php 0000666 00000011205 15226557730 0012023 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } https-migration-20260605122500.php 0000666 00000011205 15226557730 0012001 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } https-migration-20260605104629.php 0000666 00000011205 15226557730 0012015 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } class-wp-user-query.php 0000666 00000126206 15226557730 0011154 0 ustar 00 <?php /** * User API: WP_User_Query class * * @package WordPress * @subpackage Users * @since 4.4.0 */ /** * Core class used for querying users. * * @since 3.1.0 * * @see WP_User_Query::prepare_query() for information on accepted arguments. */ #[AllowDynamicProperties] class WP_User_Query { /** * Query vars, after parsing * * @since 3.5.0 * @var array */ public $query_vars = array(); /** * List of found user IDs. * * @since 3.1.0 * @var array */ private $results; /** * Total number of found users for the current query * * @since 3.1.0 * @var int */ private $total_users = 0; /** * Metadata query container. * * @since 4.2.0 * @var WP_Meta_Query */ public $meta_query = false; /** * The SQL query used to fetch matching users. * * @since 4.4.0 * @var string */ public $request; private $compat_fields = array( 'results', 'total_users' ); // SQL clauses. public $query_fields; public $query_from; public $query_where; public $query_orderby; public $query_limit; /** * Constructor. * * @since 3.1.0 * * @param null|string|array $query Optional. The query variables. * See WP_User_Query::prepare_query() for information on accepted arguments. */ public function __construct( $query = null ) { if ( ! empty( $query ) ) { $this->prepare_query( $query ); $this->query(); } } /** * Fills in missing query variables with default values. * * @since 4.4.0 * * @param string|array $args Query vars, as passed to `WP_User_Query`. * @return array Complete query variables with undefined ones filled in with defaults. */ public static function fill_query_vars( $args ) { $defaults = array( 'blog_id' => get_current_blog_id(), 'role' => '', 'role__in' => array(), 'role__not_in' => array(), 'capability' => '', 'capability__in' => array(), 'capability__not_in' => array(), 'meta_key' => '', 'meta_value' => '', 'meta_compare' => '', 'include' => array(), 'exclude' => array(), 'search' => '', 'search_columns' => array(), 'orderby' => 'login', 'order' => 'ASC', 'offset' => '', 'number' => '', 'paged' => 1, 'count_total' => true, 'fields' => 'all', 'who' => '', 'has_published_posts' => null, 'nicename' => '', 'nicename__in' => array(), 'nicename__not_in' => array(), 'login' => '', 'login__in' => array(), 'login__not_in' => array(), 'cache_results' => true, ); return wp_parse_args( $args, $defaults ); } /** * Prepares the query variables. * * @since 3.1.0 * @since 4.1.0 Added the ability to order by the `include` value. * @since 4.2.0 Added 'meta_value_num' support for `$orderby` parameter. Added multi-dimensional array syntax * for `$orderby` parameter. * @since 4.3.0 Added 'has_published_posts' parameter. * @since 4.4.0 Added 'paged', 'role__in', and 'role__not_in' parameters. The 'role' parameter was updated to * permit an array or comma-separated list of values. The 'number' parameter was updated to support * querying for all users with using -1. * @since 4.7.0 Added 'nicename', 'nicename__in', 'nicename__not_in', 'login', 'login__in', * and 'login__not_in' parameters. * @since 5.1.0 Introduced the 'meta_compare_key' parameter. * @since 5.3.0 Introduced the 'meta_type_key' parameter. * @since 5.9.0 Added 'capability', 'capability__in', and 'capability__not_in' parameters. * Deprecated the 'who' parameter. * @since 6.3.0 Added 'cache_results' parameter. * * @global wpdb $wpdb WordPress database abstraction object. * @global WP_Roles $wp_roles WordPress role management object. * * @param string|array $query { * Optional. Array or string of query parameters. * * @type int $blog_id The site ID. Default is the current site. * @type string|string[] $role An array or a comma-separated list of role names that users * must match to be included in results. Note that this is * an inclusive list: users must match *each* role. Default empty. * @type string[] $role__in An array of role names. Matched users must have at least one * of these roles. Default empty array. * @type string[] $role__not_in An array of role names to exclude. Users matching one or more * of these roles will not be included in results. Default empty array. * @type string|string[] $meta_key Meta key or keys to filter by. * @type string|string[] $meta_value Meta value or values to filter by. * @type string $meta_compare MySQL operator used for comparing the meta value. * See WP_Meta_Query::__construct() for accepted values and default value. * @type string $meta_compare_key MySQL operator used for comparing the meta key. * See WP_Meta_Query::__construct() for accepted values and default value. * @type string $meta_type MySQL data type that the meta_value column will be CAST to for comparisons. * See WP_Meta_Query::__construct() for accepted values and default value. * @type string $meta_type_key MySQL data type that the meta_key column will be CAST to for comparisons. * See WP_Meta_Query::__construct() for accepted values and default value. * @type array $meta_query An associative array of WP_Meta_Query arguments. * See WP_Meta_Query::__construct() for accepted values. * @type string|string[] $capability An array or a comma-separated list of capability names that users * must match to be included in results. Note that this is * an inclusive list: users must match *each* capability. * Does NOT work for capabilities not in the database or filtered * via {@see 'map_meta_cap'}. Default empty. * @type string[] $capability__in An array of capability names. Matched users must have at least one * of these capabilities. * Does NOT work for capabilities not in the database or filtered * via {@see 'map_meta_cap'}. Default empty array. * @type string[] $capability__not_in An array of capability names to exclude. Users matching one or more * of these capabilities will not be included in results. * Does NOT work for capabilities not in the database or filtered * via {@see 'map_meta_cap'}. Default empty array. * @type int[] $include An array of user IDs to include. Default empty array. * @type int[] $exclude An array of user IDs to exclude. Default empty array. * @type string $search Search keyword. Searches for possible string matches on columns. * When `$search_columns` is left empty, it tries to determine which * column to search in based on search string. Default empty. * @type string[] $search_columns Array of column names to be searched. Accepts 'ID', 'user_login', * 'user_email', 'user_url', 'user_nicename', 'display_name'. * Default empty array. * @type string|array $orderby Field(s) to sort the retrieved users by. May be a single value, * an array of values, or a multi-dimensional array with fields as * keys and orders ('ASC' or 'DESC') as values. Accepted values are: * - 'ID' * - 'display_name' (or 'name') * - 'include' * - 'user_login' (or 'login') * - 'login__in' * - 'user_nicename' (or 'nicename') * - 'nicename__in' * - 'user_email' (or 'email') * - 'user_url' (or 'url') * - 'user_registered' (or 'registered') * - 'post_count' * - 'meta_value' * - 'meta_value_num' * - The value of `$meta_key` * - An array key of `$meta_query` * To use 'meta_value' or 'meta_value_num', `$meta_key` * must be also be defined. Default 'user_login'. * @type string $order Designates ascending or descending order of users. Order values * passed as part of an `$orderby` array take precedence over this * parameter. Accepts 'ASC', 'DESC'. Default 'ASC'. * @type int $offset Number of users to offset in retrieved results. Can be used in * conjunction with pagination. Default 0. * @type int $number Number of users to limit the query for. Can be used in * conjunction with pagination. Value -1 (all) is supported, but * should be used with caution on larger sites. * Default -1 (all users). * @type int $paged When used with number, defines the page of results to return. * Default 1. * @type bool $count_total Whether to count the total number of users found. If pagination * is not needed, setting this to false can improve performance. * Default true. * @type string|string[] $fields Which fields to return. Single or all fields (string), or array * of fields. Accepts: * - 'ID' * - 'display_name' * - 'user_login' * - 'user_nicename' * - 'user_email' * - 'user_url' * - 'user_registered' * - 'user_pass' * - 'user_activation_key' * - 'user_status' * - 'spam' (only available on multisite installs) * - 'deleted' (only available on multisite installs) * - 'all' for all fields and loads user meta. * - 'all_with_meta' Deprecated. Use 'all'. * Default 'all'. * @type string $who Deprecated, use `$capability` instead. * Type of users to query. Accepts 'authors'. * Default empty (all users). * @type bool|string[] $has_published_posts Pass an array of post types to filter results to users who have * published posts in those post types. `true` is an alias for all * public post types. * @type string $nicename The user nicename. Default empty. * @type string[] $nicename__in An array of nicenames to include. Users matching one of these * nicenames will be included in results. Default empty array. * @type string[] $nicename__not_in An array of nicenames to exclude. Users matching one of these * nicenames will not be included in results. Default empty array. * @type string $login The user login. Default empty. * @type string[] $login__in An array of logins to include. Users matching one of these * logins will be included in results. Default empty array. * @type string[] $login__not_in An array of logins to exclude. Users matching one of these * logins will not be included in results. Default empty array. * @type bool $cache_results Whether to cache user information. Default true. * } */ public function prepare_query( $query = array() ) { global $wpdb, $wp_roles; if ( empty( $this->query_vars ) || ! empty( $query ) ) { $this->query_limit = null; $this->query_vars = $this->fill_query_vars( $query ); } /** * Fires before the WP_User_Query has been parsed. * * The passed WP_User_Query object contains the query variables, * not yet passed into SQL. * * @since 4.0.0 * * @param WP_User_Query $query Current instance of WP_User_Query (passed by reference). */ do_action_ref_array( 'pre_get_users', array( &$this ) ); // Ensure that query vars are filled after 'pre_get_users'. $qv =& $this->query_vars; $qv = $this->fill_query_vars( $qv ); $allowed_fields = array( 'id', 'user_login', 'user_pass', 'user_nicename', 'user_email', 'user_url', 'user_registered', 'user_activation_key', 'user_status', 'display_name', ); if ( is_multisite() ) { $allowed_fields[] = 'spam'; $allowed_fields[] = 'deleted'; } if ( is_array( $qv['fields'] ) ) { $qv['fields'] = array_map( 'strtolower', $qv['fields'] ); $qv['fields'] = array_intersect( array_unique( $qv['fields'] ), $allowed_fields ); if ( empty( $qv['fields'] ) ) { $qv['fields'] = array( 'id' ); } $this->query_fields = array(); foreach ( $qv['fields'] as $field ) { $field = 'id' === $field ? 'ID' : sanitize_key( $field ); $this->query_fields[] = "$wpdb->users.$field"; } $this->query_fields = implode( ',', $this->query_fields ); } elseif ( 'all_with_meta' === $qv['fields'] || 'all' === $qv['fields'] || ! in_array( $qv['fields'], $allowed_fields, true ) ) { $this->query_fields = "$wpdb->users.ID"; } else { $field = 'id' === strtolower( $qv['fields'] ) ? 'ID' : sanitize_key( $qv['fields'] ); $this->query_fields = "$wpdb->users.$field"; } if ( isset( $qv['count_total'] ) && $qv['count_total'] ) { $this->query_fields = 'SQL_CALC_FOUND_ROWS ' . $this->query_fields; } $this->query_from = "FROM $wpdb->users"; $this->query_where = 'WHERE 1=1'; // Parse and sanitize 'include', for use by 'orderby' as well as 'include' below. if ( ! empty( $qv['include'] ) ) { $include = wp_parse_id_list( $qv['include'] ); } else { $include = false; } $blog_id = 0; if ( isset( $qv['blog_id'] ) ) { $blog_id = absint( $qv['blog_id'] ); } if ( $qv['has_published_posts'] && $blog_id ) { if ( true === $qv['has_published_posts'] ) { $post_types = get_post_types( array( 'public' => true ) ); } else { $post_types = (array) $qv['has_published_posts']; } foreach ( $post_types as &$post_type ) { $post_type = $wpdb->prepare( '%s', $post_type ); } $posts_table = $wpdb->get_blog_prefix( $blog_id ) . 'posts'; $this->query_where .= " AND $wpdb->users.ID IN ( SELECT DISTINCT $posts_table.post_author FROM $posts_table WHERE $posts_table.post_status = 'publish' AND $posts_table.post_type IN ( " . implode( ', ', $post_types ) . ' ) )'; } // nicename if ( '' !== $qv['nicename'] ) { $this->query_where .= $wpdb->prepare( ' AND user_nicename = %s', $qv['nicename'] ); } if ( ! empty( $qv['nicename__in'] ) ) { $sanitized_nicename__in = array_map( 'esc_sql', $qv['nicename__in'] ); $nicename__in = implode( "','", $sanitized_nicename__in ); $this->query_where .= " AND user_nicename IN ( '$nicename__in' )"; } if ( ! empty( $qv['nicename__not_in'] ) ) { $sanitized_nicename__not_in = array_map( 'esc_sql', $qv['nicename__not_in'] ); $nicename__not_in = implode( "','", $sanitized_nicename__not_in ); $this->query_where .= " AND user_nicename NOT IN ( '$nicename__not_in' )"; } // login if ( '' !== $qv['login'] ) { $this->query_where .= $wpdb->prepare( ' AND user_login = %s', $qv['login'] ); } if ( ! empty( $qv['login__in'] ) ) { $sanitized_login__in = array_map( 'esc_sql', $qv['login__in'] ); $login__in = implode( "','", $sanitized_login__in ); $this->query_where .= " AND user_login IN ( '$login__in' )"; } if ( ! empty( $qv['login__not_in'] ) ) { $sanitized_login__not_in = array_map( 'esc_sql', $qv['login__not_in'] ); $login__not_in = implode( "','", $sanitized_login__not_in ); $this->query_where .= " AND user_login NOT IN ( '$login__not_in' )"; } // Meta query. $this->meta_query = new WP_Meta_Query(); $this->meta_query->parse_query_vars( $qv ); if ( isset( $qv['who'] ) && 'authors' === $qv['who'] && $blog_id ) { _deprecated_argument( 'WP_User_Query', '5.9.0', sprintf( /* translators: 1: who, 2: capability */ __( '%1$s is deprecated. Use %2$s instead.' ), '<code>who</code>', '<code>capability</code>' ) ); $who_query = array( 'key' => $wpdb->get_blog_prefix( $blog_id ) . 'user_level', 'value' => 0, 'compare' => '!=', ); // Prevent extra meta query. $qv['blog_id'] = 0; $blog_id = 0; if ( empty( $this->meta_query->queries ) ) { $this->meta_query->queries = array( $who_query ); } else { // Append the cap query to the original queries and reparse the query. $this->meta_query->queries = array( 'relation' => 'AND', array( $this->meta_query->queries, $who_query ), ); } $this->meta_query->parse_query_vars( $this->meta_query->queries ); } // Roles. $roles = array(); if ( isset( $qv['role'] ) ) { if ( is_array( $qv['role'] ) ) { $roles = $qv['role']; } elseif ( is_string( $qv['role'] ) && ! empty( $qv['role'] ) ) { $roles = array_map( 'trim', explode( ',', $qv['role'] ) ); } } $role__in = array(); if ( isset( $qv['role__in'] ) ) { $role__in = (array) $qv['role__in']; } $role__not_in = array(); if ( isset( $qv['role__not_in'] ) ) { $role__not_in = (array) $qv['role__not_in']; } // Capabilities. $available_roles = array(); if ( ! empty( $qv['capability'] ) || ! empty( $qv['capability__in'] ) || ! empty( $qv['capability__not_in'] ) ) { $wp_roles->for_site( $blog_id ); $available_roles = $wp_roles->roles; } $capabilities = array(); if ( ! empty( $qv['capability'] ) ) { if ( is_array( $qv['capability'] ) ) { $capabilities = $qv['capability']; } elseif ( is_string( $qv['capability'] ) ) { $capabilities = array_map( 'trim', explode( ',', $qv['capability'] ) ); } } $capability__in = array(); if ( ! empty( $qv['capability__in'] ) ) { $capability__in = (array) $qv['capability__in']; } $capability__not_in = array(); if ( ! empty( $qv['capability__not_in'] ) ) { $capability__not_in = (array) $qv['capability__not_in']; } // Keep track of all capabilities and the roles they're added on. $caps_with_roles = array(); foreach ( $available_roles as $role => $role_data ) { $role_caps = array_keys( array_filter( $role_data['capabilities'] ) ); foreach ( $capabilities as $cap ) { if ( in_array( $cap, $role_caps, true ) ) { $caps_with_roles[ $cap ][] = $role; break; } } foreach ( $capability__in as $cap ) { if ( in_array( $cap, $role_caps, true ) ) { $role__in[] = $role; break; } } foreach ( $capability__not_in as $cap ) { if ( in_array( $cap, $role_caps, true ) ) { $role__not_in[] = $role; break; } } } $role__in = array_merge( $role__in, $capability__in ); $role__not_in = array_merge( $role__not_in, $capability__not_in ); $roles = array_unique( $roles ); $role__in = array_unique( $role__in ); $role__not_in = array_unique( $role__not_in ); // Support querying by capabilities added directly to users. if ( $blog_id && ! empty( $capabilities ) ) { $capabilities_clauses = array( 'relation' => 'AND' ); foreach ( $capabilities as $cap ) { $clause = array( 'relation' => 'OR' ); $clause[] = array( 'key' => $wpdb->get_blog_prefix( $blog_id ) . 'capabilities', 'value' => '"' . $cap . '"', 'compare' => 'LIKE', ); if ( ! empty( $caps_with_roles[ $cap ] ) ) { foreach ( $caps_with_roles[ $cap ] as $role ) { $clause[] = array( 'key' => $wpdb->get_blog_prefix( $blog_id ) . 'capabilities', 'value' => '"' . $role . '"', 'compare' => 'LIKE', ); } } $capabilities_clauses[] = $clause; } $role_queries[] = $capabilities_clauses; if ( empty( $this->meta_query->queries ) ) { $this->meta_query->queries[] = $capabilities_clauses; } else { // Append the cap query to the original queries and reparse the query. $this->meta_query->queries = array( 'relation' => 'AND', array( $this->meta_query->queries, array( $capabilities_clauses ) ), ); } $this->meta_query->parse_query_vars( $this->meta_query->queries ); } if ( $blog_id && ( ! empty( $roles ) || ! empty( $role__in ) || ! empty( $role__not_in ) || is_multisite() ) ) { $role_queries = array(); $roles_clauses = array( 'relation' => 'AND' ); if ( ! empty( $roles ) ) { foreach ( $roles as $role ) { $roles_clauses[] = array( 'key' => $wpdb->get_blog_prefix( $blog_id ) . 'capabilities', 'value' => '"' . $role . '"', 'compare' => 'LIKE', ); } $role_queries[] = $roles_clauses; } $role__in_clauses = array( 'relation' => 'OR' ); if ( ! empty( $role__in ) ) { foreach ( $role__in as $role ) { $role__in_clauses[] = array( 'key' => $wpdb->get_blog_prefix( $blog_id ) . 'capabilities', 'value' => '"' . $role . '"', 'compare' => 'LIKE', ); } $role_queries[] = $role__in_clauses; } $role__not_in_clauses = array( 'relation' => 'AND' ); if ( ! empty( $role__not_in ) ) { foreach ( $role__not_in as $role ) { $role__not_in_clauses[] = array( 'key' => $wpdb->get_blog_prefix( $blog_id ) . 'capabilities', 'value' => '"' . $role . '"', 'compare' => 'NOT LIKE', ); } $role_queries[] = $role__not_in_clauses; } // If there are no specific roles named, make sure the user is a member of the site. if ( empty( $role_queries ) ) { $role_queries[] = array( 'key' => $wpdb->get_blog_prefix( $blog_id ) . 'capabilities', 'compare' => 'EXISTS', ); } // Specify that role queries should be joined with AND. $role_queries['relation'] = 'AND'; if ( empty( $this->meta_query->queries ) ) { $this->meta_query->queries = $role_queries; } else { // Append the cap query to the original queries and reparse the query. $this->meta_query->queries = array( 'relation' => 'AND', array( $this->meta_query->queries, $role_queries ), ); } $this->meta_query->parse_query_vars( $this->meta_query->queries ); } if ( ! empty( $this->meta_query->queries ) ) { $clauses = $this->meta_query->get_sql( 'user', $wpdb->users, 'ID', $this ); $this->query_from .= $clauses['join']; $this->query_where .= $clauses['where']; if ( $this->meta_query->has_or_relation() ) { $this->query_fields = 'DISTINCT ' . $this->query_fields; } } // Sorting. $qv['order'] = isset( $qv['order'] ) ? strtoupper( $qv['order'] ) : ''; $order = $this->parse_order( $qv['order'] ); if ( empty( $qv['orderby'] ) ) { // Default order is by 'user_login'. $ordersby = array( 'user_login' => $order ); } elseif ( is_array( $qv['orderby'] ) ) { $ordersby = $qv['orderby']; } else { // 'orderby' values may be a comma- or space-separated list. $ordersby = preg_split( '/[,\s]+/', $qv['orderby'] ); } $orderby_array = array(); foreach ( $ordersby as $_key => $_value ) { if ( ! $_value ) { continue; } if ( is_int( $_key ) ) { // Integer key means this is a flat array of 'orderby' fields. $_orderby = $_value; $_order = $order; } else { // Non-integer key means this the key is the field and the value is ASC/DESC. $_orderby = $_key; $_order = $_value; } $parsed = $this->parse_orderby( $_orderby ); if ( ! $parsed ) { continue; } if ( 'nicename__in' === $_orderby || 'login__in' === $_orderby ) { $orderby_array[] = $parsed; } else { $orderby_array[] = $parsed . ' ' . $this->parse_order( $_order ); } } // If no valid clauses were found, order by user_login. if ( empty( $orderby_array ) ) { $orderby_array[] = "user_login $order"; } $this->query_orderby = 'ORDER BY ' . implode( ', ', $orderby_array ); // Limit. if ( isset( $qv['number'] ) && $qv['number'] > 0 ) { if ( $qv['offset'] ) { $this->query_limit = $wpdb->prepare( 'LIMIT %d, %d', $qv['offset'], $qv['number'] ); } else { $this->query_limit = $wpdb->prepare( 'LIMIT %d, %d', $qv['number'] * ( $qv['paged'] - 1 ), $qv['number'] ); } } $search = ''; if ( isset( $qv['search'] ) ) { $search = trim( $qv['search'] ); } if ( $search ) { $leading_wild = ( ltrim( $search, '*' ) !== $search ); $trailing_wild = ( rtrim( $search, '*' ) !== $search ); if ( $leading_wild && $trailing_wild ) { $wild = 'both'; } elseif ( $leading_wild ) { $wild = 'leading'; } elseif ( $trailing_wild ) { $wild = 'trailing'; } else { $wild = false; } if ( $wild ) { $search = trim( $search, '*' ); } $search_columns = array(); if ( $qv['search_columns'] ) { $search_columns = array_intersect( $qv['search_columns'], array( 'ID', 'user_login', 'user_email', 'user_url', 'user_nicename', 'display_name' ) ); } if ( ! $search_columns ) { if ( str_contains( $search, '@' ) ) { $search_columns = array( 'user_email' ); } elseif ( is_numeric( $search ) ) { $search_columns = array( 'user_login', 'ID' ); } elseif ( preg_match( '|^https?://|', $search ) && ! ( is_multisite() && wp_is_large_network( 'users' ) ) ) { $search_columns = array( 'user_url' ); } else { $search_columns = array( 'user_login', 'user_url', 'user_email', 'user_nicename', 'display_name' ); } } /** * Filters the columns to search in a WP_User_Query search. * * The default columns depend on the search term, and include 'ID', 'user_login', * 'user_email', 'user_url', 'user_nicename', and 'display_name'. * * @since 3.6.0 * * @param string[] $search_columns Array of column names to be searched. * @param string $search Text being searched. * @param WP_User_Query $query The current WP_User_Query instance. */ $search_columns = apply_filters( 'user_search_columns', $search_columns, $search, $this ); $this->query_where .= $this->get_search_sql( $search, $search_columns, $wild ); } if ( ! empty( $include ) ) { // Sanitized earlier. $ids = implode( ',', $include ); $this->query_where .= " AND $wpdb->users.ID IN ($ids)"; } elseif ( ! empty( $qv['exclude'] ) ) { $ids = implode( ',', wp_parse_id_list( $qv['exclude'] ) ); $this->query_where .= " AND $wpdb->users.ID NOT IN ($ids)"; } // Date queries are allowed for the user_registered field. if ( ! empty( $qv['date_query'] ) && is_array( $qv['date_query'] ) ) { $date_query = new WP_Date_Query( $qv['date_query'], 'user_registered' ); $this->query_where .= $date_query->get_sql(); } /** * Fires after the WP_User_Query has been parsed, and before * the query is executed. * * The passed WP_User_Query object contains SQL parts formed * from parsing the given query. * * @since 3.1.0 * * @param WP_User_Query $query Current instance of WP_User_Query (passed by reference). */ do_action_ref_array( 'pre_user_query', array( &$this ) ); } /** * Executes the query, with the current variables. * * @since 3.1.0 * * @global wpdb $wpdb WordPress database abstraction object. */ public function query() { global $wpdb; if ( ! did_action( 'plugins_loaded' ) ) { _doing_it_wrong( 'WP_User_Query::query', sprintf( /* translators: %s: plugins_loaded */ __( 'User queries should not be run before the %s hook.' ), '<code>plugins_loaded</code>' ), '6.1.1' ); } $qv =& $this->query_vars; // Do not cache results if more than 3 fields are requested. if ( is_array( $qv['fields'] ) && count( $qv['fields'] ) > 3 ) { $qv['cache_results'] = false; } /** * Filters the users array before the query takes place. * * Return a non-null value to bypass WordPress' default user queries. * * Filtering functions that require pagination information are encouraged to set * the `total_users` property of the WP_User_Query object, passed to the filter * by reference. If WP_User_Query does not perform a database query, it will not * have enough information to generate these values itself. * * @since 5.1.0 * * @param array|null $results Return an array of user data to short-circuit WP's user query * or null to allow WP to run its normal queries. * @param WP_User_Query $query The WP_User_Query instance (passed by reference). */ $this->results = apply_filters_ref_array( 'users_pre_query', array( null, &$this ) ); if ( null === $this->results ) { // Beginning of the string is on a new line to prevent leading whitespace. See https://core.trac.wordpress.org/ticket/56841. $this->request = "SELECT {$this->query_fields} {$this->query_from} {$this->query_where} {$this->query_orderby} {$this->query_limit}"; $cache_value = false; $cache_key = $this->generate_cache_key( $qv, $this->request ); $cache_group = 'user-queries'; $last_changed = $this->get_cache_last_changed( $qv ); if ( $qv['cache_results'] ) { $cache_value = wp_cache_get_salted( $cache_key, $cache_group, $last_changed ); } if ( false !== $cache_value ) { $this->results = $cache_value['user_data']; $this->total_users = $cache_value['total_users']; } else { if ( is_array( $qv['fields'] ) ) { $this->results = $wpdb->get_results( $this->request ); } else { $this->results = $wpdb->get_col( $this->request ); } if ( isset( $qv['count_total'] ) && $qv['count_total'] ) { /** * Filters SELECT FOUND_ROWS() query for the current WP_User_Query instance. * * @since 3.2.0 * @since 5.1.0 Added the `$this` parameter. * * @global wpdb $wpdb WordPress database abstraction object. * * @param string $sql The SELECT FOUND_ROWS() query for the current WP_User_Query. * @param WP_User_Query $query The current WP_User_Query instance. */ $found_users_query = apply_filters( 'found_users_query', 'SELECT FOUND_ROWS()', $this ); $this->total_users = (int) $wpdb->get_var( $found_users_query ); } if ( $qv['cache_results'] ) { $cache_value = array( 'user_data' => $this->results, 'total_users' => $this->total_users, ); wp_cache_set_salted( $cache_key, $cache_value, $cache_group, $last_changed ); } } } if ( ! $this->results ) { return; } if ( is_array( $qv['fields'] ) && isset( $this->results[0]->ID ) ) { foreach ( $this->results as $result ) { $result->id = $result->ID; } } elseif ( 'all_with_meta' === $qv['fields'] || 'all' === $qv['fields'] ) { if ( function_exists( 'cache_users' ) ) { cache_users( $this->results ); } $r = array(); foreach ( $this->results as $userid ) { if ( 'all_with_meta' === $qv['fields'] ) { $r[ $userid ] = new WP_User( $userid, '', $qv['blog_id'] ); } else { $r[] = new WP_User( $userid, '', $qv['blog_id'] ); } } $this->results = $r; } } /** * Retrieves query variable. * * @since 3.5.0 * * @param string $query_var Query variable key. * @return mixed */ public function get( $query_var ) { if ( isset( $this->query_vars[ $query_var ] ) ) { return $this->query_vars[ $query_var ]; } return null; } /** * Sets query variable. * * @since 3.5.0 * * @param string $query_var Query variable key. * @param mixed $value Query variable value. */ public function set( $query_var, $value ) { $this->query_vars[ $query_var ] = $value; } /** * Used internally to generate an SQL string for searching across multiple columns. * * @since 3.1.0 * * @global wpdb $wpdb WordPress database abstraction object. * * @param string $search Search string. * @param string[] $columns Array of columns to search. * @param bool $wild Whether to allow wildcard searches. Default is false for Network Admin, true for single site. * Single site allows leading and trailing wildcards, Network Admin only trailing. * @return string */ protected function get_search_sql( $search, $columns, $wild = false ) { global $wpdb; $searches = array(); $leading_wild = ( 'leading' === $wild || 'both' === $wild ) ? '%' : ''; $trailing_wild = ( 'trailing' === $wild || 'both' === $wild ) ? '%' : ''; $like = $leading_wild . $wpdb->esc_like( $search ) . $trailing_wild; foreach ( $columns as $column ) { if ( 'ID' === $column ) { $searches[] = $wpdb->prepare( "$column = %s", $search ); } else { $searches[] = $wpdb->prepare( "$column LIKE %s", $like ); } } return ' AND (' . implode( ' OR ', $searches ) . ')'; } /** * Returns the list of users. * * @since 3.1.0 * * @return array Array of results. */ public function get_results() { return $this->results; } /** * Returns the total number of users for the current query. * * @since 3.1.0 * * @return int Number of total users. */ public function get_total() { return $this->total_users; } /** * Parses and sanitizes 'orderby' keys passed to the user query. * * @since 4.2.0 * * @global wpdb $wpdb WordPress database abstraction object. * * @param string $orderby Alias for the field to order by. * @return string Value to used in the ORDER clause, if `$orderby` is valid. */ protected function parse_orderby( $orderby ) { global $wpdb; $meta_query_clauses = $this->meta_query->get_clauses(); $_orderby = ''; if ( in_array( $orderby, array( 'login', 'nicename', 'email', 'url', 'registered' ), true ) ) { $_orderby = 'user_' . $orderby; } elseif ( in_array( $orderby, array( 'user_login', 'user_nicename', 'user_email', 'user_url', 'user_registered' ), true ) ) { $_orderby = $orderby; } elseif ( 'name' === $orderby || 'display_name' === $orderby ) { $_orderby = 'display_name'; } elseif ( 'post_count' === $orderby ) { // @todo Avoid the JOIN. $where = get_posts_by_author_sql( 'post' ); $this->query_from .= " LEFT OUTER JOIN ( SELECT post_author, COUNT(*) as post_count FROM $wpdb->posts $where GROUP BY post_author ) p ON ({$wpdb->users}.ID = p.post_author)"; $_orderby = 'post_count'; } elseif ( 'ID' === $orderby || 'id' === $orderby ) { $_orderby = 'ID'; } elseif ( 'meta_value' === $orderby || $this->get( 'meta_key' ) === $orderby ) { $_orderby = "$wpdb->usermeta.meta_value"; } elseif ( 'meta_value_num' === $orderby ) { $_orderby = "$wpdb->usermeta.meta_value+0"; } elseif ( 'include' === $orderby && ! empty( $this->query_vars['include'] ) ) { $include = wp_parse_id_list( $this->query_vars['include'] ); $include_sql = implode( ',', $include ); $_orderby = "FIELD( $wpdb->users.ID, $include_sql )"; } elseif ( 'nicename__in' === $orderby ) { $sanitized_nicename__in = array_map( 'esc_sql', $this->query_vars['nicename__in'] ); $nicename__in = implode( "','", $sanitized_nicename__in ); $_orderby = "FIELD( user_nicename, '$nicename__in' )"; } elseif ( 'login__in' === $orderby ) { $sanitized_login__in = array_map( 'esc_sql', $this->query_vars['login__in'] ); $login__in = implode( "','", $sanitized_login__in ); $_orderby = "FIELD( user_login, '$login__in' )"; } elseif ( isset( $meta_query_clauses[ $orderby ] ) ) { $meta_clause = $meta_query_clauses[ $orderby ]; $_orderby = sprintf( 'CAST(%s.meta_value AS %s)', esc_sql( $meta_clause['alias'] ), esc_sql( $meta_clause['cast'] ) ); } return $_orderby; } /** * Generate cache key. * * @since 6.3.0 * @since 6.9.0 The `$args` parameter was deprecated and renamed to `$deprecated`. * * @global wpdb $wpdb WordPress database abstraction object. * * @param array $deprecated Unused. * @param string $sql SQL statement. * @return string Cache key. */ protected function generate_cache_key( array $deprecated, $sql ) { global $wpdb; // Replace wpdb placeholder in the SQL statement used by the cache key. $sql = $wpdb->remove_placeholder_escape( $sql ); $key = md5( $sql ); return "get_users:$key"; } /** * Retrieves the last changed cache timestamp for users and optionally posts. * * @since 6.9.0 * * @param array $args Query arguments. * @return string[] The last changed timestamp string for the relevant cache groups. */ protected function get_cache_last_changed( array $args ) { $last_changed = (array) wp_cache_get_last_changed( 'users' ); if ( empty( $args['orderby'] ) ) { // Default order is by 'user_login'. $ordersby = array( 'user_login' => '' ); } elseif ( is_array( $args['orderby'] ) ) { $ordersby = $args['orderby']; } else { // 'orderby' values may be a comma- or space-separated list. $ordersby = preg_split( '/[,\s]+/', $args['orderby'] ); } $blog_id = 0; if ( isset( $args['blog_id'] ) ) { $blog_id = absint( $args['blog_id'] ); } if ( $args['has_published_posts'] || in_array( 'post_count', $ordersby, true ) ) { $switch = $blog_id && get_current_blog_id() !== $blog_id; if ( $switch ) { switch_to_blog( $blog_id ); } $last_changed[] = wp_cache_get_last_changed( 'posts' ); if ( $switch ) { restore_current_blog(); } } return $last_changed; } /** * Parses an 'order' query variable and casts it to ASC or DESC as necessary. * * @since 4.2.0 * * @param string $order The 'order' query variable. * @return string The sanitized 'order' query variable. */ protected function parse_order( $order ) { if ( ! is_string( $order ) || empty( $order ) ) { return 'DESC'; } if ( 'ASC' === strtoupper( $order ) ) { return 'ASC'; } else { return 'DESC'; } } /** * Makes private properties readable for backward compatibility. * * @since 4.0.0 * @since 6.4.0 Getting a dynamic property is deprecated. * * @param string $name Property to get. * @return mixed Property. */ public function __get( $name ) { if ( in_array( $name, $this->compat_fields, true ) ) { return $this->$name; } wp_trigger_error( __METHOD__, "The property `{$name}` is not declared. Getting a dynamic property is " . 'deprecated since version 6.4.0! Instead, declare the property on the class.', E_USER_DEPRECATED ); return null; } /** * Makes private properties settable for backward compatibility. * * @since 4.0.0 * @since 6.4.0 Setting a dynamic property is deprecated. * * @param string $name Property to check if set. * @param mixed $value Property value. */ public function __set( $name, $value ) { if ( in_array( $name, $this->compat_fields, true ) ) { $this->$name = $value; return; } wp_trigger_error( __METHOD__, "The property `{$name}` is not declared. Setting a dynamic property is " . 'deprecated since version 6.4.0! Instead, declare the property on the class.', E_USER_DEPRECATED ); } /** * Makes private properties checkable for backward compatibility. * * @since 4.0.0 * @since 6.4.0 Checking a dynamic property is deprecated. * * @param string $name Property to check if set. * @return bool Whether the property is set. */ public function __isset( $name ) { if ( in_array( $name, $this->compat_fields, true ) ) { return isset( $this->$name ); } wp_trigger_error( __METHOD__, "The property `{$name}` is not declared. Checking `isset()` on a dynamic property " . 'is deprecated since version 6.4.0! Instead, declare the property on the class.', E_USER_DEPRECATED ); return false; } /** * Makes private properties un-settable for backward compatibility. * * @since 4.0.0 * @since 6.4.0 Unsetting a dynamic property is deprecated. * * @param string $name Property to unset. */ public function __unset( $name ) { if ( in_array( $name, $this->compat_fields, true ) ) { unset( $this->$name ); return; } wp_trigger_error( __METHOD__, "A property `{$name}` is not declared. Unsetting a dynamic property is " . 'deprecated since version 6.4.0! Instead, declare the property on the class.', E_USER_DEPRECATED ); } /** * Makes private/protected methods readable for backward compatibility. * * @since 4.0.0 * * @param string $name Method to call. * @param array $arguments Arguments to pass when calling. * @return mixed Return value of the callback, false otherwise. */ public function __call( $name, $arguments ) { if ( 'get_search_sql' === $name ) { return $this->get_search_sql( ...$arguments ); } return false; } } https-migration-20260605111908.php 0000666 00000011205 15226557730 0012013 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } abilities-api.php 0000666 00000057461 15226557730 0010026 0 ustar 00 <?php /** * Abilities API: core functions for registering and managing abilities. * * The Abilities API provides a unified, extensible framework for registering * and executing discrete capabilities within WordPress. An "ability" is a * self-contained unit of functionality with defined inputs, outputs, permissions, * and execution logic. * * ## Overview * * The Abilities API enables developers to: * * - Register custom abilities with standardized interfaces. * - Define permission checks and execution callbacks. * - Organize abilities into logical categories. * - Validate inputs and outputs using JSON Schema. * - Expose abilities through the REST API. * * ## Working with Abilities * * Abilities must be registered on the `wp_abilities_api_init` action hook. * Attempting to register an ability outside of this hook will fail and * trigger a `_doing_it_wrong()` notice. * Example: * * function my_plugin_register_abilities(): void { * wp_register_ability( * 'my-plugin/export-users', * array( * 'label' => __( 'Export Users', 'my-plugin' ), * 'description' => __( 'Exports user data to CSV format.', 'my-plugin' ), * 'category' => 'data-export', * 'execute_callback' => 'my_plugin_export_users', * 'permission_callback' => function(): bool { * return current_user_can( 'export' ); * }, * 'input_schema' => array( * 'type' => 'string', * 'enum' => array( 'subscriber', 'contributor', 'author', 'editor', 'administrator' ), * 'description' => __( 'Limits the export to users with this role.', 'my-plugin' ), * 'required' => false, * ), * 'output_schema' => array( * 'type' => 'string', * 'description' => __( 'User data in CSV format.', 'my-plugin' ), * 'required' => true, * ), * 'meta' => array( * 'show_in_rest' => true, * ), * ) * ); * } * add_action( 'wp_abilities_api_init', 'my_plugin_register_abilities' ); * * Once registered, abilities can be checked, retrieved, and managed: * * // Checks if an ability is registered, and prints its label. * if ( wp_has_ability( 'my-plugin/export-users' ) ) { * $ability = wp_get_ability( 'my-plugin/export-users' ); * * echo $ability->get_label(); * } * * // Gets all registered abilities. * $all_abilities = wp_get_abilities(); * * // Unregisters when no longer needed. * wp_unregister_ability( 'my-plugin/export-users' ); * * ## Best Practices * * - Always register abilities on the `wp_abilities_api_init` hook. * - Use namespaced ability names to prevent conflicts. * - Implement robust permission checks in permission callbacks. * - Provide an `input_schema` to ensure data integrity and document expected inputs. * - Define an `output_schema` to describe return values and validate responses. * - Return `WP_Error` objects for failures rather than throwing exceptions. * - Use internationalization functions for all user-facing strings. * * @package WordPress * @subpackage Abilities_API * @since 6.9.0 */ declare( strict_types = 1 ); /** * Registers a new ability using the Abilities API. It requires three steps: * * 1. Hook into the `wp_abilities_api_init` action. * 2. Call `wp_register_ability()` with a namespaced name and configuration. * 3. Provide execute and permission callbacks. * * Example: * * function my_plugin_register_abilities(): void { * wp_register_ability( * 'my-plugin/analyze-text', * array( * 'label' => __( 'Analyze Text', 'my-plugin' ), * 'description' => __( 'Performs sentiment analysis on provided text.', 'my-plugin' ), * 'category' => 'text-processing', * 'input_schema' => array( * 'type' => 'string', * 'description' => __( 'The text to be analyzed.', 'my-plugin' ), * 'minLength' => 10, * 'required' => true, * ), * 'output_schema' => array( * 'type' => 'string', * 'enum' => array( 'positive', 'negative', 'neutral' ), * 'description' => __( 'The sentiment result: positive, negative, or neutral.', 'my-plugin' ), * 'required' => true, * ), * 'execute_callback' => 'my_plugin_analyze_text', * 'permission_callback' => 'my_plugin_can_analyze_text', * 'meta' => array( * 'annotations' => array( * 'readonly' => true, * ), * 'show_in_rest' => true, * ), * ) * ); * } * add_action( 'wp_abilities_api_init', 'my_plugin_register_abilities' ); * * ### Naming Conventions * * Ability names must follow these rules: * * - Include a namespace prefix (e.g., `my-plugin/my-ability`). * - Use only lowercase alphanumeric characters, dashes, and forward slashes. * - Use descriptive, action-oriented names (e.g., `process-payment`, `generate-report`). * * ### Categories * * Abilities must be organized into categories. Ability categories provide better * discoverability and must be registered before the abilities that reference them: * * function my_plugin_register_categories(): void { * wp_register_ability_category( * 'text-processing', * array( * 'label' => __( 'Text Processing', 'my-plugin' ), * 'description' => __( 'Abilities for analyzing and transforming text.', 'my-plugin' ), * ) * ); * } * add_action( 'wp_abilities_api_categories_init', 'my_plugin_register_categories' ); * * ### Input and Output Schemas * * Schemas define the expected structure, type, and constraints for ability inputs * and outputs using JSON Schema syntax. They serve two critical purposes: automatic * validation of data passed to and returned from abilities, and self-documenting * API contracts for developers. * * WordPress implements a validator based on a subset of the JSON Schema Version 4 * specification (https://json-schema.org/specification-links.html#draft-4). * For details on supported JSON Schema properties and syntax, see the * related WordPress REST API Schema documentation: * https://developer.wordpress.org/rest-api/extending-the-rest-api/schema/#json-schema-basics * * Defining schemas is mandatory when there is a value to pass or return. * They ensure data integrity, improve developer experience, and enable * better documentation: * * 'input_schema' => array( * 'type' => 'string', * 'description' => __( 'The text to be analyzed.', 'my-plugin' ), * 'minLength' => 10, * 'required' => true, * ), * 'output_schema' => array( * 'type' => 'string', * 'enum' => array( 'positive', 'negative', 'neutral' ), * 'description' => __( 'The sentiment result: positive, negative, or neutral.', 'my-plugin' ), * 'required' => true, * ), * * ### Callbacks * * #### Execute Callback * * The execute callback performs the ability's core functionality. It receives * optional input data and returns either a result or `WP_Error` on failure. * * function my_plugin_analyze_text( string $input ): string|WP_Error { * $score = My_Plugin::perform_sentiment_analysis( $input ); * if ( is_wp_error( $score ) ) { * return $score; * } * return My_Plugin::interpret_sentiment_score( $score ); * } * * #### Permission Callback * * The permission callback determines whether the ability can be executed. * It receives the same input as the execute callback and must return a * boolean or `WP_Error`. Common use cases include checking user capabilities, * validating API keys, or verifying system state: * * function my_plugin_can_analyze_text( string $input ): bool|WP_Error { * return current_user_can( 'edit_posts' ); * } * * ### REST API Integration * * Abilities can be exposed through the REST API by setting `show_in_rest` * to `true` in the meta configuration: * * 'meta' => array( * 'show_in_rest' => true, * ), * * This allows abilities to be invoked via HTTP requests to the WordPress REST API. * * @since 6.9.0 * * @see WP_Abilities_Registry::register() * @see wp_register_ability_category() * @see wp_unregister_ability() * * @param string $name The name of the ability. Must be a namespaced string containing * a prefix, e.g., `my-plugin/my-ability`. Can only contain lowercase * alphanumeric characters, dashes, and forward slashes. * @param array<string, mixed> $args { * An associative array of arguments for configuring the ability. * * @type string $label Required. The human-readable label for the ability. * @type string $description Required. A detailed description of what the ability does * and when it should be used. * @type string $category Required. The ability category slug this ability belongs to. * The ability category must be registered via `wp_register_ability_category()` * before registering the ability. * @type callable $execute_callback Required. A callback function to execute when the ability is invoked. * Receives optional mixed input data and must return either a result * value (any type) or a `WP_Error` object on failure. * @type callable $permission_callback Required. A callback function to check permissions before execution. * Receives optional mixed input data (same as `execute_callback`) and * must return `true`/`false` for simple checks, or `WP_Error` for * detailed error responses. * @type array<string, mixed> $input_schema Optional. JSON Schema definition for validating the ability's input. * Must be a valid JSON Schema object defining the structure and * constraints for input data. Used for automatic validation and * API documentation. * @type array<string, mixed> $output_schema Optional. JSON Schema definition for the ability's output. * Describes the structure of successful return values from * `execute_callback`. Used for documentation and validation. * @type array<string, mixed> $meta { * Optional. Additional metadata for the ability. * * @type array<string, bool|null> $annotations { * Optional. Semantic annotations describing the ability's behavioral characteristics. * These annotations are hints for tooling and documentation. * * @type bool|null $readonly Optional. If true, the ability does not modify its environment. * @type bool|null $destructive Optional. If true, the ability may perform destructive updates to its environment. * If false, the ability performs only additive updates. * @type bool|null $idempotent Optional. If true, calling the ability repeatedly with the same arguments * will have no additional effect on its environment. * } * @type bool $show_in_rest Optional. Whether to expose this ability in the REST API. * When true, the ability can be invoked via HTTP requests. * Default false. * } * @type string $ability_class Optional. Fully-qualified custom class name to instantiate * instead of the default `WP_Ability` class. The custom class * must extend `WP_Ability`. Useful for advanced customization * of ability behavior. * } * @return WP_Ability|null The registered ability instance on success, `null` on failure. */ function wp_register_ability( string $name, array $args ): ?WP_Ability { if ( ! doing_action( 'wp_abilities_api_init' ) ) { _doing_it_wrong( __FUNCTION__, sprintf( /* translators: 1: wp_abilities_api_init, 2: string value of the ability name. */ __( 'Abilities must be registered on the %1$s action. The ability %2$s was not registered.' ), '<code>wp_abilities_api_init</code>', '<code>' . esc_html( $name ) . '</code>' ), '6.9.0' ); return null; } $registry = WP_Abilities_Registry::get_instance(); if ( null === $registry ) { return null; } return $registry->register( $name, $args ); } /** * Unregisters an ability from the Abilities API. * * Removes a previously registered ability from the global registry. Use this to * disable abilities provided by other plugins or when an ability is no longer needed. * * Can be called at any time after the ability has been registered. * * Example: * * if ( wp_has_ability( 'other-plugin/some-ability' ) ) { * wp_unregister_ability( 'other-plugin/some-ability' ); * } * * @since 6.9.0 * * @see WP_Abilities_Registry::unregister() * @see wp_register_ability() * * @param string $name The name of the ability to unregister, including namespace prefix * (e.g., 'my-plugin/my-ability'). * @return WP_Ability|null The unregistered ability instance on success, `null` on failure. */ function wp_unregister_ability( string $name ): ?WP_Ability { $registry = WP_Abilities_Registry::get_instance(); if ( null === $registry ) { return null; } return $registry->unregister( $name ); } /** * Checks if an ability is registered. * * Use this for conditional logic and feature detection before attempting to * retrieve or use an ability. * * Example: * * // Displays different UI based on available abilities. * if ( wp_has_ability( 'premium-plugin/advanced-export' ) ) { * echo 'Export with Premium Features'; * } else { * echo 'Basic Export'; * } * * @since 6.9.0 * * @see WP_Abilities_Registry::is_registered() * @see wp_get_ability() * * @param string $name The name of the ability to check, including namespace prefix * (e.g., 'my-plugin/my-ability'). * @return bool `true` if the ability is registered, `false` otherwise. */ function wp_has_ability( string $name ): bool { $registry = WP_Abilities_Registry::get_instance(); if ( null === $registry ) { return false; } return $registry->is_registered( $name ); } /** * Retrieves a registered ability. * * Returns the ability instance for inspection or use. The instance provides access * to the ability's configuration, metadata, and execution methods. * * Example: * * // Prints information about a registered ability. * $ability = wp_get_ability( 'my-plugin/export-data' ); * if ( $ability ) { * echo $ability->get_label() . ': ' . $ability->get_description(); * } * * @since 6.9.0 * * @see WP_Abilities_Registry::get_registered() * @see wp_has_ability() * * @param string $name The name of the ability, including namespace prefix * (e.g., 'my-plugin/my-ability'). * @return WP_Ability|null The registered ability instance, or `null` if not registered. */ function wp_get_ability( string $name ): ?WP_Ability { $registry = WP_Abilities_Registry::get_instance(); if ( null === $registry ) { return null; } return $registry->get_registered( $name ); } /** * Retrieves all registered abilities. * * Returns an array of all ability instances currently registered in the system. * Use this for discovery, debugging, or building administrative interfaces. * * Example: * * // Prints information about all available abilities. * $abilities = wp_get_abilities(); * foreach ( $abilities as $ability ) { * echo $ability->get_label() . ': ' . $ability->get_description() . "\n"; * } * * @since 6.9.0 * * @see WP_Abilities_Registry::get_all_registered() * * @return WP_Ability[] An array of registered WP_Ability instances. Returns an empty * array if no abilities are registered or if the registry is unavailable. */ function wp_get_abilities(): array { $registry = WP_Abilities_Registry::get_instance(); if ( null === $registry ) { return array(); } return $registry->get_all_registered(); } /** * Registers a new ability category. * * Ability categories provide a way to organize and group related abilities for better * discoverability and management. Ability categories must be registered before abilities * that reference them. * * Ability categories must be registered on the `wp_abilities_api_categories_init` action hook. * * Example: * * function my_plugin_register_categories() { * wp_register_ability_category( * 'content-management', * array( * 'label' => __( 'Content Management', 'my-plugin' ), * 'description' => __( 'Abilities for managing and organizing content.', 'my-plugin' ), * ) * ); * } * add_action( 'wp_abilities_api_categories_init', 'my_plugin_register_categories' ); * * @since 6.9.0 * * @see WP_Ability_Categories_Registry::register() * @see wp_register_ability() * @see wp_unregister_ability_category() * * @param string $slug The unique slug for the ability category. Must contain only lowercase * alphanumeric characters and dashes (e.g., 'data-export'). * @param array<string, mixed> $args { * An associative array of arguments for the ability category. * * @type string $label Required. The human-readable label for the ability category. * @type string $description Required. A description of what abilities in this category do. * @type array<string, mixed> $meta Optional. Additional metadata for the ability category. * } * @return WP_Ability_Category|null The registered ability category instance on success, `null` on failure. */ function wp_register_ability_category( string $slug, array $args ): ?WP_Ability_Category { if ( ! doing_action( 'wp_abilities_api_categories_init' ) ) { _doing_it_wrong( __FUNCTION__, sprintf( /* translators: 1: wp_abilities_api_categories_init, 2: ability category slug. */ __( 'Ability categories must be registered on the %1$s action. The ability category %2$s was not registered.' ), '<code>wp_abilities_api_categories_init</code>', '<code>' . esc_html( $slug ) . '</code>' ), '6.9.0' ); return null; } $registry = WP_Ability_Categories_Registry::get_instance(); if ( null === $registry ) { return null; } return $registry->register( $slug, $args ); } /** * Unregisters an ability category. * * Removes a previously registered ability category from the global registry. Use this to * disable ability categories that are no longer needed. * * Can be called at any time after the ability category has been registered. * * Example: * * if ( wp_has_ability_category( 'deprecated-category' ) ) { * wp_unregister_ability_category( 'deprecated-category' ); * } * * @since 6.9.0 * * @see WP_Ability_Categories_Registry::unregister() * @see wp_register_ability_category() * * @param string $slug The slug of the ability category to unregister. * @return WP_Ability_Category|null The unregistered ability category instance on success, `null` on failure. */ function wp_unregister_ability_category( string $slug ): ?WP_Ability_Category { $registry = WP_Ability_Categories_Registry::get_instance(); if ( null === $registry ) { return null; } return $registry->unregister( $slug ); } /** * Checks if an ability category is registered. * * Use this for conditional logic and feature detection before attempting to * retrieve or use an ability category. * * Example: * * // Displays different UI based on available ability categories. * if ( wp_has_ability_category( 'premium-features' ) ) { * echo 'Premium Features Available'; * } else { * echo 'Standard Features'; * } * * @since 6.9.0 * * @see WP_Ability_Categories_Registry::is_registered() * @see wp_get_ability_category() * * @param string $slug The slug of the ability category to check. * @return bool `true` if the ability category is registered, `false` otherwise. */ function wp_has_ability_category( string $slug ): bool { $registry = WP_Ability_Categories_Registry::get_instance(); if ( null === $registry ) { return false; } return $registry->is_registered( $slug ); } /** * Retrieves a registered ability category. * * Returns the ability category instance for inspection or use. The instance provides access * to the ability category's configuration and metadata. * * Example: * * // Prints information about a registered ability category. * $ability_category = wp_get_ability_category( 'content-management' ); * if ( $ability_category ) { * echo $ability_category->get_label() . ': ' . $ability_category->get_description(); * } * * @since 6.9.0 * * @see WP_Ability_Categories_Registry::get_registered() * @see wp_has_ability_category() * @see wp_get_ability_categories() * * @param string $slug The slug of the ability category. * @return WP_Ability_Category|null The ability category instance, or `null` if not registered. */ function wp_get_ability_category( string $slug ): ?WP_Ability_Category { $registry = WP_Ability_Categories_Registry::get_instance(); if ( null === $registry ) { return null; } return $registry->get_registered( $slug ); } /** * Retrieves all registered ability categories. * * Returns an array of all ability category instances currently registered in the system. * Use this for discovery, debugging, or building administrative interfaces. * * Example: * * // Prints information about all available ability categories. * $ability_categories = wp_get_ability_categories(); * foreach ( $ability_categories as $ability_category ) { * echo $ability_category->get_label() . ': ' . $ability_category->get_description() . "\n"; * } * * @since 6.9.0 * * @see WP_Ability_Categories_Registry::get_all_registered() * @see wp_get_ability_category() * * @return WP_Ability_Category[] An array of registered ability category instances. Returns an empty array * if no ability categories are registered or if the registry is unavailable. */ function wp_get_ability_categories(): array { $registry = WP_Ability_Categories_Registry::get_instance(); if ( null === $registry ) { return array(); } return $registry->get_all_registered(); } https-detection-20260606231123.php 0000666 00000013341 15226557730 0011774 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } speculative-loading.php 0000666 00000020630 15226557730 0011235 0 ustar 00 <?php /** * Speculative loading functions. * * @package WordPress * @subpackage Speculative Loading * @since 6.8.0 */ /** * Returns the speculation rules configuration. * * @since 6.8.0 * * @return array<string, string>|null Associative array with 'mode' and 'eagerness' keys, or null if speculative * loading is disabled. */ function wp_get_speculation_rules_configuration(): ?array { // By default, speculative loading is only enabled for sites with pretty permalinks when no user is logged in. if ( ! is_user_logged_in() && get_option( 'permalink_structure' ) ) { $config = array( 'mode' => 'auto', 'eagerness' => 'auto', ); } else { $config = null; } /** * Filters the way that speculation rules are configured. * * The Speculation Rules API is a web API that allows to automatically prefetch or prerender certain URLs on the * page, which can lead to near-instant page load times. This is also referred to as speculative loading. * * There are two aspects to the configuration: * * The "mode" (whether to "prefetch" or "prerender" URLs). * * The "eagerness" (whether to speculatively load URLs in an "eager", "moderate", or "conservative" way). * * By default, the speculation rules configuration is decided by WordPress Core ("auto"). This filter can be used * to force a certain configuration, which could for instance load URLs more or less eagerly. * * For logged-in users or for sites that are not configured to use pretty permalinks, the default value is `null`, * indicating that speculative loading is entirely disabled. * * @since 6.8.0 * @see https://developer.chrome.com/docs/web-platform/prerender-pages * * @param array<string, string>|null $config Associative array with 'mode' and 'eagerness' keys, or `null`. The * default value for both of the keys is 'auto'. Other possible values * for 'mode' are 'prefetch' and 'prerender'. Other possible values for * 'eagerness' are 'eager', 'moderate', and 'conservative'. The value * `null` is used to disable speculative loading entirely. */ $config = apply_filters( 'wp_speculation_rules_configuration', $config ); // Allow the value `null` to indicate that speculative loading is disabled. if ( null === $config ) { return null; } // Sanitize the configuration and replace 'auto' with current defaults. $default_mode = 'prefetch'; $default_eagerness = 'conservative'; if ( ! is_array( $config ) ) { return array( 'mode' => $default_mode, 'eagerness' => $default_eagerness, ); } if ( ! isset( $config['mode'] ) || 'auto' === $config['mode'] || ! WP_Speculation_Rules::is_valid_mode( $config['mode'] ) ) { $config['mode'] = $default_mode; } if ( ! isset( $config['eagerness'] ) || 'auto' === $config['eagerness'] || ! WP_Speculation_Rules::is_valid_eagerness( $config['eagerness'] ) || // 'immediate' is a valid eagerness, but for safety WordPress does not allow it for document-level rules. 'immediate' === $config['eagerness'] ) { $config['eagerness'] = $default_eagerness; } return array( 'mode' => $config['mode'], 'eagerness' => $config['eagerness'], ); } /** * Returns the full speculation rules data based on the configuration. * * Plugins with features that rely on frontend URLs to exclude from prefetching or prerendering should use the * {@see 'wp_speculation_rules_href_exclude_paths'} filter to ensure those URL patterns are excluded. * * Additional speculation rules other than the default rule from WordPress Core can be provided by using the * {@see 'wp_load_speculation_rules'} action and amending the passed WP_Speculation_Rules object. * * @since 6.8.0 * @access private * * @return WP_Speculation_Rules|null Object representing the speculation rules to use, or null if speculative loading * is disabled in the current context. */ function wp_get_speculation_rules(): ?WP_Speculation_Rules { $configuration = wp_get_speculation_rules_configuration(); if ( null === $configuration ) { return null; } $mode = $configuration['mode']; $eagerness = $configuration['eagerness']; $prefixer = new WP_URL_Pattern_Prefixer(); $base_href_exclude_paths = array( $prefixer->prefix_path_pattern( '/wp-*.php', 'site' ), $prefixer->prefix_path_pattern( '/wp-admin/*', 'site' ), $prefixer->prefix_path_pattern( '/*', 'uploads' ), $prefixer->prefix_path_pattern( '/*', 'content' ), $prefixer->prefix_path_pattern( '/*', 'plugins' ), $prefixer->prefix_path_pattern( '/*', 'template' ), $prefixer->prefix_path_pattern( '/*', 'stylesheet' ), ); /* * If pretty permalinks are enabled, exclude any URLs with query parameters. * Otherwise, exclude specifically the URLs with a `_wpnonce` query parameter or any other query parameter * containing the word `nonce`. */ if ( get_option( 'permalink_structure' ) ) { $base_href_exclude_paths[] = $prefixer->prefix_path_pattern( '/*\\?(.+)', 'home' ); } else { $base_href_exclude_paths[] = $prefixer->prefix_path_pattern( '/*\\?*(^|&)*nonce*=*', 'home' ); } /** * Filters the paths for which speculative loading should be disabled. * * All paths should start in a forward slash, relative to the root document. The `*` can be used as a wildcard. * If the WordPress site is in a subdirectory, the exclude paths will automatically be prefixed as necessary. * * Note that WordPress always excludes certain path patterns such as `/wp-login.php` and `/wp-admin/*`, and those * cannot be modified using the filter. * * @since 6.8.0 * * @param string[] $href_exclude_paths Additional path patterns to disable speculative loading for. * @param string $mode Mode used to apply speculative loading. Either 'prefetch' or 'prerender'. */ $href_exclude_paths = (array) apply_filters( 'wp_speculation_rules_href_exclude_paths', array(), $mode ); // Ensure that: // 1. There are no duplicates. // 2. The base paths cannot be removed. // 3. The array has sequential keys (i.e. array_is_list()). $href_exclude_paths = array_values( array_unique( array_merge( $base_href_exclude_paths, array_map( static function ( string $href_exclude_path ) use ( $prefixer ): string { return $prefixer->prefix_path_pattern( $href_exclude_path ); }, $href_exclude_paths ) ) ) ); $speculation_rules = new WP_Speculation_Rules(); $main_rule_conditions = array( // Include any URLs within the same site. array( 'href_matches' => $prefixer->prefix_path_pattern( '/*' ), ), // Except for excluded paths. array( 'not' => array( 'href_matches' => $href_exclude_paths, ), ), // Also exclude rel=nofollow links, as certain plugins use that on their links that perform an action. array( 'not' => array( 'selector_matches' => 'a[rel~="nofollow"]', ), ), // Also exclude links that are explicitly marked to opt out, either directly or via a parent element. array( 'not' => array( 'selector_matches' => ".no-{$mode}, .no-{$mode} a", ), ), ); // If using 'prerender', also exclude links that opt out of 'prefetch' because it's part of 'prerender'. if ( 'prerender' === $mode ) { $main_rule_conditions[] = array( 'not' => array( 'selector_matches' => '.no-prefetch, .no-prefetch a', ), ); } $speculation_rules->add_rule( $mode, 'main', array( 'source' => 'document', 'where' => array( 'and' => $main_rule_conditions, ), 'eagerness' => $eagerness, ) ); /** * Fires when speculation rules data is loaded, allowing to amend the rules. * * @since 6.8.0 * * @param WP_Speculation_Rules $speculation_rules Object representing the speculation rules to use. */ do_action( 'wp_load_speculation_rules', $speculation_rules ); return $speculation_rules; } /** * Prints the speculation rules. * * For browsers that do not support speculation rules yet, the `script[type="speculationrules"]` tag will be ignored. * * @since 6.8.0 * @access private */ function wp_print_speculation_rules(): void { $speculation_rules = wp_get_speculation_rules(); if ( null === $speculation_rules ) { return; } wp_print_inline_script_tag( (string) wp_json_encode( $speculation_rules, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ), array( 'type' => 'speculationrules' ) ); } https-migration-20260605121148.php 0000666 00000011205 15226557730 0012010 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } class-wp-post.php 0000666 00000014533 15226557730 0010017 0 ustar 00 <?php /** * Post API: WP_Post class * * @package WordPress * @subpackage Post * @since 4.4.0 */ /** * Core class used to implement the WP_Post object. * * @since 3.5.0 * * @property string $page_template * * @property-read int[] $ancestors * @property-read int[] $post_category * @property-read string[] $tags_input */ #[AllowDynamicProperties] final class WP_Post { /** * Post ID. * * @since 3.5.0 * @var int */ public $ID; /** * ID of post author. * * A numeric string, for compatibility reasons. * * @since 3.5.0 * @var string */ public $post_author = '0'; /** * The post's local publication time. * * @since 3.5.0 * @var string */ public $post_date = '0000-00-00 00:00:00'; /** * The post's GMT publication time. * * @since 3.5.0 * @var string */ public $post_date_gmt = '0000-00-00 00:00:00'; /** * The post's content. * * @since 3.5.0 * @var string */ public $post_content = ''; /** * The post's title. * * @since 3.5.0 * @var string */ public $post_title = ''; /** * The post's excerpt. * * @since 3.5.0 * @var string */ public $post_excerpt = ''; /** * The post's status. * * @since 3.5.0 * @var string */ public $post_status = 'publish'; /** * Whether comments are allowed. * * @since 3.5.0 * @var string */ public $comment_status = 'open'; /** * Whether pings are allowed. * * @since 3.5.0 * @var string */ public $ping_status = 'open'; /** * The post's password in plain text. * * @since 3.5.0 * @var string */ public $post_password = ''; /** * The post's slug. * * @since 3.5.0 * @var string */ public $post_name = ''; /** * URLs queued to be pinged. * * @since 3.5.0 * @var string */ public $to_ping = ''; /** * URLs that have been pinged. * * @since 3.5.0 * @var string */ public $pinged = ''; /** * The post's local modified time. * * @since 3.5.0 * @var string */ public $post_modified = '0000-00-00 00:00:00'; /** * The post's GMT modified time. * * @since 3.5.0 * @var string */ public $post_modified_gmt = '0000-00-00 00:00:00'; /** * A utility DB field for post content. * * @since 3.5.0 * @var string */ public $post_content_filtered = ''; /** * ID of a post's parent post. * * @since 3.5.0 * @var int */ public $post_parent = 0; /** * The unique identifier for a post, not necessarily a URL, used as the feed GUID. * * @since 3.5.0 * @var string */ public $guid = ''; /** * A field used for ordering posts. * * @since 3.5.0 * @var int */ public $menu_order = 0; /** * The post's type, like post or page. * * @since 3.5.0 * @var string */ public $post_type = 'post'; /** * An attachment's mime type. * * @since 3.5.0 * @var string */ public $post_mime_type = ''; /** * Cached comment count. * * A numeric string, for compatibility reasons. * * @since 3.5.0 * @var string */ public $comment_count = '0'; /** * Stores the post object's sanitization level. * * Does not correspond to a DB field. * * @since 3.5.0 * @var string */ public $filter; /** * Retrieve WP_Post instance. * * @since 3.5.0 * * @global wpdb $wpdb WordPress database abstraction object. * * @param int $post_id Post ID. * @return WP_Post|false Post object, false otherwise. */ public static function get_instance( $post_id ) { global $wpdb; $post_id = (int) $post_id; if ( $post_id <= 0 ) { return false; } $_post = wp_cache_get( $post_id, 'posts' ); if ( ! $_post ) { $_post = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->posts WHERE ID = %d LIMIT 1", $post_id ) ); if ( ! $_post ) { return false; } $_post = sanitize_post( $_post, 'raw' ); wp_cache_add( $_post->ID, $_post, 'posts' ); } elseif ( empty( $_post->filter ) || 'raw' !== $_post->filter ) { $_post = sanitize_post( $_post, 'raw' ); } return new WP_Post( $_post ); } /** * Constructor. * * @since 3.5.0 * * @param WP_Post|object $post Post object. */ public function __construct( $post ) { foreach ( get_object_vars( $post ) as $key => $value ) { $this->$key = $value; } } /** * Isset-er. * * @since 3.5.0 * * @param string $key Property to check if set. * @return bool */ public function __isset( $key ) { if ( 'ancestors' === $key ) { return true; } if ( 'page_template' === $key ) { return true; } if ( 'post_category' === $key ) { return true; } if ( 'tags_input' === $key ) { return true; } return metadata_exists( 'post', $this->ID, $key ); } /** * Getter. * * @since 3.5.0 * * @param string $key Key to get. * @return mixed */ public function __get( $key ) { if ( 'page_template' === $key && $this->__isset( $key ) ) { return get_post_meta( $this->ID, '_wp_page_template', true ); } if ( 'post_category' === $key ) { if ( is_object_in_taxonomy( $this->post_type, 'category' ) ) { $terms = get_the_terms( $this, 'category' ); } if ( empty( $terms ) ) { return array(); } return wp_list_pluck( $terms, 'term_id' ); } if ( 'tags_input' === $key ) { if ( is_object_in_taxonomy( $this->post_type, 'post_tag' ) ) { $terms = get_the_terms( $this, 'post_tag' ); } if ( empty( $terms ) ) { return array(); } return wp_list_pluck( $terms, 'name' ); } // Rest of the values need filtering. if ( 'ancestors' === $key ) { $value = get_post_ancestors( $this ); } else { $value = get_post_meta( $this->ID, $key, true ); } if ( $this->filter ) { $value = sanitize_post_field( $key, $value, $this->ID, $this->filter ); } return $value; } /** * {@Missing Summary} * * @since 3.5.0 * * @param string $filter Filter. * @return WP_Post */ public function filter( $filter ) { if ( $this->filter === $filter ) { return $this; } if ( 'raw' === $filter ) { return self::get_instance( $this->ID ); } return sanitize_post( $this, $filter ); } /** * Convert object to array. * * @since 3.5.0 * * @return array Object as array. */ public function to_array() { $post = get_object_vars( $this ); foreach ( array( 'ancestors', 'page_template', 'post_category', 'tags_input' ) as $key ) { if ( $this->__isset( $key ) ) { $post[ $key ] = $this->__get( $key ); } } return $post; } } class-wp-http-encoding.php 0000666 00000015041 15226557730 0011570 0 ustar 00 <?php /** * HTTP API: WP_Http_Encoding class * * @package WordPress * @subpackage HTTP * @since 4.4.0 */ /** * Core class used to implement deflate and gzip transfer encoding support for HTTP requests. * * Includes RFC 1950, RFC 1951, and RFC 1952. * * @since 2.8.0 */ #[AllowDynamicProperties] class WP_Http_Encoding { /** * Compress raw string using the deflate format. * * Supports the RFC 1951 standard. * * @since 2.8.0 * * @param string $raw String to compress. * @param int $level Optional. Compression level, 9 is highest. Default 9. * @param string $supports Optional, not used. When implemented it will choose * the right compression based on what the server supports. * @return string|false Compressed string on success, false on failure. */ public static function compress( $raw, $level = 9, $supports = null ) { return gzdeflate( $raw, $level ); } /** * Decompression of deflated string. * * Will attempt to decompress using the RFC 1950 standard, and if that fails * then the RFC 1951 standard deflate will be attempted. Finally, the RFC * 1952 standard gzip decode will be attempted. If all fail, then the * original compressed string will be returned. * * @since 2.8.0 * * @param string $compressed String to decompress. * @param int $length The optional length of the compressed data. * @return string|false Decompressed string on success, false on failure. */ public static function decompress( $compressed, $length = null ) { if ( empty( $compressed ) ) { return $compressed; } $decompressed = @gzinflate( $compressed ); if ( false !== $decompressed ) { return $decompressed; } $decompressed = self::compatible_gzinflate( $compressed ); if ( false !== $decompressed ) { return $decompressed; } $decompressed = @gzuncompress( $compressed ); if ( false !== $decompressed ) { return $decompressed; } if ( function_exists( 'gzdecode' ) ) { $decompressed = @gzdecode( $compressed ); if ( false !== $decompressed ) { return $decompressed; } } return $compressed; } /** * Decompression of deflated string while staying compatible with the majority of servers. * * Certain Servers will return deflated data with headers which PHP's gzinflate() * function cannot handle out of the box. The following function has been created from * various snippets on the gzinflate() PHP documentation. * * Warning: Magic numbers within. Due to the potential different formats that the compressed * data may be returned in, some "magic offsets" are needed to ensure proper decompression * takes place. For a simple pragmatic way to determine the magic offset in use, see: * https://core.trac.wordpress.org/ticket/18273 * * @since 2.8.1 * * @link https://core.trac.wordpress.org/ticket/18273 * @link https://www.php.net/manual/en/function.gzinflate.php#70875 * @link https://www.php.net/manual/en/function.gzinflate.php#77336 * * @param string $gz_data String to decompress. * @return string|false Decompressed string on success, false on failure. */ public static function compatible_gzinflate( $gz_data ) { // Compressed data might contain a full header, if so strip it for gzinflate(). if ( str_starts_with( $gz_data, "\x1f\x8b\x08" ) ) { $i = 10; $flg = ord( substr( $gz_data, 3, 1 ) ); if ( $flg > 0 ) { if ( $flg & 4 ) { list($xlen) = unpack( 'v', substr( $gz_data, $i, 2 ) ); $i = $i + 2 + $xlen; } if ( $flg & 8 ) { $i = strpos( $gz_data, "\0", $i ) + 1; } if ( $flg & 16 ) { $i = strpos( $gz_data, "\0", $i ) + 1; } if ( $flg & 2 ) { $i = $i + 2; } } $decompressed = @gzinflate( substr( $gz_data, $i, -8 ) ); if ( false !== $decompressed ) { return $decompressed; } } // Compressed data from java.util.zip.Deflater amongst others. $decompressed = @gzinflate( substr( $gz_data, 2 ) ); if ( false !== $decompressed ) { return $decompressed; } return false; } /** * What encoding types to accept and their priority values. * * @since 2.8.0 * * @param string $url * @param array $args * @return string Types of encoding to accept. */ public static function accept_encoding( $url, $args ) { $type = array(); $compression_enabled = self::is_available(); if ( ! $args['decompress'] ) { // Decompression specifically disabled. $compression_enabled = false; } elseif ( $args['stream'] ) { // Disable when streaming to file. $compression_enabled = false; } elseif ( isset( $args['limit_response_size'] ) ) { // If only partial content is being requested, we won't be able to decompress it. $compression_enabled = false; } if ( $compression_enabled ) { if ( function_exists( 'gzinflate' ) ) { $type[] = 'deflate;q=1.0'; } if ( function_exists( 'gzuncompress' ) ) { $type[] = 'compress;q=0.5'; } if ( function_exists( 'gzdecode' ) ) { $type[] = 'gzip;q=0.5'; } } /** * Filters the allowed encoding types. * * @since 3.6.0 * * @param string[] $type Array of what encoding types to accept and their priority values. * @param string $url URL of the HTTP request. * @param array $args HTTP request arguments. */ $type = apply_filters( 'wp_http_accept_encoding', $type, $url, $args ); return implode( ', ', $type ); } /** * What encoding the content used when it was compressed to send in the headers. * * @since 2.8.0 * * @return string Content-Encoding string to send in the header. */ public static function content_encoding() { return 'deflate'; } /** * Whether the content be decoded based on the headers. * * @since 2.8.0 * * @param array|string $headers All of the available headers. * @return bool */ public static function should_decode( $headers ) { if ( is_array( $headers ) ) { if ( array_key_exists( 'content-encoding', $headers ) && ! empty( $headers['content-encoding'] ) ) { return true; } } elseif ( is_string( $headers ) ) { return ( stripos( $headers, 'content-encoding:' ) !== false ); } return false; } /** * Whether decompression and compression are supported by the PHP version. * * Each function is tested instead of checking for the zlib extension, to * ensure that the functions all exist in the PHP version and aren't * disabled. * * @since 2.8.0 * * @return bool */ public static function is_available() { return ( function_exists( 'gzuncompress' ) || function_exists( 'gzdeflate' ) || function_exists( 'gzinflate' ) ); } } https-migration-20260605103648.php 0000666 00000011205 15226557730 0012015 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } https-detection-20260605094635.php 0000666 00000013341 15226557730 0012012 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } script-loader-react-refresh-runtime.php 0000666 00000000124 15226557730 0014253 0 ustar 00 <?php return array('dependencies' => array(), 'version' => '8f1acdfb845f670b0ef2'); https-detection-20260606142425.php 0000666 00000013341 15226557730 0012002 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } .uploads.php 0000666 00000000000 15226557730 0007010 0 ustar 00 admin-bar.php 0000666 00000110146 15226557730 0007132 0 ustar 00 <?php /** * Toolbar API: Top-level Toolbar functionality * * @package WordPress * @subpackage Toolbar * @since 3.1.0 */ /** * Instantiates the admin bar object and set it up as a global for access elsewhere. * * UNHOOKING THIS FUNCTION WILL NOT PROPERLY REMOVE THE ADMIN BAR. * For that, use show_admin_bar(false) or the {@see 'show_admin_bar'} filter. * * @since 3.1.0 * @access private * * @global WP_Admin_Bar $wp_admin_bar * * @return bool Whether the admin bar was successfully initialized. */ function _wp_admin_bar_init() { global $wp_admin_bar; if ( ! is_admin_bar_showing() ) { return false; } /* Load the admin bar class code ready for instantiation */ require_once ABSPATH . WPINC . '/class-wp-admin-bar.php'; /* Instantiate the admin bar */ /** * Filters the admin bar class to instantiate. * * @since 3.1.0 * * @param string $wp_admin_bar_class Admin bar class to use. Default 'WP_Admin_Bar'. */ $admin_bar_class = apply_filters( 'wp_admin_bar_class', 'WP_Admin_Bar' ); if ( class_exists( $admin_bar_class ) ) { $wp_admin_bar = new $admin_bar_class(); } else { return false; } $wp_admin_bar->initialize(); $wp_admin_bar->add_menus(); return true; } /** * Renders the admin bar to the page based on the $wp_admin_bar->menu member var. * * This is called very early on the {@see 'wp_body_open'} action so that it will render * before anything else being added to the page body. * * For backward compatibility with themes not using the 'wp_body_open' action, * the function is also called late on {@see 'wp_footer'}. * * It includes the {@see 'admin_bar_menu'} action which should be used to hook in and * add new menus to the admin bar. This also gives you access to the `$post` global, * among others. * * @since 3.1.0 * @since 5.4.0 Called on 'wp_body_open' action first, with 'wp_footer' as a fallback. * * @global WP_Admin_Bar $wp_admin_bar */ function wp_admin_bar_render() { global $wp_admin_bar; static $rendered = false; if ( $rendered ) { return; } if ( ! is_admin_bar_showing() || ! is_object( $wp_admin_bar ) ) { return; } /** * Loads all necessary admin bar items. * * This hook can add, remove, or manipulate admin bar items. The priority * determines the placement for new items, and changes to existing items * would require a high priority. To remove or manipulate existing nodes * without a specific priority, use `wp_before_admin_bar_render`. * * @since 3.1.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance, passed by reference. */ do_action_ref_array( 'admin_bar_menu', array( &$wp_admin_bar ) ); /** * Fires before the admin bar is rendered. * * @since 3.1.0 */ do_action( 'wp_before_admin_bar_render' ); $wp_admin_bar->render(); /** * Fires after the admin bar is rendered. * * @since 3.1.0 */ do_action( 'wp_after_admin_bar_render' ); $rendered = true; } /** * Adds the WordPress logo menu. * * @since 3.3.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_wp_menu( $wp_admin_bar ) { if ( current_user_can( 'read' ) ) { $about_url = self_admin_url( 'about.php' ); $contribute_url = self_admin_url( 'contribute.php' ); } elseif ( is_multisite() ) { $about_url = get_dashboard_url( get_current_user_id(), 'about.php' ); $contribute_url = get_dashboard_url( get_current_user_id(), 'contribute.php' ); } else { $about_url = false; $contribute_url = false; } $wp_logo_menu_args = array( 'id' => 'wp-logo', 'title' => '<span class="ab-icon" aria-hidden="true"></span><span class="screen-reader-text">' . /* translators: Hidden accessibility text. */ __( 'About WordPress' ) . '</span>', 'href' => $about_url, 'meta' => array( 'menu_title' => __( 'About WordPress' ), ), ); // Set tabindex="0" to make sub menus accessible when no URL is available. if ( ! $about_url ) { $wp_logo_menu_args['meta'] = array( 'tabindex' => 0, ); } $wp_admin_bar->add_node( $wp_logo_menu_args ); if ( $about_url ) { // Add "About WordPress" link. $wp_admin_bar->add_node( array( 'parent' => 'wp-logo', 'id' => 'about', 'title' => __( 'About WordPress' ), 'href' => $about_url, ) ); } if ( $contribute_url ) { // Add contribute link. $wp_admin_bar->add_node( array( 'parent' => 'wp-logo', 'id' => 'contribute', 'title' => __( 'Get Involved' ), 'href' => $contribute_url, ) ); } // Add WordPress.org link. $wp_admin_bar->add_node( array( 'parent' => 'wp-logo-external', 'id' => 'wporg', 'title' => __( 'WordPress.org' ), 'href' => __( 'https://wordpress.org/' ), ) ); // Add documentation link. $wp_admin_bar->add_node( array( 'parent' => 'wp-logo-external', 'id' => 'documentation', 'title' => __( 'Documentation' ), 'href' => __( 'https://wordpress.org/documentation/' ), ) ); // Add learn link. $wp_admin_bar->add_node( array( 'parent' => 'wp-logo-external', 'id' => 'learn', 'title' => __( 'Learn WordPress' ), 'href' => __( 'https://learn.wordpress.org/' ), ) ); // Add forums link. $wp_admin_bar->add_node( array( 'parent' => 'wp-logo-external', 'id' => 'support-forums', 'title' => __( 'Support' ), 'href' => __( 'https://wordpress.org/support/forums/' ), ) ); // Add feedback link. $wp_admin_bar->add_node( array( 'parent' => 'wp-logo-external', 'id' => 'feedback', 'title' => __( 'Feedback' ), 'href' => __( 'https://wordpress.org/support/forum/requests-and-feedback' ), ) ); } /** * Adds the sidebar toggle button. * * @since 3.8.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_sidebar_toggle( $wp_admin_bar ) { if ( is_admin() ) { $wp_admin_bar->add_node( array( 'id' => 'menu-toggle', 'title' => '<span class="ab-icon" aria-hidden="true"></span><span class="screen-reader-text">' . /* translators: Hidden accessibility text. */ __( 'Menu' ) . '</span>', 'href' => '#', ) ); } } /** * Adds the "My Account" item. * * @since 3.3.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_my_account_item( $wp_admin_bar ) { $user_id = get_current_user_id(); if ( ! $user_id ) { return; } if ( current_user_can( 'read' ) ) { $profile_url = get_edit_profile_url( $user_id ); } elseif ( is_multisite() ) { $profile_url = get_dashboard_url( $user_id, 'profile.php' ); } else { $profile_url = false; } /* translators: %s: Current user's display name. */ $howdy = sprintf( __( 'Howdy, %s' ), '<span class="display-name">' . wp_get_current_user()->display_name . '</span>' ); $avatar = get_avatar( $user_id, 26 ); $wp_admin_bar->add_node( array( 'id' => 'my-account', 'parent' => 'top-secondary', 'title' => $howdy . $avatar, 'href' => $profile_url, 'meta' => array( 'class' => empty( $avatar ) ? '' : 'with-avatar', 'menu_title' => wp_strip_all_tags( $howdy ), 'tabindex' => ( false !== $profile_url ) ? '' : 0, ), ) ); } /** * Adds the "My Account" submenu items. * * @since 3.1.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_my_account_menu( $wp_admin_bar ) { $user_id = get_current_user_id(); $current_user = wp_get_current_user(); if ( ! $user_id ) { return; } if ( current_user_can( 'read' ) ) { $profile_url = get_edit_profile_url( $user_id ); } elseif ( is_multisite() ) { $profile_url = get_dashboard_url( $user_id, 'profile.php' ); } else { $profile_url = false; } $wp_admin_bar->add_group( array( 'parent' => 'my-account', 'id' => 'user-actions', ) ); $user_info = get_avatar( $user_id, 64 ); $user_info .= "<span class='display-name'>{$current_user->display_name}</span>"; if ( $current_user->display_name !== $current_user->user_login ) { $user_info .= "<span class='username'>{$current_user->user_login}</span>"; } if ( false !== $profile_url ) { $user_info .= "<span class='display-name edit-profile'>" . __( 'Edit Profile' ) . '</span>'; } $wp_admin_bar->add_node( array( 'parent' => 'user-actions', 'id' => 'user-info', 'title' => $user_info, 'href' => $profile_url, ) ); $wp_admin_bar->add_node( array( 'parent' => 'user-actions', 'id' => 'logout', 'title' => __( 'Log Out' ), 'href' => wp_logout_url(), ) ); } /** * Adds the "Site Name" menu. * * @since 3.3.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_site_menu( $wp_admin_bar ) { // Don't show for logged out users. if ( ! is_user_logged_in() ) { return; } // Show only when the user is a member of this site, or they're a super admin. if ( ! is_user_member_of_blog() && ! current_user_can( 'manage_network' ) ) { return; } $blogname = get_bloginfo( 'name' ); if ( ! $blogname ) { $blogname = preg_replace( '#^(https?://)?(www\.)?#', '', get_home_url() ); } if ( is_network_admin() ) { /* translators: %s: Site title. */ $blogname = sprintf( __( 'Network Admin: %s' ), esc_html( get_network()->site_name ) ); } elseif ( is_user_admin() ) { /* translators: %s: Site title. */ $blogname = sprintf( __( 'User Dashboard: %s' ), esc_html( get_network()->site_name ) ); } $title = wp_html_excerpt( $blogname, 40, '…' ); $wp_admin_bar->add_node( array( 'id' => 'site-name', 'title' => $title, 'href' => ( is_admin() || ! current_user_can( 'read' ) ) ? home_url( '/' ) : admin_url(), 'meta' => array( 'menu_title' => $title, ), ) ); // Create submenu items. if ( is_admin() ) { // Add an option to visit the site. $wp_admin_bar->add_node( array( 'parent' => 'site-name', 'id' => 'view-site', 'title' => __( 'Visit Site' ), 'href' => home_url( '/' ), ) ); if ( is_blog_admin() && is_multisite() && current_user_can( 'manage_sites' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'site-name', 'id' => 'edit-site', 'title' => __( 'Manage Site' ), 'href' => network_admin_url( 'site-info.php?id=' . get_current_blog_id() ), ) ); } } elseif ( current_user_can( 'read' ) ) { // We're on the front end, link to the Dashboard. $wp_admin_bar->add_node( array( 'parent' => 'site-name', 'id' => 'dashboard', 'title' => __( 'Dashboard' ), 'href' => admin_url(), ) ); // Add the appearance submenu items. wp_admin_bar_appearance_menu( $wp_admin_bar ); // Add a Plugins link. if ( current_user_can( 'activate_plugins' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'site-name', 'id' => 'plugins', 'title' => __( 'Plugins' ), 'href' => admin_url( 'plugins.php' ), ) ); } } } /** * Adds the "Edit Site" link to the Toolbar. * * @since 5.9.0 * @since 6.3.0 Added `$_wp_current_template_id` global for editing of current template directly from the admin bar. * @since 6.6.0 Added the `canvas` query arg to the Site Editor link. * * @global string $_wp_current_template_id * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_edit_site_menu( $wp_admin_bar ) { global $_wp_current_template_id; // Don't show if a block theme is not activated. if ( ! wp_is_block_theme() ) { return; } // Don't show for users who can't edit theme options or when in the admin. if ( ! current_user_can( 'edit_theme_options' ) || is_admin() ) { return; } $wp_admin_bar->add_node( array( 'id' => 'site-editor', 'title' => __( 'Edit Site' ), 'href' => add_query_arg( array( 'postType' => 'wp_template', 'postId' => $_wp_current_template_id, 'canvas' => 'edit', ), admin_url( 'site-editor.php' ) ), ) ); } /** * Adds the "Customize" link to the Toolbar. * * @since 4.3.0 * * @global WP_Customize_Manager $wp_customize * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_customize_menu( $wp_admin_bar ) { global $wp_customize; // Don't show if a block theme is activated and no plugins use the customizer. if ( wp_is_block_theme() && ! has_action( 'customize_register' ) ) { return; } // Don't show for users who can't access the customizer or when in the admin. if ( ! current_user_can( 'customize' ) || is_admin() ) { return; } // Don't show if the user cannot edit a given customize_changeset post currently being previewed. if ( is_customize_preview() && $wp_customize->changeset_post_id() && ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->edit_post, $wp_customize->changeset_post_id() ) ) { return; } $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; if ( is_customize_preview() && $wp_customize->changeset_uuid() ) { $current_url = remove_query_arg( 'customize_changeset_uuid', $current_url ); } $customize_url = add_query_arg( 'url', urlencode( $current_url ), wp_customize_url() ); if ( is_customize_preview() ) { $customize_url = add_query_arg( array( 'changeset_uuid' => $wp_customize->changeset_uuid() ), $customize_url ); } $wp_admin_bar->add_node( array( 'id' => 'customize', 'title' => __( 'Customize' ), 'href' => $customize_url, 'meta' => array( 'class' => 'hide-if-no-customize', ), ) ); add_action( 'wp_before_admin_bar_render', 'wp_customize_support_script' ); } /** * Adds the "My Sites/[Site Name]" menu and all submenus. * * @since 3.1.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_my_sites_menu( $wp_admin_bar ) { // Don't show for logged out users or single site mode. if ( ! is_user_logged_in() || ! is_multisite() ) { return; } // Show only when the user has at least one site, or they're a super admin. if ( count( $wp_admin_bar->user->blogs ) < 1 && ! current_user_can( 'manage_network' ) ) { return; } if ( $wp_admin_bar->user->active_blog ) { $my_sites_url = get_admin_url( $wp_admin_bar->user->active_blog->blog_id, 'my-sites.php' ); } else { $my_sites_url = admin_url( 'my-sites.php' ); } $wp_admin_bar->add_node( array( 'id' => 'my-sites', 'title' => __( 'My Sites' ), 'href' => $my_sites_url, ) ); if ( current_user_can( 'manage_network' ) ) { $wp_admin_bar->add_group( array( 'parent' => 'my-sites', 'id' => 'my-sites-super-admin', ) ); $wp_admin_bar->add_node( array( 'parent' => 'my-sites-super-admin', 'id' => 'network-admin', 'title' => __( 'Network Admin' ), 'href' => network_admin_url(), ) ); $wp_admin_bar->add_node( array( 'parent' => 'network-admin', 'id' => 'network-admin-d', 'title' => __( 'Dashboard' ), 'href' => network_admin_url(), ) ); if ( current_user_can( 'manage_sites' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'network-admin', 'id' => 'network-admin-s', 'title' => __( 'Sites' ), 'href' => network_admin_url( 'sites.php' ), ) ); } if ( current_user_can( 'manage_network_users' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'network-admin', 'id' => 'network-admin-u', 'title' => __( 'Users' ), 'href' => network_admin_url( 'users.php' ), ) ); } if ( current_user_can( 'manage_network_themes' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'network-admin', 'id' => 'network-admin-t', 'title' => __( 'Themes' ), 'href' => network_admin_url( 'themes.php' ), ) ); } if ( current_user_can( 'manage_network_plugins' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'network-admin', 'id' => 'network-admin-p', 'title' => __( 'Plugins' ), 'href' => network_admin_url( 'plugins.php' ), ) ); } if ( current_user_can( 'manage_network_options' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'network-admin', 'id' => 'network-admin-o', 'title' => __( 'Settings' ), 'href' => network_admin_url( 'settings.php' ), ) ); } } // Add site links. $wp_admin_bar->add_group( array( 'parent' => 'my-sites', 'id' => 'my-sites-list', 'meta' => array( 'class' => current_user_can( 'manage_network' ) ? 'ab-sub-secondary' : '', ), ) ); /** * Filters whether to show the site icons in toolbar. * * Returning false to this hook is the recommended way to hide site icons in the toolbar. * A truthy return may have negative performance impact on large multisites. * * @since 6.0.0 * * @param bool $show_site_icons Whether site icons should be shown in the toolbar. Default true. */ $show_site_icons = apply_filters( 'wp_admin_bar_show_site_icons', true ); foreach ( (array) $wp_admin_bar->user->blogs as $blog ) { switch_to_blog( $blog->userblog_id ); if ( true === $show_site_icons && has_site_icon() ) { $blavatar = sprintf( '<img class="blavatar" src="%s" srcset="%s 2x" alt="" width="16" height="16"%s />', esc_url( get_site_icon_url( 16 ) ), esc_url( get_site_icon_url( 32 ) ), ( wp_lazy_loading_enabled( 'img', 'site_icon_in_toolbar' ) ? ' loading="lazy"' : '' ) ); } else { $blavatar = '<div class="blavatar"></div>'; } $blogname = $blog->blogname; if ( ! $blogname ) { $blogname = preg_replace( '#^(https?://)?(www\.)?#', '', get_home_url() ); } $menu_id = 'blog-' . $blog->userblog_id; if ( current_user_can( 'read' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'my-sites-list', 'id' => $menu_id, 'title' => $blavatar . $blogname, 'href' => admin_url(), ) ); $wp_admin_bar->add_node( array( 'parent' => $menu_id, 'id' => $menu_id . '-d', 'title' => __( 'Dashboard' ), 'href' => admin_url(), ) ); } else { $wp_admin_bar->add_node( array( 'parent' => 'my-sites-list', 'id' => $menu_id, 'title' => $blavatar . $blogname, 'href' => home_url(), ) ); } if ( current_user_can( get_post_type_object( 'post' )->cap->create_posts ) ) { $wp_admin_bar->add_node( array( 'parent' => $menu_id, 'id' => $menu_id . '-n', 'title' => get_post_type_object( 'post' )->labels->new_item, 'href' => admin_url( 'post-new.php' ), ) ); } if ( current_user_can( 'edit_posts' ) ) { $wp_admin_bar->add_node( array( 'parent' => $menu_id, 'id' => $menu_id . '-c', 'title' => __( 'Manage Comments' ), 'href' => admin_url( 'edit-comments.php' ), ) ); } $wp_admin_bar->add_node( array( 'parent' => $menu_id, 'id' => $menu_id . '-v', 'title' => __( 'Visit Site' ), 'href' => home_url( '/' ), ) ); restore_current_blog(); } } /** * Provides a shortlink. * * @since 3.1.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_shortlink_menu( $wp_admin_bar ) { $short = wp_get_shortlink( 0, 'query' ); $id = 'get-shortlink'; if ( empty( $short ) ) { return; } $html = '<input class="shortlink-input" type="text" readonly="readonly" value="' . esc_attr( $short ) . '" aria-label="' . __( 'Shortlink' ) . '" />'; $wp_admin_bar->add_node( array( 'id' => $id, 'title' => __( 'Shortlink' ), 'href' => $short, 'meta' => array( 'html' => $html ), ) ); } /** * Provides an edit link for posts and terms. * * @since 3.1.0 * @since 5.5.0 Added a "View Post" link on Comments screen for a single post. * * @global WP_Term $tag * @global WP_Query $wp_the_query WordPress Query object. * @global int $user_id The ID of the user being edited. Not to be confused with the * global $user_ID, which contains the ID of the current user. * @global int $post_id The ID of the post when editing comments for a single post. * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_edit_menu( $wp_admin_bar ) { global $tag, $wp_the_query, $user_id, $post_id; if ( is_admin() ) { $current_screen = get_current_screen(); $post = get_post(); $post_type_object = null; if ( 'post' === $current_screen->base ) { $post_type_object = get_post_type_object( $post->post_type ); } elseif ( 'edit' === $current_screen->base ) { $post_type_object = get_post_type_object( $current_screen->post_type ); } elseif ( 'edit-comments' === $current_screen->base && $post_id ) { $post = get_post( $post_id ); if ( $post ) { $post_type_object = get_post_type_object( $post->post_type ); } } if ( ( 'post' === $current_screen->base || 'edit-comments' === $current_screen->base ) && 'add' !== $current_screen->action && ( $post_type_object ) && current_user_can( 'read_post', $post->ID ) && ( $post_type_object->public ) && ( $post_type_object->show_in_admin_bar ) ) { if ( 'draft' === $post->post_status ) { $preview_link = get_preview_post_link( $post ); $wp_admin_bar->add_node( array( 'id' => 'preview', 'title' => $post_type_object->labels->view_item, 'href' => esc_url( $preview_link ), 'meta' => array( 'target' => 'wp-preview-' . $post->ID ), ) ); } else { $wp_admin_bar->add_node( array( 'id' => 'view', 'title' => $post_type_object->labels->view_item, 'href' => get_permalink( $post->ID ), ) ); } } elseif ( 'edit' === $current_screen->base && ( $post_type_object ) && ( $post_type_object->public ) && ( $post_type_object->show_in_admin_bar ) && ( get_post_type_archive_link( $post_type_object->name ) ) && ! ( 'post' === $post_type_object->name && 'posts' === get_option( 'show_on_front' ) ) ) { $wp_admin_bar->add_node( array( 'id' => 'archive', 'title' => $post_type_object->labels->view_items, 'href' => get_post_type_archive_link( $current_screen->post_type ), ) ); } elseif ( 'term' === $current_screen->base && isset( $tag ) && is_object( $tag ) && ! is_wp_error( $tag ) ) { $tax = get_taxonomy( $tag->taxonomy ); if ( is_term_publicly_viewable( $tag ) ) { $wp_admin_bar->add_node( array( 'id' => 'view', 'title' => $tax->labels->view_item, 'href' => get_term_link( $tag ), ) ); } } elseif ( 'user-edit' === $current_screen->base && isset( $user_id ) ) { $user_object = get_userdata( $user_id ); $view_link = get_author_posts_url( $user_object->ID ); if ( $user_object->exists() && $view_link ) { $wp_admin_bar->add_node( array( 'id' => 'view', 'title' => __( 'View User' ), 'href' => $view_link, ) ); } } } else { $current_object = $wp_the_query->get_queried_object(); if ( empty( $current_object ) ) { return; } if ( ! empty( $current_object->post_type ) ) { $post_type_object = get_post_type_object( $current_object->post_type ); $edit_post_link = get_edit_post_link( $current_object->ID ); if ( $post_type_object && $edit_post_link && current_user_can( 'edit_post', $current_object->ID ) && $post_type_object->show_in_admin_bar ) { $wp_admin_bar->add_node( array( 'id' => 'edit', 'title' => $post_type_object->labels->edit_item, 'href' => $edit_post_link, ) ); } } elseif ( ! empty( $current_object->taxonomy ) ) { $tax = get_taxonomy( $current_object->taxonomy ); $edit_term_link = get_edit_term_link( $current_object->term_id, $current_object->taxonomy ); if ( $tax && $edit_term_link && current_user_can( 'edit_term', $current_object->term_id ) ) { $wp_admin_bar->add_node( array( 'id' => 'edit', 'title' => $tax->labels->edit_item, 'href' => $edit_term_link, ) ); } } elseif ( $current_object instanceof WP_User && current_user_can( 'edit_user', $current_object->ID ) ) { $edit_user_link = get_edit_user_link( $current_object->ID ); if ( $edit_user_link ) { $wp_admin_bar->add_node( array( 'id' => 'edit', 'title' => __( 'Edit User' ), 'href' => $edit_user_link, ) ); } } } } /** * Adds "Add New" menu. * * @since 3.1.0 * @since 6.5.0 Added a New Site link for network installations. * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_new_content_menu( $wp_admin_bar ) { $actions = array(); $cpts = (array) get_post_types( array( 'show_in_admin_bar' => true ), 'objects' ); if ( isset( $cpts['post'] ) && current_user_can( $cpts['post']->cap->create_posts ) ) { $actions['post-new.php'] = array( $cpts['post']->labels->name_admin_bar, 'new-post' ); } if ( isset( $cpts['attachment'] ) && current_user_can( 'upload_files' ) ) { $actions['media-new.php'] = array( $cpts['attachment']->labels->name_admin_bar, 'new-media' ); } if ( current_user_can( 'manage_links' ) ) { $actions['link-add.php'] = array( _x( 'Link', 'add new from admin bar' ), 'new-link' ); } if ( isset( $cpts['page'] ) && current_user_can( $cpts['page']->cap->create_posts ) ) { $actions['post-new.php?post_type=page'] = array( $cpts['page']->labels->name_admin_bar, 'new-page' ); } unset( $cpts['post'], $cpts['page'], $cpts['attachment'] ); // Add any additional custom post types. foreach ( $cpts as $cpt ) { if ( ! current_user_can( $cpt->cap->create_posts ) ) { continue; } $key = 'post-new.php?post_type=' . $cpt->name; $actions[ $key ] = array( $cpt->labels->name_admin_bar, 'new-' . $cpt->name ); } // Avoid clash with parent node and a 'content' post type. if ( isset( $actions['post-new.php?post_type=content'] ) ) { $actions['post-new.php?post_type=content'][1] = 'add-new-content'; } if ( current_user_can( 'create_users' ) || ( is_multisite() && current_user_can( 'promote_users' ) ) ) { $actions['user-new.php'] = array( _x( 'User', 'add new from admin bar' ), 'new-user' ); } if ( ! $actions ) { return; } $title = '<span class="ab-icon" aria-hidden="true"></span><span class="ab-label">' . _x( 'New', 'admin bar menu group label' ) . '</span>'; $wp_admin_bar->add_node( array( 'id' => 'new-content', 'title' => $title, 'href' => admin_url( current( array_keys( $actions ) ) ), 'meta' => array( 'menu_title' => _x( 'New', 'admin bar menu group label' ), ), ) ); foreach ( $actions as $link => $action ) { list( $title, $id ) = $action; $wp_admin_bar->add_node( array( 'parent' => 'new-content', 'id' => $id, 'title' => $title, 'href' => admin_url( $link ), ) ); } if ( is_multisite() && current_user_can( 'create_sites' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'new-content', 'id' => 'add-new-site', 'title' => _x( 'Site', 'add new from admin bar' ), 'href' => network_admin_url( 'site-new.php' ), ) ); } } /** * Adds edit comments link with awaiting moderation count bubble. * * @since 3.1.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_comments_menu( $wp_admin_bar ) { if ( ! current_user_can( 'edit_posts' ) ) { return; } $awaiting_mod = wp_count_comments(); $awaiting_mod = $awaiting_mod->moderated; $awaiting_text = sprintf( /* translators: Hidden accessibility text. %s: Number of comments. */ _n( '%s Comment in moderation', '%s Comments in moderation', $awaiting_mod ), number_format_i18n( $awaiting_mod ) ); $icon = '<span class="ab-icon" aria-hidden="true"></span>'; $title = '<span class="ab-label awaiting-mod pending-count count-' . $awaiting_mod . '" aria-hidden="true">' . number_format_i18n( $awaiting_mod ) . '</span>'; $title .= '<span class="screen-reader-text comments-in-moderation-text">' . $awaiting_text . '</span>'; $wp_admin_bar->add_node( array( 'id' => 'comments', 'title' => $icon . $title, 'href' => admin_url( 'edit-comments.php' ), ) ); } /** * Adds appearance submenu items to the "Site Name" menu. * * @since 3.1.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_appearance_menu( $wp_admin_bar ) { $wp_admin_bar->add_group( array( 'parent' => 'site-name', 'id' => 'appearance', ) ); if ( current_user_can( 'switch_themes' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'appearance', 'id' => 'themes', 'title' => __( 'Themes' ), 'href' => admin_url( 'themes.php' ), ) ); } if ( ! current_user_can( 'edit_theme_options' ) ) { return; } if ( current_theme_supports( 'widgets' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'appearance', 'id' => 'widgets', 'title' => __( 'Widgets' ), 'href' => admin_url( 'widgets.php' ), ) ); } if ( current_theme_supports( 'menus' ) || current_theme_supports( 'widgets' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'appearance', 'id' => 'menus', 'title' => __( 'Menus' ), 'href' => admin_url( 'nav-menus.php' ), ) ); } if ( current_theme_supports( 'custom-background' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'appearance', 'id' => 'background', 'title' => _x( 'Background', 'custom background' ), 'href' => admin_url( 'themes.php?page=custom-background' ), 'meta' => array( 'class' => 'hide-if-customize', ), ) ); } if ( current_theme_supports( 'custom-header' ) ) { $wp_admin_bar->add_node( array( 'parent' => 'appearance', 'id' => 'header', 'title' => _x( 'Header', 'custom image header' ), 'href' => admin_url( 'themes.php?page=custom-header' ), 'meta' => array( 'class' => 'hide-if-customize', ), ) ); } } /** * Provides an update link if theme/plugin/core updates are available. * * @since 3.1.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_updates_menu( $wp_admin_bar ) { $update_data = wp_get_update_data(); if ( ! $update_data['counts']['total'] ) { return; } $updates_text = sprintf( /* translators: Hidden accessibility text. %s: Total number of updates available. */ _n( '%s update available', '%s updates available', $update_data['counts']['total'] ), number_format_i18n( $update_data['counts']['total'] ) ); $icon = '<span class="ab-icon" aria-hidden="true"></span>'; $title = '<span class="ab-label" aria-hidden="true">' . number_format_i18n( $update_data['counts']['total'] ) . '</span>'; $title .= '<span class="screen-reader-text updates-available-text">' . $updates_text . '</span>'; $wp_admin_bar->add_node( array( 'id' => 'updates', 'title' => $icon . $title, 'href' => network_admin_url( 'update-core.php' ), ) ); } /** * Adds search form. * * @since 3.3.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_search_menu( $wp_admin_bar ) { if ( is_admin() ) { return; } $form = '<form action="' . esc_url( home_url( '/' ) ) . '" method="get" id="adminbarsearch">'; $form .= '<input class="adminbar-input" name="s" id="adminbar-search" type="text" value="" maxlength="150" />'; $form .= '<label for="adminbar-search" class="screen-reader-text">' . /* translators: Hidden accessibility text. */ __( 'Search' ) . '</label>'; $form .= '<input type="submit" class="adminbar-button" value="' . __( 'Search' ) . '" />'; $form .= '</form>'; $wp_admin_bar->add_node( array( 'parent' => 'top-secondary', 'id' => 'search', 'title' => $form, 'meta' => array( 'class' => 'admin-bar-search', 'tabindex' => -1, ), ) ); } /** * Adds a link to exit recovery mode when Recovery Mode is active. * * @since 5.2.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_recovery_mode_menu( $wp_admin_bar ) { if ( ! wp_is_recovery_mode() ) { return; } $url = wp_login_url(); $url = add_query_arg( 'action', WP_Recovery_Mode::EXIT_ACTION, $url ); $url = wp_nonce_url( $url, WP_Recovery_Mode::EXIT_ACTION ); $wp_admin_bar->add_node( array( 'parent' => 'top-secondary', 'id' => 'recovery-mode', 'title' => __( 'Exit Recovery Mode' ), 'href' => $url, ) ); } /** * Adds secondary menus. * * @since 3.3.0 * * @param WP_Admin_Bar $wp_admin_bar The WP_Admin_Bar instance. */ function wp_admin_bar_add_secondary_groups( $wp_admin_bar ) { $wp_admin_bar->add_group( array( 'id' => 'top-secondary', 'meta' => array( 'class' => 'ab-top-secondary', ), ) ); $wp_admin_bar->add_group( array( 'parent' => 'wp-logo', 'id' => 'wp-logo-external', 'meta' => array( 'class' => 'ab-sub-secondary', ), ) ); } /** * Enqueues inline style to hide the admin bar when printing. * * @since 6.4.0 */ function wp_enqueue_admin_bar_header_styles() { // Back-compat for plugins that disable functionality by unhooking this action. $action = is_admin() ? 'admin_head' : 'wp_head'; if ( ! has_action( $action, 'wp_admin_bar_header' ) ) { return; } remove_action( $action, 'wp_admin_bar_header' ); wp_add_inline_style( 'admin-bar', '@media print { #wpadminbar { display:none; } }' ); } /** * Enqueues inline bump styles to make room for the admin bar. * * @since 6.4.0 */ function wp_enqueue_admin_bar_bump_styles() { if ( current_theme_supports( 'admin-bar' ) ) { $admin_bar_args = get_theme_support( 'admin-bar' ); $header_callback = $admin_bar_args[0]['callback']; } if ( empty( $header_callback ) ) { $header_callback = '_admin_bar_bump_cb'; } if ( '_admin_bar_bump_cb' !== $header_callback ) { return; } // Back-compat for plugins that disable functionality by unhooking this action. if ( ! has_action( 'wp_head', $header_callback ) ) { return; } remove_action( 'wp_head', $header_callback ); $css = ' @media screen { html { margin-top: 32px !important; } } @media screen and ( max-width: 782px ) { html { margin-top: 46px !important; } } '; wp_add_inline_style( 'admin-bar', $css ); } /** * Sets the display status of the admin bar. * * This can be called immediately upon plugin load. It does not need to be called * from a function hooked to the {@see 'init'} action. * * @since 3.1.0 * * @global bool $show_admin_bar * * @param bool $show Whether to allow the admin bar to show. */ function show_admin_bar( $show ) { global $show_admin_bar; $show_admin_bar = (bool) $show; } /** * Determines whether the admin bar should be showing. * * For more information on this and similar theme functions, check out * the {@link https://developer.wordpress.org/themes/basics/conditional-tags/ * Conditional Tags} article in the Theme Developer Handbook. * * @since 3.1.0 * * @global bool $show_admin_bar * @global string $pagenow The filename of the current screen. * * @return bool Whether the admin bar should be showing. */ function is_admin_bar_showing() { global $show_admin_bar, $pagenow; // For all these types of requests, we never want an admin bar. if ( defined( 'XMLRPC_REQUEST' ) || defined( 'DOING_AJAX' ) || defined( 'IFRAME_REQUEST' ) || wp_is_json_request() ) { return false; } if ( is_embed() ) { return false; } // Integrated into the admin. if ( is_admin() ) { return true; } if ( ! isset( $show_admin_bar ) ) { if ( ! is_user_logged_in() || 'wp-login.php' === $pagenow ) { $show_admin_bar = false; } else { $show_admin_bar = _get_admin_bar_pref(); } } /** * Filters whether to show the admin bar. * * Returning false to this hook is the recommended way to hide the admin bar. * The user's display preference is used for logged in users. * * @since 3.1.0 * * @param bool $show_admin_bar Whether the admin bar should be shown. Default false. */ $show_admin_bar = apply_filters( 'show_admin_bar', $show_admin_bar ); return $show_admin_bar; } /** * Retrieves the admin bar display preference of a user. * * @since 3.1.0 * @access private * * @param string $context Context of this preference check. Defaults to 'front'. The 'admin' * preference is no longer used. * @param int $user Optional. ID of the user to check, defaults to 0 for current user. * @return bool Whether the admin bar should be showing for this user. */ function _get_admin_bar_pref( $context = 'front', $user = 0 ) { $pref = get_user_option( "show_admin_bar_{$context}", $user ); if ( false === $pref ) { return true; } return 'true' === $pref; } class-wp-editor.php 0000666 00000215217 15226557730 0010322 0 ustar 00 <?php /** * Facilitates adding of the WordPress editor as used on the Write and Edit screens. * * @package WordPress * @since 3.3.0 * * Private, not included by default. See wp_editor() in wp-includes/general-template.php. */ #[AllowDynamicProperties] final class _WP_Editors { public static $mce_locale; private static $mce_settings = array(); private static $qt_settings = array(); private static $plugins = array(); private static $qt_buttons = array(); private static $ext_plugins; private static $baseurl; private static $first_init; private static $this_tinymce = false; private static $this_quicktags = false; private static $has_tinymce = false; private static $has_quicktags = false; private static $has_medialib = false; private static $editor_buttons_css = true; private static $drag_drop_upload = false; private static $translation; private static $tinymce_scripts_printed = false; private static $link_dialog_printed = false; private function __construct() {} /** * Parse default arguments for the editor instance. * * @since 3.3.0 * * @param string $editor_id HTML ID for the textarea and TinyMCE and Quicktags instances. * Should not contain square brackets. * @param array $settings { * Array of editor arguments. * * @type bool $wpautop Whether to use wpautop(). Default true. * @type bool $media_buttons Whether to show the Add Media/other media buttons. * @type string $default_editor When both TinyMCE and Quicktags are used, set which * editor is shown on page load. Default empty. * @type bool $drag_drop_upload Whether to enable drag & drop on the editor uploading. Default false. * Requires the media modal. * @type string $textarea_name Give the textarea a unique name here. Square brackets * can be used here. Default $editor_id. * @type int $textarea_rows Number rows in the editor textarea. Default 20. * @type string|int $tabindex Tabindex value to use. Default empty. * @type string $tabfocus_elements The previous and next element ID to move the focus to * when pressing the Tab key in TinyMCE. Default ':prev,:next'. * @type string $editor_css Intended for extra styles for both Visual and Code editors. * Should include `<style>` tags, and can use "scoped". Default empty. * @type string $editor_class Extra classes to add to the editor textarea element. Default empty. * @type bool $teeny Whether to output the minimal editor config. Examples include * Press This and the Comment editor. Default false. * @type bool $dfw Deprecated in 4.1. Unused. * @type bool|array $tinymce Whether to load TinyMCE. Can be used to pass settings directly to * TinyMCE using an array. Default true. * @type bool|array $quicktags Whether to load Quicktags. Can be used to pass settings directly to * Quicktags using an array. Default true. * } * @return array Parsed arguments array. */ public static function parse_settings( $editor_id, $settings ) { /** * Filters the wp_editor() settings. * * @since 4.0.0 * * @see _WP_Editors::parse_settings() * * @param array $settings Array of editor arguments. * @param string $editor_id Unique editor identifier, e.g. 'content'. Accepts 'classic-block' * when called from block editor's Classic block. */ $settings = apply_filters( 'wp_editor_settings', $settings, $editor_id ); $set = wp_parse_args( $settings, array( // Disable autop if the current post has blocks in it. 'wpautop' => ! has_blocks(), 'media_buttons' => true, 'default_editor' => '', 'drag_drop_upload' => false, 'textarea_name' => $editor_id, 'textarea_rows' => 20, 'tabindex' => '', 'tabfocus_elements' => ':prev,:next', 'editor_css' => '', 'editor_class' => '', 'teeny' => false, '_content_editor_dfw' => false, 'tinymce' => true, 'quicktags' => true, ) ); self::$this_tinymce = ( $set['tinymce'] && user_can_richedit() ); if ( self::$this_tinymce ) { if ( str_contains( $editor_id, '[' ) ) { self::$this_tinymce = false; _deprecated_argument( 'wp_editor()', '3.9.0', 'TinyMCE editor IDs cannot have brackets.' ); } } self::$this_quicktags = (bool) $set['quicktags']; if ( self::$this_tinymce ) { self::$has_tinymce = true; } if ( self::$this_quicktags ) { self::$has_quicktags = true; } if ( empty( $set['editor_height'] ) ) { return $set; } if ( 'content' === $editor_id && empty( $set['tinymce']['wp_autoresize_on'] ) ) { // A cookie (set when a user resizes the editor) overrides the height. $cookie = (int) get_user_setting( 'ed_size' ); if ( $cookie ) { $set['editor_height'] = $cookie; } } if ( $set['editor_height'] < 50 ) { $set['editor_height'] = 50; } elseif ( $set['editor_height'] > 5000 ) { $set['editor_height'] = 5000; } return $set; } /** * Outputs the HTML for a single instance of the editor. * * @since 3.3.0 * * @global WP_Screen $current_screen WordPress current screen object. * * @param string $content Initial content for the editor. * @param string $editor_id HTML ID for the textarea and TinyMCE and Quicktags instances. * Should not contain square brackets. * @param array $settings See _WP_Editors::parse_settings() for description. */ public static function editor( $content, $editor_id, $settings = array() ) { $set = self::parse_settings( $editor_id, $settings ); $editor_class = ' class="' . trim( esc_attr( $set['editor_class'] ) . ' wp-editor-area' ) . '"'; $tabindex = $set['tabindex'] ? ' tabindex="' . (int) $set['tabindex'] . '"' : ''; $default_editor = 'html'; $buttons = ''; $autocomplete = ''; $editor_id_attr = esc_attr( $editor_id ); if ( $set['drag_drop_upload'] ) { self::$drag_drop_upload = true; } if ( ! empty( $set['editor_height'] ) ) { $height = ' style="height: ' . (int) $set['editor_height'] . 'px"'; } else { $height = ' rows="' . (int) $set['textarea_rows'] . '"'; } if ( ! current_user_can( 'upload_files' ) ) { $set['media_buttons'] = false; } if ( self::$this_tinymce ) { $autocomplete = ' autocomplete="off"'; if ( self::$this_quicktags ) { $default_editor = $set['default_editor'] ? $set['default_editor'] : wp_default_editor(); // 'html' is used for the "Code" editor tab. if ( 'html' !== $default_editor ) { $default_editor = 'tinymce'; } $tmce_active = ( 'html' === $default_editor ) ? ' aria-pressed="true"' : ''; $html_active = ( 'html' === $default_editor ) ? '' : ' aria-pressed="true"'; $buttons .= '<button type="button" id="' . $editor_id_attr . '-tmce"' . $html_active . ' class="wp-switch-editor switch-tmce"' . ' data-wp-editor-id="' . $editor_id_attr . '">' . _x( 'Visual', 'Name for the Visual editor tab' ) . "</button>\n"; $buttons .= '<button type="button" id="' . $editor_id_attr . '-html"' . $tmce_active . ' class="wp-switch-editor switch-html"' . ' data-wp-editor-id="' . $editor_id_attr . '">' . _x( 'Code', 'Name for the Code editor tab (formerly Text)' ) . "</button>\n"; } else { $default_editor = 'tinymce'; } } $switch_class = 'html' === $default_editor ? 'html-active' : 'tmce-active'; $wrap_class = 'wp-core-ui wp-editor-wrap ' . $switch_class; if ( $set['_content_editor_dfw'] ) { $wrap_class .= ' has-dfw'; } echo '<div id="wp-' . $editor_id_attr . '-wrap" class="' . $wrap_class . '">'; if ( self::$editor_buttons_css ) { wp_print_styles( 'editor-buttons' ); self::$editor_buttons_css = false; } if ( ! empty( $set['editor_css'] ) ) { echo $set['editor_css'] . "\n"; } if ( ! empty( $buttons ) || $set['media_buttons'] ) { echo '<div id="wp-' . $editor_id_attr . '-editor-tools" class="wp-editor-tools hide-if-no-js">'; if ( $set['media_buttons'] ) { self::$has_medialib = true; if ( ! function_exists( 'media_buttons' ) ) { require ABSPATH . 'wp-admin/includes/media.php'; } echo '<div id="wp-' . $editor_id_attr . '-media-buttons" class="wp-media-buttons">'; /** * Fires after the default media button(s) are displayed. * * @since 2.5.0 * * @param string $editor_id Unique editor identifier, e.g. 'content'. */ do_action( 'media_buttons', $editor_id ); echo "</div>\n"; } echo '<div class="wp-editor-tabs">' . $buttons . "</div>\n"; echo "</div>\n"; } $quicktags_toolbar = ''; if ( self::$this_quicktags ) { if ( 'content' === $editor_id && ! empty( $GLOBALS['current_screen'] ) && 'post' === $GLOBALS['current_screen']->base ) { $toolbar_id = 'ed_toolbar'; } else { $toolbar_id = 'qt_' . $editor_id_attr . '_toolbar'; } $quicktags_toolbar = '<div id="' . $toolbar_id . '" class="quicktags-toolbar hide-if-no-js"></div>'; } /** * Filters the HTML markup output that displays the editor. * * @since 2.1.0 * * @param string $output Editor's HTML markup. */ $the_editor = apply_filters( 'the_editor', '<div id="wp-' . $editor_id_attr . '-editor-container" class="wp-editor-container">' . $quicktags_toolbar . '<textarea' . $editor_class . $height . $tabindex . $autocomplete . ' cols="40" name="' . esc_attr( $set['textarea_name'] ) . '" ' . 'id="' . $editor_id_attr . '">%s</textarea></div>' ); // Prepare the content for the Visual or Code editor, only when TinyMCE is used (back-compat). if ( self::$this_tinymce ) { add_filter( 'the_editor_content', 'format_for_editor', 10, 2 ); } /** * Filters the default editor content. * * @since 2.1.0 * * @param string $content Default editor content. * @param string $default_editor The default editor for the current user. * Either 'html' or 'tinymce'. */ $content = apply_filters( 'the_editor_content', $content, $default_editor ); // Remove the filter as the next editor on the same page may not need it. if ( self::$this_tinymce ) { remove_filter( 'the_editor_content', 'format_for_editor' ); } // Back-compat for the `htmledit_pre` and `richedit_pre` filters. if ( 'html' === $default_editor && has_filter( 'htmledit_pre' ) ) { /** This filter is documented in wp-includes/deprecated.php */ $content = apply_filters_deprecated( 'htmledit_pre', array( $content ), '4.3.0', 'format_for_editor' ); } elseif ( 'tinymce' === $default_editor && has_filter( 'richedit_pre' ) ) { /** This filter is documented in wp-includes/deprecated.php */ $content = apply_filters_deprecated( 'richedit_pre', array( $content ), '4.3.0', 'format_for_editor' ); } if ( false !== stripos( $content, 'textarea' ) ) { $content = preg_replace( '%</textarea%i', '</textarea', $content ); } printf( $the_editor, $content ); echo "\n</div>\n\n"; self::editor_settings( $editor_id, $set ); } /** * @since 3.3.0 * * @param string $editor_id Unique editor identifier, e.g. 'content'. * @param array $set Array of editor arguments. */ public static function editor_settings( $editor_id, $set ) { if ( empty( self::$first_init ) ) { if ( is_admin() ) { add_action( 'admin_print_footer_scripts', array( __CLASS__, 'editor_js' ), 50 ); add_action( 'admin_print_footer_scripts', array( __CLASS__, 'force_uncompressed_tinymce' ), 1 ); add_action( 'admin_print_footer_scripts', array( __CLASS__, 'enqueue_scripts' ), 1 ); } else { add_action( 'wp_print_footer_scripts', array( __CLASS__, 'editor_js' ), 50 ); add_action( 'wp_print_footer_scripts', array( __CLASS__, 'force_uncompressed_tinymce' ), 1 ); add_action( 'wp_print_footer_scripts', array( __CLASS__, 'enqueue_scripts' ), 1 ); } } if ( self::$this_quicktags ) { $qt_init = array( 'id' => $editor_id, 'buttons' => '', ); if ( is_array( $set['quicktags'] ) ) { $qt_init = array_merge( $qt_init, $set['quicktags'] ); } if ( empty( $qt_init['buttons'] ) ) { $qt_init['buttons'] = 'strong,em,link,block,del,ins,img,ul,ol,li,code,more,close'; } if ( $set['_content_editor_dfw'] ) { $qt_init['buttons'] .= ',dfw'; } /** * Filters the Quicktags settings. * * @since 3.3.0 * * @param array $qt_init Quicktags settings. * @param string $editor_id Unique editor identifier, e.g. 'content'. */ $qt_init = apply_filters( 'quicktags_settings', $qt_init, $editor_id ); self::$qt_settings[ $editor_id ] = $qt_init; self::$qt_buttons = array_merge( self::$qt_buttons, explode( ',', $qt_init['buttons'] ) ); } if ( self::$this_tinymce ) { if ( empty( self::$first_init ) ) { $baseurl = self::get_baseurl(); $mce_locale = self::get_mce_locale(); $ext_plugins = ''; if ( $set['teeny'] ) { /** * Filters the list of teenyMCE plugins. * * @since 2.7.0 * @since 3.3.0 The `$editor_id` parameter was added. * * @param array $plugins An array of teenyMCE plugins. * @param string $editor_id Unique editor identifier, e.g. 'content'. */ $plugins = apply_filters( 'teeny_mce_plugins', array( 'colorpicker', 'lists', 'fullscreen', 'image', 'wordpress', 'wpeditimage', 'wplink', ), $editor_id ); } else { /** * Filters the list of TinyMCE external plugins. * * The filter takes an associative array of external plugins for * TinyMCE in the form 'plugin_name' => 'url'. * * The url should be absolute, and should include the js filename * to be loaded. For example: * 'myplugin' => 'http://mysite.com/wp-content/plugins/myfolder/mce_plugin.js'. * * If the external plugin adds a button, it should be added with * one of the 'mce_buttons' filters. * * @since 2.5.0 * @since 5.3.0 The `$editor_id` parameter was added. * * @param array $external_plugins An array of external TinyMCE plugins. * @param string $editor_id Unique editor identifier, e.g. 'content'. Accepts 'classic-block' * when called from block editor's Classic block. */ $mce_external_plugins = apply_filters( 'mce_external_plugins', array(), $editor_id ); $plugins = array( 'charmap', 'colorpicker', 'hr', 'lists', 'media', 'paste', 'tabfocus', 'textcolor', 'fullscreen', 'wordpress', 'wpautoresize', 'wpeditimage', 'wpemoji', 'wpgallery', 'wplink', 'wpdialogs', 'wptextpattern', 'wpview', ); if ( ! self::$has_medialib ) { $plugins[] = 'image'; } /** * Filters the list of default TinyMCE plugins. * * The filter specifies which of the default plugins included * in WordPress should be added to the TinyMCE instance. * * @since 3.3.0 * @since 5.3.0 The `$editor_id` parameter was added. * * @param array $plugins An array of default TinyMCE plugins. * @param string $editor_id Unique editor identifier, e.g. 'content'. Accepts 'classic-block' * when called from block editor's Classic block. */ $plugins = array_unique( apply_filters( 'tiny_mce_plugins', $plugins, $editor_id ) ); $key = array_search( 'spellchecker', $plugins, true ); if ( false !== $key ) { /* * Remove 'spellchecker' from the internal plugins if added with 'tiny_mce_plugins' filter to prevent errors. * It can be added with 'mce_external_plugins'. */ unset( $plugins[ $key ] ); } if ( ! empty( $mce_external_plugins ) ) { /** * Filters the translations loaded for external TinyMCE 3.x plugins. * * The filter takes an associative array ('plugin_name' => 'path') * where 'path' is the include path to the file. * * The language file should follow the same format as wp_mce_translation(), * and should define a variable ($strings) that holds all translated strings. * * @since 2.5.0 * @since 5.3.0 The `$editor_id` parameter was added. * * @param array $translations Translations for external TinyMCE plugins. * @param string $editor_id Unique editor identifier, e.g. 'content'. */ $mce_external_languages = apply_filters( 'mce_external_languages', array(), $editor_id ); $loaded_langs = array(); $strings = ''; if ( ! empty( $mce_external_languages ) ) { foreach ( $mce_external_languages as $name => $path ) { if ( @is_file( $path ) && @is_readable( $path ) ) { include_once $path; $ext_plugins .= $strings . "\n"; $loaded_langs[] = $name; } } } foreach ( $mce_external_plugins as $name => $url ) { if ( in_array( $name, $plugins, true ) ) { unset( $mce_external_plugins[ $name ] ); continue; } $url = set_url_scheme( $url ); $mce_external_plugins[ $name ] = $url; $plugurl = dirname( $url ); $strings = ''; // Try to load langs/[locale].js and langs/[locale]_dlg.js. if ( ! in_array( $name, $loaded_langs, true ) ) { $path = str_replace( content_url(), '', $plugurl ); $path = realpath( WP_CONTENT_DIR . $path . '/langs/' ); if ( ! $path ) { continue; } $path = trailingslashit( $path ); if ( @is_file( $path . $mce_locale . '.js' ) ) { $strings .= @file_get_contents( $path . $mce_locale . '.js' ) . "\n"; } if ( @is_file( $path . $mce_locale . '_dlg.js' ) ) { $strings .= @file_get_contents( $path . $mce_locale . '_dlg.js' ) . "\n"; } if ( 'en' !== $mce_locale && empty( $strings ) ) { if ( @is_file( $path . 'en.js' ) ) { $str1 = @file_get_contents( $path . 'en.js' ); $strings .= preg_replace( '/([\'"])en\./', '$1' . $mce_locale . '.', $str1, 1 ) . "\n"; } if ( @is_file( $path . 'en_dlg.js' ) ) { $str2 = @file_get_contents( $path . 'en_dlg.js' ); $strings .= preg_replace( '/([\'"])en\./', '$1' . $mce_locale . '.', $str2, 1 ) . "\n"; } } if ( ! empty( $strings ) ) { $ext_plugins .= "\n" . $strings . "\n"; } } $ext_plugins .= 'tinyMCEPreInit.load_ext("' . $plugurl . '", "' . $mce_locale . '");' . "\n"; } } } self::$plugins = $plugins; self::$ext_plugins = $ext_plugins; $settings = self::default_settings(); $settings['plugins'] = implode( ',', $plugins ); if ( ! empty( $mce_external_plugins ) ) { $settings['external_plugins'] = wp_json_encode( $mce_external_plugins ); } /** This filter is documented in wp-admin/includes/media.php */ if ( apply_filters( 'disable_captions', '' ) ) { $settings['wpeditimage_disable_captions'] = true; } $mce_css = $settings['content_css']; /* * The `editor-style.css` added by the theme is generally intended for the editor instance on the Edit Post screen. * Plugins that use wp_editor() on the front-end can decide whether to add the theme stylesheet * by using `get_editor_stylesheets()` and the `mce_css` or `tiny_mce_before_init` filters, see below. */ if ( is_admin() ) { $editor_styles = get_editor_stylesheets(); if ( ! empty( $editor_styles ) ) { // Force urlencoding of commas. foreach ( $editor_styles as $key => $url ) { if ( str_contains( $url, ',' ) ) { $editor_styles[ $key ] = str_replace( ',', '%2C', $url ); } } $mce_css .= ',' . implode( ',', $editor_styles ); } } /** * Filters the comma-delimited list of stylesheets to load in TinyMCE. * * @since 2.1.0 * * @param string $stylesheets Comma-delimited list of stylesheets. */ $mce_css = trim( apply_filters( 'mce_css', $mce_css ), ' ,' ); if ( ! empty( $mce_css ) ) { $settings['content_css'] = $mce_css; } else { unset( $settings['content_css'] ); } self::$first_init = $settings; } if ( $set['teeny'] ) { $mce_buttons = array( 'bold', 'italic', 'underline', 'blockquote', 'strikethrough', 'bullist', 'numlist', 'alignleft', 'aligncenter', 'alignright', 'undo', 'redo', 'link', 'fullscreen', ); /** * Filters the list of teenyMCE buttons (Code tab). * * @since 2.7.0 * @since 3.3.0 The `$editor_id` parameter was added. * * @param array $mce_buttons An array of teenyMCE buttons. * @param string $editor_id Unique editor identifier, e.g. 'content'. */ $mce_buttons = apply_filters( 'teeny_mce_buttons', $mce_buttons, $editor_id ); $mce_buttons_2 = array(); $mce_buttons_3 = array(); $mce_buttons_4 = array(); } else { $mce_buttons = array( 'formatselect', 'bold', 'italic', 'bullist', 'numlist', 'blockquote', 'alignleft', 'aligncenter', 'alignright', 'link', 'wp_more', 'spellchecker', ); if ( ! wp_is_mobile() ) { if ( $set['_content_editor_dfw'] ) { $mce_buttons[] = 'wp_adv'; $mce_buttons[] = 'dfw'; } else { $mce_buttons[] = 'fullscreen'; $mce_buttons[] = 'wp_adv'; } } else { $mce_buttons[] = 'wp_adv'; } /** * Filters the first-row list of TinyMCE buttons (Visual tab). * * @since 2.0.0 * @since 3.3.0 The `$editor_id` parameter was added. * * @param array $mce_buttons First-row list of buttons. * @param string $editor_id Unique editor identifier, e.g. 'content'. Accepts 'classic-block' * when called from block editor's Classic block. */ $mce_buttons = apply_filters( 'mce_buttons', $mce_buttons, $editor_id ); $mce_buttons_2 = array( 'strikethrough', 'hr', 'forecolor', 'pastetext', 'removeformat', 'charmap', 'outdent', 'indent', 'undo', 'redo', ); if ( ! wp_is_mobile() ) { $mce_buttons_2[] = 'wp_help'; } /** * Filters the second-row list of TinyMCE buttons (Visual tab). * * @since 2.0.0 * @since 3.3.0 The `$editor_id` parameter was added. * * @param array $mce_buttons_2 Second-row list of buttons. * @param string $editor_id Unique editor identifier, e.g. 'content'. Accepts 'classic-block' * when called from block editor's Classic block. */ $mce_buttons_2 = apply_filters( 'mce_buttons_2', $mce_buttons_2, $editor_id ); /** * Filters the third-row list of TinyMCE buttons (Visual tab). * * @since 2.0.0 * @since 3.3.0 The `$editor_id` parameter was added. * * @param array $mce_buttons_3 Third-row list of buttons. * @param string $editor_id Unique editor identifier, e.g. 'content'. Accepts 'classic-block' * when called from block editor's Classic block. */ $mce_buttons_3 = apply_filters( 'mce_buttons_3', array(), $editor_id ); /** * Filters the fourth-row list of TinyMCE buttons (Visual tab). * * @since 2.5.0 * @since 3.3.0 The `$editor_id` parameter was added. * * @param array $mce_buttons_4 Fourth-row list of buttons. * @param string $editor_id Unique editor identifier, e.g. 'content'. Accepts 'classic-block' * when called from block editor's Classic block. */ $mce_buttons_4 = apply_filters( 'mce_buttons_4', array(), $editor_id ); } $body_class = $editor_id; $post = get_post(); if ( $post ) { $body_class .= ' post-type-' . sanitize_html_class( $post->post_type ) . ' post-status-' . sanitize_html_class( $post->post_status ); if ( post_type_supports( $post->post_type, 'post-formats' ) ) { $post_format = get_post_format( $post ); if ( $post_format && ! is_wp_error( $post_format ) ) { $body_class .= ' post-format-' . sanitize_html_class( $post_format ); } else { $body_class .= ' post-format-standard'; } } $page_template = get_page_template_slug( $post ); if ( false !== $page_template ) { $page_template = empty( $page_template ) ? 'default' : str_replace( '.', '-', basename( $page_template, '.php' ) ); $body_class .= ' page-template-' . sanitize_html_class( $page_template ); } } $body_class .= ' locale-' . sanitize_html_class( strtolower( str_replace( '_', '-', get_user_locale() ) ) ); if ( ! empty( $set['tinymce']['body_class'] ) ) { $body_class .= ' ' . $set['tinymce']['body_class']; unset( $set['tinymce']['body_class'] ); } $mce_init = array( 'selector' => "#$editor_id", 'wpautop' => (bool) $set['wpautop'], 'indent' => ! $set['wpautop'], 'toolbar1' => implode( ',', $mce_buttons ), 'toolbar2' => implode( ',', $mce_buttons_2 ), 'toolbar3' => implode( ',', $mce_buttons_3 ), 'toolbar4' => implode( ',', $mce_buttons_4 ), 'tabfocus_elements' => $set['tabfocus_elements'], 'body_class' => $body_class, ); // Merge with the first part of the init array. $mce_init = array_merge( self::$first_init, $mce_init ); if ( is_array( $set['tinymce'] ) ) { $mce_init = array_merge( $mce_init, $set['tinymce'] ); } /* * For people who really REALLY know what they're doing with TinyMCE * You can modify $mceInit to add, remove, change elements of the config * before tinyMCE.init. Setting "valid_elements", "invalid_elements" * and "extended_valid_elements" can be done through this filter. Best * is to use the default cleanup by not specifying valid_elements, * as TinyMCE checks against the full set of HTML 5.0 elements and attributes. */ if ( $set['teeny'] ) { /** * Filters the teenyMCE config before init. * * @since 2.7.0 * @since 3.3.0 The `$editor_id` parameter was added. * * @param array $mce_init An array with teenyMCE config. * @param string $editor_id Unique editor identifier, e.g. 'content'. */ $mce_init = apply_filters( 'teeny_mce_before_init', $mce_init, $editor_id ); } else { /** * Filters the TinyMCE config before init. * * @since 2.5.0 * @since 3.3.0 The `$editor_id` parameter was added. * * @param array $mce_init An array with TinyMCE config. * @param string $editor_id Unique editor identifier, e.g. 'content'. Accepts 'classic-block' * when called from block editor's Classic block. */ $mce_init = apply_filters( 'tiny_mce_before_init', $mce_init, $editor_id ); } if ( empty( $mce_init['toolbar3'] ) && ! empty( $mce_init['toolbar4'] ) ) { $mce_init['toolbar3'] = $mce_init['toolbar4']; $mce_init['toolbar4'] = ''; } self::$mce_settings[ $editor_id ] = $mce_init; } // End if self::$this_tinymce. } /** * @since 3.3.0 * * @param array $init * @return string */ private static function _parse_init( $init ) { $options = ''; foreach ( $init as $key => $value ) { if ( is_bool( $value ) ) { $val = $value ? 'true' : 'false'; $options .= $key . ':' . $val . ','; continue; } elseif ( ! empty( $value ) && is_string( $value ) && ( ( '{' === $value[0] && '}' === $value[ strlen( $value ) - 1 ] ) || ( '[' === $value[0] && ']' === $value[ strlen( $value ) - 1 ] ) || preg_match( '/^\(?function ?\(/', $value ) ) ) { $options .= $key . ':' . $value . ','; continue; } $options .= $key . ':"' . $value . '",'; } return '{' . trim( $options, ' ,' ) . '}'; } /** * @since 3.3.0 * * @param bool $default_scripts Optional. Whether default scripts should be enqueued. Default false. */ public static function enqueue_scripts( $default_scripts = false ) { if ( $default_scripts || self::$has_tinymce ) { wp_enqueue_script( 'editor' ); } if ( $default_scripts || self::$has_quicktags ) { wp_enqueue_script( 'quicktags' ); wp_enqueue_style( 'buttons' ); } if ( $default_scripts || in_array( 'wplink', self::$plugins, true ) || in_array( 'link', self::$qt_buttons, true ) ) { wp_enqueue_script( 'wplink' ); wp_enqueue_script( 'jquery-ui-autocomplete' ); } if ( self::$has_medialib ) { add_thickbox(); wp_enqueue_script( 'media-upload' ); wp_enqueue_script( 'wp-embed' ); } elseif ( $default_scripts ) { wp_enqueue_script( 'media-upload' ); } /** * Fires when scripts and styles are enqueued for the editor. * * @since 3.9.0 * * @param array $to_load An array containing boolean values whether TinyMCE * and Quicktags are being loaded. */ do_action( 'wp_enqueue_editor', array( 'tinymce' => ( $default_scripts || self::$has_tinymce ), 'quicktags' => ( $default_scripts || self::$has_quicktags ), ) ); } /** * Enqueue all editor scripts. * For use when the editor is going to be initialized after page load. * * @since 4.8.0 */ public static function enqueue_default_editor() { // We are past the point where scripts can be enqueued properly. if ( did_action( 'wp_enqueue_editor' ) ) { return; } self::enqueue_scripts( true ); // Also add wp-includes/css/editor.css. wp_enqueue_style( 'editor-buttons' ); if ( is_admin() ) { add_action( 'admin_print_footer_scripts', array( __CLASS__, 'force_uncompressed_tinymce' ), 1 ); add_action( 'admin_print_footer_scripts', array( __CLASS__, 'print_default_editor_scripts' ), 45 ); } else { add_action( 'wp_print_footer_scripts', array( __CLASS__, 'force_uncompressed_tinymce' ), 1 ); add_action( 'wp_print_footer_scripts', array( __CLASS__, 'print_default_editor_scripts' ), 45 ); } } /** * Print (output) all editor scripts and default settings. * For use when the editor is going to be initialized after page load. * * @since 4.8.0 */ public static function print_default_editor_scripts() { $user_can_richedit = user_can_richedit(); if ( $user_can_richedit ) { $settings = self::default_settings(); $settings['toolbar1'] = 'bold,italic,bullist,numlist,link'; $settings['wpautop'] = false; $settings['indent'] = true; $settings['elementpath'] = false; if ( is_rtl() ) { $settings['directionality'] = 'rtl'; } /* * In production all plugins are loaded (they are in wp-editor.js.gz). * The 'wpview', 'wpdialogs', and 'media' TinyMCE plugins are not initialized by default. * Can be added from js by using the 'wp-before-tinymce-init' event. */ $settings['plugins'] = implode( ',', array( 'charmap', 'colorpicker', 'hr', 'lists', 'paste', 'tabfocus', 'textcolor', 'fullscreen', 'wordpress', 'wpautoresize', 'wpeditimage', 'wpemoji', 'wpgallery', 'wplink', 'wptextpattern', ) ); $settings = self::_parse_init( $settings ); } else { $settings = '{}'; } ?> <script type="text/javascript"> window.wp = window.wp || {}; window.wp.editor = window.wp.editor || {}; window.wp.editor.getDefaultSettings = function() { return { tinymce: <?php echo $settings; ?>, quicktags: { buttons: 'strong,em,link,ul,ol,li,code' } }; }; <?php if ( $user_can_richedit ) { $suffix = SCRIPT_DEBUG ? '' : '.min'; $baseurl = self::get_baseurl(); ?> var tinyMCEPreInit = { baseURL: "<?php echo $baseurl; ?>", suffix: "<?php echo $suffix; ?>", mceInit: {}, qtInit: {}, load_ext: function(url,lang){var sl=tinymce.ScriptLoader;sl.markDone(url+'/langs/'+lang+'.js');sl.markDone(url+'/langs/'+lang+'_dlg.js');} }; <?php } ?> </script> <?php if ( $user_can_richedit ) { self::print_tinymce_scripts(); } /** * Fires when the editor scripts are loaded for later initialization, * after all scripts and settings are printed. * * @since 4.8.0 */ do_action( 'print_default_editor_scripts' ); self::wp_link_dialog(); } /** * Returns the TinyMCE locale. * * @since 4.8.0 * * @return string */ public static function get_mce_locale() { if ( empty( self::$mce_locale ) ) { $mce_locale = get_user_locale(); self::$mce_locale = empty( $mce_locale ) ? 'en' : strtolower( substr( $mce_locale, 0, 2 ) ); // ISO 639-1. } return self::$mce_locale; } /** * Returns the TinyMCE base URL. * * @since 4.8.0 * * @return string */ public static function get_baseurl() { if ( empty( self::$baseurl ) ) { self::$baseurl = includes_url( 'js/tinymce' ); } return self::$baseurl; } /** * Returns the default TinyMCE settings. * Doesn't include plugins, buttons, editor selector. * * @since 4.8.0 * * @global string $tinymce_version * * @return array */ private static function default_settings() { global $tinymce_version; $shortcut_labels = array(); foreach ( self::get_translation() as $name => $value ) { if ( is_array( $value ) ) { $shortcut_labels[ $name ] = $value[1]; } } $settings = array( 'theme' => 'modern', 'skin' => 'lightgray', 'language' => self::get_mce_locale(), 'formats' => '{' . 'alignleft: [' . '{selector: "p,h1,h2,h3,h4,h5,h6,td,th,div,ul,ol,li", styles: {textAlign:"left"}},' . '{selector: "img,table,dl.wp-caption", classes: "alignleft"}' . '],' . 'aligncenter: [' . '{selector: "p,h1,h2,h3,h4,h5,h6,td,th,div,ul,ol,li", styles: {textAlign:"center"}},' . '{selector: "img,table,dl.wp-caption", classes: "aligncenter"}' . '],' . 'alignright: [' . '{selector: "p,h1,h2,h3,h4,h5,h6,td,th,div,ul,ol,li", styles: {textAlign:"right"}},' . '{selector: "img,table,dl.wp-caption", classes: "alignright"}' . '],' . 'strikethrough: {inline: "del"}' . '}', 'relative_urls' => false, 'remove_script_host' => false, 'convert_urls' => false, 'browser_spellcheck' => true, 'fix_list_elements' => true, 'entities' => '38,amp,60,lt,62,gt', 'entity_encoding' => 'raw', 'keep_styles' => false, 'cache_suffix' => 'wp-mce-' . $tinymce_version, 'resize' => 'vertical', 'menubar' => false, 'branding' => false, // Limit the preview styles in the menu/toolbar. 'preview_styles' => 'font-family font-size font-weight font-style text-decoration text-transform', 'end_container_on_empty_block' => true, 'wpeditimage_html5_captions' => true, 'wp_lang_attr' => get_bloginfo( 'language' ), 'wp_shortcut_labels' => wp_json_encode( $shortcut_labels ), ); $suffix = SCRIPT_DEBUG ? '' : '.min'; $version = 'ver=' . get_bloginfo( 'version' ); // Default stylesheets. $settings['content_css'] = includes_url( "css/dashicons$suffix.css?$version" ) . ',' . includes_url( "js/tinymce/skins/wordpress/wp-content.css?$version" ); return $settings; } /** * @since 4.7.0 * * @return array */ private static function get_translation() { if ( empty( self::$translation ) ) { self::$translation = array( // Default TinyMCE strings. 'New document' => __( 'New document' ), 'Formats' => _x( 'Formats', 'TinyMCE' ), 'Headings' => _x( 'Headings', 'TinyMCE' ), 'Heading 1' => array( __( 'Heading 1' ), 'access1' ), 'Heading 2' => array( __( 'Heading 2' ), 'access2' ), 'Heading 3' => array( __( 'Heading 3' ), 'access3' ), 'Heading 4' => array( __( 'Heading 4' ), 'access4' ), 'Heading 5' => array( __( 'Heading 5' ), 'access5' ), 'Heading 6' => array( __( 'Heading 6' ), 'access6' ), /* translators: Block tags. */ 'Blocks' => _x( 'Blocks', 'TinyMCE' ), 'Paragraph' => array( __( 'Paragraph' ), 'access7' ), 'Blockquote' => array( __( 'Blockquote' ), 'accessQ' ), 'Div' => _x( 'Div', 'HTML tag' ), 'Pre' => _x( 'Pre', 'HTML tag' ), 'Preformatted' => _x( 'Preformatted', 'HTML tag' ), 'Address' => _x( 'Address', 'HTML tag' ), 'Inline' => _x( 'Inline', 'HTML elements' ), 'Underline' => array( __( 'Underline' ), 'metaU' ), 'Strikethrough' => array( __( 'Strikethrough' ), 'accessD' ), 'Subscript' => __( 'Subscript' ), 'Superscript' => __( 'Superscript' ), 'Clear formatting' => __( 'Clear formatting' ), 'Bold' => array( __( 'Bold' ), 'metaB' ), 'Italic' => array( __( 'Italic' ), 'metaI' ), 'Code' => array( __( 'Code' ), 'accessX' ), 'Source code' => __( 'Source code' ), 'Font Family' => __( 'Font Family' ), 'Font Sizes' => __( 'Font Sizes' ), 'Align center' => array( __( 'Align center' ), 'accessC' ), 'Align right' => array( __( 'Align right' ), 'accessR' ), 'Align left' => array( __( 'Align left' ), 'accessL' ), 'Justify' => array( __( 'Justify' ), 'accessJ' ), 'Increase indent' => __( 'Increase indent' ), 'Decrease indent' => __( 'Decrease indent' ), 'Cut' => array( __( 'Cut' ), 'metaX' ), 'Copy' => array( __( 'Copy' ), 'metaC' ), 'Paste' => array( __( 'Paste' ), 'metaV' ), 'Select all' => array( __( 'Select all' ), 'metaA' ), 'Undo' => array( __( 'Undo' ), 'metaZ' ), 'Redo' => array( __( 'Redo' ), 'metaY' ), 'Ok' => __( 'OK' ), 'Cancel' => __( 'Cancel' ), 'Close' => __( 'Close' ), 'Visual aids' => __( 'Visual aids' ), 'Bullet list' => array( __( 'Bulleted list' ), 'accessU' ), 'Numbered list' => array( __( 'Numbered list' ), 'accessO' ), 'Square' => _x( 'Square', 'list style' ), 'Default' => _x( 'Default', 'list style' ), 'Circle' => _x( 'Circle', 'list style' ), 'Disc' => _x( 'Disc', 'list style' ), 'Lower Greek' => _x( 'Lower Greek', 'list style' ), 'Lower Alpha' => _x( 'Lower Alpha', 'list style' ), 'Upper Alpha' => _x( 'Upper Alpha', 'list style' ), 'Upper Roman' => _x( 'Upper Roman', 'list style' ), 'Lower Roman' => _x( 'Lower Roman', 'list style' ), // Anchor plugin. 'Name' => _x( 'Name', 'Name of link anchor (TinyMCE)' ), 'Anchor' => _x( 'Anchor', 'Link anchor (TinyMCE)' ), 'Anchors' => _x( 'Anchors', 'Link anchors (TinyMCE)' ), 'Id should start with a letter, followed only by letters, numbers, dashes, dots, colons or underscores.' => __( 'Id should start with a letter, followed only by letters, numbers, dashes, dots, colons or underscores.' ), 'Id' => _x( 'Id', 'Id for link anchor (TinyMCE)' ), // Fullpage plugin. 'Document properties' => __( 'Document properties' ), 'Robots' => __( 'Robots' ), 'Title' => __( 'Title' ), 'Keywords' => __( 'Keywords' ), 'Encoding' => __( 'Encoding' ), 'Description' => __( 'Description' ), 'Author' => __( 'Author' ), // Media, image plugins. 'Image' => __( 'Image' ), 'Insert/edit image' => array( __( 'Insert/edit image' ), 'accessM' ), 'General' => __( 'General' ), 'Advanced' => __( 'Advanced' ), 'Source' => __( 'Source' ), 'Border' => __( 'Border' ), 'Constrain proportions' => __( 'Constrain proportions' ), 'Vertical space' => __( 'Vertical space' ), 'Image description' => __( 'Image description' ), 'Style' => __( 'Style' ), 'Dimensions' => __( 'Dimensions' ), 'Insert image' => __( 'Insert image' ), 'Date/time' => __( 'Date/time' ), 'Insert date/time' => __( 'Insert date/time' ), 'Table of Contents' => __( 'Table of Contents' ), 'Insert/Edit code sample' => __( 'Insert/edit code sample' ), 'Language' => __( 'Language' ), 'Media' => __( 'Media' ), 'Insert/edit media' => __( 'Insert/edit media' ), 'Poster' => __( 'Poster' ), 'Alternative source' => __( 'Alternative source' ), 'Paste your embed code below:' => __( 'Paste your embed code below:' ), 'Insert video' => __( 'Insert video' ), 'Embed' => __( 'Embed' ), // Each of these have a corresponding plugin. 'Special character' => __( 'Special character' ), 'Right to left' => _x( 'Right to left', 'editor button' ), 'Left to right' => _x( 'Left to right', 'editor button' ), 'Emoticons' => __( 'Emoticons' ), 'Nonbreaking space' => __( 'Nonbreaking space' ), 'Page break' => __( 'Page break' ), 'Paste as text' => __( 'Paste as text' ), 'Preview' => __( 'Preview' ), 'Print' => __( 'Print' ), 'Save' => __( 'Save' ), 'Fullscreen' => __( 'Fullscreen' ), 'Horizontal line' => __( 'Horizontal line' ), 'Horizontal space' => __( 'Horizontal space' ), 'Restore last draft' => __( 'Restore last draft' ), 'Insert/edit link' => array( __( 'Insert/edit link' ), 'metaK' ), 'Remove link' => array( __( 'Remove link' ), 'accessS' ), // Link plugin. 'Link' => __( 'Link' ), 'Insert link' => __( 'Insert link' ), 'Target' => __( 'Target' ), 'New window' => __( 'New window' ), 'Text to display' => __( 'Text to display' ), 'Url' => __( 'URL' ), 'The URL you entered seems to be an email address. Do you want to add the required mailto: prefix?' => __( 'The URL you entered seems to be an email address. Do you want to add the required mailto: prefix?' ), 'The URL you entered seems to be an external link. Do you want to add the required http:// prefix?' => __( 'The URL you entered seems to be an external link. Do you want to add the required http:// prefix?' ), 'Color' => __( 'Color' ), 'Custom color' => __( 'Custom color' ), 'Custom...' => _x( 'Custom...', 'label for custom color' ), // No ellipsis. 'No color' => __( 'No color' ), 'R' => _x( 'R', 'Short for red in RGB' ), 'G' => _x( 'G', 'Short for green in RGB' ), 'B' => _x( 'B', 'Short for blue in RGB' ), // Spelling, search/replace plugins. 'Could not find the specified string.' => __( 'Could not find the specified string.' ), 'Replace' => _x( 'Replace', 'find/replace' ), 'Next' => _x( 'Next', 'find/replace' ), /* translators: Previous. */ 'Prev' => _x( 'Prev', 'find/replace' ), 'Whole words' => _x( 'Whole words', 'find/replace' ), 'Find and replace' => __( 'Find and replace' ), 'Replace with' => _x( 'Replace with', 'find/replace' ), 'Find' => _x( 'Find', 'find/replace' ), 'Replace all' => _x( 'Replace all', 'find/replace' ), 'Match case' => __( 'Match case' ), 'Spellcheck' => __( 'Check Spelling' ), 'Finish' => _x( 'Finish', 'spellcheck' ), 'Ignore all' => _x( 'Ignore all', 'spellcheck' ), 'Ignore' => _x( 'Ignore', 'spellcheck' ), 'Add to Dictionary' => __( 'Add to Dictionary' ), // TinyMCE tables. 'Insert table' => __( 'Insert table' ), 'Delete table' => __( 'Delete table' ), 'Table properties' => __( 'Table properties' ), 'Row properties' => __( 'Table row properties' ), 'Cell properties' => __( 'Table cell properties' ), 'Border color' => __( 'Border color' ), 'Row' => __( 'Row' ), 'Rows' => __( 'Rows' ), 'Column' => __( 'Column' ), 'Cols' => __( 'Columns' ), 'Cell' => _x( 'Cell', 'table cell' ), 'Header cell' => __( 'Header cell' ), 'Header' => _x( 'Header', 'table header' ), 'Body' => _x( 'Body', 'table body' ), 'Footer' => _x( 'Footer', 'table footer' ), 'Insert row before' => __( 'Insert row before' ), 'Insert row after' => __( 'Insert row after' ), 'Insert column before' => __( 'Insert column before' ), 'Insert column after' => __( 'Insert column after' ), 'Paste row before' => __( 'Paste table row before' ), 'Paste row after' => __( 'Paste table row after' ), 'Delete row' => __( 'Delete row' ), 'Delete column' => __( 'Delete column' ), 'Cut row' => __( 'Cut table row' ), 'Copy row' => __( 'Copy table row' ), 'Merge cells' => __( 'Merge table cells' ), 'Split cell' => __( 'Split table cell' ), 'Height' => __( 'Height' ), 'Width' => __( 'Width' ), 'Caption' => __( 'Caption' ), 'Alignment' => __( 'Alignment' ), 'H Align' => _x( 'H Align', 'horizontal table cell alignment' ), 'Left' => __( 'Left' ), 'Center' => __( 'Center' ), 'Right' => __( 'Right' ), 'None' => _x( 'None', 'table cell alignment attribute' ), 'V Align' => _x( 'V Align', 'vertical table cell alignment' ), 'Top' => __( 'Top' ), 'Middle' => __( 'Middle' ), 'Bottom' => __( 'Bottom' ), 'Row group' => __( 'Row group' ), 'Column group' => __( 'Column group' ), 'Row type' => __( 'Row type' ), 'Cell type' => __( 'Cell type' ), 'Cell padding' => __( 'Cell padding' ), 'Cell spacing' => __( 'Cell spacing' ), 'Scope' => _x( 'Scope', 'table cell scope attribute' ), 'Insert template' => _x( 'Insert template', 'TinyMCE' ), 'Templates' => _x( 'Templates', 'TinyMCE' ), 'Background color' => __( 'Background color' ), 'Text color' => __( 'Text color' ), 'Show blocks' => _x( 'Show blocks', 'editor button' ), 'Show invisible characters' => __( 'Show invisible characters' ), /* translators: Word count. */ 'Words: {0}' => sprintf( __( 'Words: %s' ), '{0}' ), 'Paste is now in plain text mode. Contents will now be pasted as plain text until you toggle this option off.' => __( 'Paste is now in plain text mode. Contents will now be pasted as plain text until you toggle this option off.' ) . "\n\n" . __( 'If you are looking to paste rich content from Microsoft Word, try turning this option off. The editor will clean up text pasted from Word automatically.' ), 'Rich Text Area. Press ALT-F9 for menu. Press ALT-F10 for toolbar. Press ALT-0 for help' => __( 'Rich Text Area. Press Alt-Shift-H for help.' ), 'Rich Text Area. Press Control-Option-H for help.' => __( 'Rich Text Area. Press Control-Option-H for help.' ), 'You have unsaved changes are you sure you want to navigate away?' => __( 'The changes you made will be lost if you navigate away from this page.' ), 'Your browser doesn\'t support direct access to the clipboard. Please use the Ctrl+X/C/V keyboard shortcuts instead.' => __( 'Your browser does not support direct access to the clipboard. Please use keyboard shortcuts or your browser’s edit menu instead.' ), // TinyMCE menus. 'Insert' => _x( 'Insert', 'TinyMCE menu' ), 'File' => _x( 'File', 'TinyMCE menu' ), 'Edit' => _x( 'Edit', 'TinyMCE menu' ), 'Tools' => _x( 'Tools', 'TinyMCE menu' ), 'View' => _x( 'View', 'TinyMCE menu' ), 'Table' => _x( 'Table', 'TinyMCE menu' ), 'Format' => _x( 'Format', 'TinyMCE menu' ), // WordPress strings. 'Toolbar Toggle' => array( __( 'Toolbar Toggle' ), 'accessZ' ), 'Insert Read More tag' => array( __( 'Insert Read More tag' ), 'accessT' ), 'Insert Page Break tag' => array( __( 'Insert Page Break tag' ), 'accessP' ), 'Read more...' => __( 'Read more...' ), // Title on the placeholder inside the editor (no ellipsis). 'Distraction-free writing mode' => array( __( 'Distraction-free writing mode' ), 'accessW' ), 'No alignment' => __( 'No alignment' ), // Tooltip for the 'alignnone' button in the image toolbar. 'Remove' => __( 'Remove' ), // Tooltip for the 'remove' button in the image toolbar. 'Edit|button' => __( 'Edit' ), // Tooltip for the 'edit' button in the image toolbar. 'Paste URL or type to search' => __( 'Paste URL or type to search' ), // Placeholder for the inline link dialog. 'Apply' => __( 'Apply' ), // Tooltip for the 'apply' button in the inline link dialog. 'Link options' => __( 'Link options' ), // Tooltip for the 'link options' button in the inline link dialog. 'Visual' => _x( 'Visual', 'Name for the Visual editor tab' ), // Editor switch tab label. 'Code|tab' => _x( 'Code', 'Name for the Code editor tab (formerly Text)' ), // Editor switch tab label. 'Add Media' => array( __( 'Add Media' ), 'accessM' ), // Tooltip for the 'Add Media' button in the block editor Classic block. // Shortcuts help modal. 'Keyboard Shortcuts' => array( __( 'Keyboard Shortcuts' ), 'accessH' ), 'Classic Block Keyboard Shortcuts' => __( 'Classic Block Keyboard Shortcuts' ), 'Default shortcuts,' => __( 'Default shortcuts,' ), 'Additional shortcuts,' => __( 'Additional shortcuts,' ), 'Focus shortcuts:' => __( 'Focus shortcuts:' ), 'Inline toolbar (when an image, link or preview is selected)' => __( 'Inline toolbar (when an image, link or preview is selected)' ), 'Editor menu (when enabled)' => __( 'Editor menu (when enabled)' ), 'Editor toolbar' => __( 'Editor toolbar' ), 'Elements path' => __( 'Elements path' ), 'Ctrl + Alt + letter:' => __( 'Ctrl + Alt + letter:' ), 'Shift + Alt + letter:' => __( 'Shift + Alt + letter:' ), 'Cmd + letter:' => __( 'Cmd + letter:' ), 'Ctrl + letter:' => __( 'Ctrl + letter:' ), 'Letter' => __( 'Letter' ), 'Action' => __( 'Action' ), 'Warning: the link has been inserted but may have errors. Please test it.' => __( 'Warning: the link has been inserted but may have errors. Please test it.' ), 'To move focus to other buttons use Tab or the arrow keys. To return focus to the editor press Escape or use one of the buttons.' => __( 'To move focus to other buttons use Tab or the arrow keys. To return focus to the editor press Escape or use one of the buttons.' ), 'When starting a new paragraph with one of these formatting shortcuts followed by a space, the formatting will be applied automatically. Press Backspace or Escape to undo.' => __( 'When starting a new paragraph with one of these formatting shortcuts followed by a space, the formatting will be applied automatically. Press Backspace or Escape to undo.' ), 'The following formatting shortcuts are replaced when pressing Enter. Press Escape or the Undo button to undo.' => __( 'The following formatting shortcuts are replaced when pressing Enter. Press Escape or the Undo button to undo.' ), 'The next group of formatting shortcuts are applied as you type or when you insert them around plain text in the same paragraph. Press Escape or the Undo button to undo.' => __( 'The next group of formatting shortcuts are applied as you type or when you insert them around plain text in the same paragraph. Press Escape or the Undo button to undo.' ), ); } /* Imagetools plugin (not included): 'Edit image' => __( 'Edit image' ), 'Image options' => __( 'Image options' ), 'Back' => __( 'Back' ), 'Invert' => __( 'Invert' ), 'Flip horizontally' => __( 'Flip horizontal' ), 'Flip vertically' => __( 'Flip vertical' ), 'Crop' => __( 'Crop' ), 'Orientation' => __( 'Orientation' ), 'Resize' => __( 'Resize' ), 'Rotate clockwise' => __( 'Rotate right' ), 'Rotate counterclockwise' => __( 'Rotate left' ), 'Sharpen' => __( 'Sharpen' ), 'Brightness' => __( 'Brightness' ), 'Color levels' => __( 'Color levels' ), 'Contrast' => __( 'Contrast' ), 'Gamma' => __( 'Gamma' ), 'Zoom in' => __( 'Zoom in' ), 'Zoom out' => __( 'Zoom out' ), */ return self::$translation; } /** * Translates the default TinyMCE strings and returns them as JSON encoded object ready to be loaded with tinymce.addI18n(), * or as JS snippet that should run after tinymce.js is loaded. * * @since 3.9.0 * * @param string $mce_locale The locale used for the editor. * @param bool $json_only Optional. Whether to include the JavaScript calls to tinymce.addI18n() and * tinymce.ScriptLoader.markDone(). Default false. * @return string Translation object, JSON encoded. */ public static function wp_mce_translation( $mce_locale = '', $json_only = false ) { if ( ! $mce_locale ) { $mce_locale = self::get_mce_locale(); } $mce_translation = self::get_translation(); foreach ( $mce_translation as $name => $value ) { if ( is_array( $value ) ) { $mce_translation[ $name ] = $value[0]; } } /** * Filters translated strings prepared for TinyMCE. * * @since 3.9.0 * * @param array $mce_translation Key/value pairs of strings. * @param string $mce_locale Locale. */ $mce_translation = apply_filters( 'wp_mce_translation', $mce_translation, $mce_locale ); foreach ( $mce_translation as $key => $value ) { // Remove strings that are not translated. if ( $key === $value ) { unset( $mce_translation[ $key ] ); continue; } if ( str_contains( $value, '&' ) ) { $mce_translation[ $key ] = html_entity_decode( $value, ENT_QUOTES, 'UTF-8' ); } } // Set direction. if ( is_rtl() ) { $mce_translation['_dir'] = 'rtl'; } if ( $json_only ) { return wp_json_encode( $mce_translation ); } $baseurl = self::get_baseurl(); return "tinymce.addI18n( '$mce_locale', " . wp_json_encode( $mce_translation ) . ");\n" . "tinymce.ScriptLoader.markDone( '$baseurl/langs/$mce_locale.js' );\n"; } /** * Force uncompressed TinyMCE when a custom theme has been defined. * * The compressed TinyMCE file cannot deal with custom themes, so this makes * sure that WordPress uses the uncompressed TinyMCE file if a theme is defined. * Even if the website is running on a production environment. * * @since 5.0.0 */ public static function force_uncompressed_tinymce() { $has_custom_theme = false; foreach ( self::$mce_settings as $init ) { if ( ! empty( $init['theme_url'] ) ) { $has_custom_theme = true; break; } } if ( ! $has_custom_theme ) { return; } $wp_scripts = wp_scripts(); $wp_scripts->remove( 'wp-tinymce' ); wp_register_tinymce_scripts( $wp_scripts, true ); } /** * Print (output) the main TinyMCE scripts. * * @since 4.8.0 * * @global bool $concatenate_scripts */ public static function print_tinymce_scripts() { global $concatenate_scripts; if ( self::$tinymce_scripts_printed ) { return; } self::$tinymce_scripts_printed = true; if ( ! isset( $concatenate_scripts ) ) { script_concat_settings(); } wp_print_scripts( array( 'wp-tinymce' ) ); echo "<script type='text/javascript'>\n" . self::wp_mce_translation() . "</script>\n"; } /** * Print (output) the TinyMCE configuration and initialization scripts. * * @since 3.3.0 * * @global string $tinymce_version */ public static function editor_js() { global $tinymce_version; $tmce_on = ! empty( self::$mce_settings ); $mce_init = ''; $qt_init = ''; if ( $tmce_on ) { foreach ( self::$mce_settings as $editor_id => $init ) { $options = self::_parse_init( $init ); $mce_init .= "'$editor_id':{$options},"; } $mce_init = '{' . trim( $mce_init, ',' ) . '}'; } else { $mce_init = '{}'; } if ( ! empty( self::$qt_settings ) ) { foreach ( self::$qt_settings as $editor_id => $init ) { $options = self::_parse_init( $init ); $qt_init .= "'$editor_id':{$options},"; } $qt_init = '{' . trim( $qt_init, ',' ) . '}'; } else { $qt_init = '{}'; } $ref = array( 'plugins' => implode( ',', self::$plugins ), 'theme' => 'modern', 'language' => self::$mce_locale, ); $suffix = SCRIPT_DEBUG ? '' : '.min'; $baseurl = self::get_baseurl(); $version = 'ver=' . $tinymce_version; /** * Fires immediately before the TinyMCE settings are printed. * * @since 3.2.0 * * @param array $mce_settings TinyMCE settings array. */ do_action( 'before_wp_tiny_mce', self::$mce_settings ); ?> <script type="text/javascript"> tinyMCEPreInit = { baseURL: "<?php echo $baseurl; ?>", suffix: "<?php echo $suffix; ?>", <?php if ( self::$drag_drop_upload ) { echo 'dragDropUpload: true,'; } ?> mceInit: <?php echo $mce_init; ?>, qtInit: <?php echo $qt_init; ?>, ref: <?php echo self::_parse_init( $ref ); ?>, load_ext: function(url,lang){var sl=tinymce.ScriptLoader;sl.markDone(url+'/langs/'+lang+'.js');sl.markDone(url+'/langs/'+lang+'_dlg.js');} }; </script> <?php if ( $tmce_on ) { self::print_tinymce_scripts(); if ( self::$ext_plugins ) { // Load the old-format English strings to prevent unsightly labels in old style popups. echo "<script type='text/javascript' src='{$baseurl}/langs/wp-langs-en.js?$version'></script>\n"; } } /** * Fires after tinymce.js is loaded, but before any TinyMCE editor * instances are created. * * @since 3.9.0 * * @param array $mce_settings TinyMCE settings array. */ do_action( 'wp_tiny_mce_init', self::$mce_settings ); ?> <script type="text/javascript"> <?php if ( self::$ext_plugins ) { echo self::$ext_plugins . "\n"; } if ( ! is_admin() ) { echo 'var ajaxurl = "' . admin_url( 'admin-ajax.php', 'relative' ) . '";'; } ?> ( function() { var initialized = []; var initialize = function() { var init, id, inPostbox, $wrap; var readyState = document.readyState; if ( readyState !== 'complete' && readyState !== 'interactive' ) { return; } for ( id in tinyMCEPreInit.mceInit ) { if ( initialized.indexOf( id ) > -1 ) { continue; } init = tinyMCEPreInit.mceInit[id]; $wrap = tinymce.$( '#wp-' + id + '-wrap' ); inPostbox = $wrap.parents( '.postbox' ).length > 0; if ( ! init.wp_skip_init && ( $wrap.hasClass( 'tmce-active' ) || ! tinyMCEPreInit.qtInit.hasOwnProperty( id ) ) && ( readyState === 'complete' || ( ! inPostbox && readyState === 'interactive' ) ) ) { tinymce.init( init ); initialized.push( id ); if ( ! window.wpActiveEditor ) { window.wpActiveEditor = id; } } } } if ( typeof tinymce !== 'undefined' ) { if ( tinymce.Env.ie && tinymce.Env.ie < 11 ) { tinymce.$( '.wp-editor-wrap ' ).removeClass( 'tmce-active' ).addClass( 'html-active' ); } else { if ( document.readyState === 'complete' ) { initialize(); } else { document.addEventListener( 'readystatechange', initialize ); } } } if ( typeof quicktags !== 'undefined' ) { for ( id in tinyMCEPreInit.qtInit ) { quicktags( tinyMCEPreInit.qtInit[id] ); if ( ! window.wpActiveEditor ) { window.wpActiveEditor = id; } } } }()); </script> <?php if ( in_array( 'wplink', self::$plugins, true ) || in_array( 'link', self::$qt_buttons, true ) ) { self::wp_link_dialog(); } /** * Fires after any core TinyMCE editor instances are created. * * @since 3.2.0 * * @param array $mce_settings TinyMCE settings array. */ do_action( 'after_wp_tiny_mce', self::$mce_settings ); } /** * Outputs the HTML for distraction-free writing mode. * * @since 3.2.0 * @deprecated 4.3.0 */ public static function wp_fullscreen_html() { _deprecated_function( __FUNCTION__, '4.3.0' ); } /** * Performs post queries for internal linking. * * @since 3.1.0 * * @param array $args { * Optional. Array of link query arguments. * * @type int $pagenum Page number. Default 1. * @type string $s Search keywords. * } * @return array|false $results { * An array of associative arrays of query results, false if there are none. * * @type array ...$0 { * @type int $ID Post ID. * @type string $title The trimmed, escaped post title. * @type string $permalink Post permalink. * @type string $info A 'Y/m/d'-formatted date for 'post' post type, * the 'singular_name' post type label otherwise. * } * } */ public static function wp_link_query( $args = array() ) { $pts = get_post_types( array( 'public' => true ), 'objects' ); $pt_names = array_keys( $pts ); $query = array( 'post_type' => $pt_names, 'suppress_filters' => true, 'update_post_term_cache' => false, 'update_post_meta_cache' => false, 'post_status' => 'publish', 'posts_per_page' => 20, ); $args['pagenum'] = isset( $args['pagenum'] ) ? absint( $args['pagenum'] ) : 1; if ( isset( $args['s'] ) ) { $query['s'] = $args['s']; } $query['offset'] = $args['pagenum'] > 1 ? $query['posts_per_page'] * ( $args['pagenum'] - 1 ) : 0; /** * Filters the link query arguments. * * Allows modification of the link query arguments before querying. * * @see WP_Query for a full list of arguments * * @since 3.7.0 * * @param array $query An array of WP_Query arguments. */ $query = apply_filters( 'wp_link_query_args', $query ); // Do main query. $get_posts = new WP_Query(); $posts = $get_posts->query( $query ); // Build results. $results = array(); foreach ( $posts as $post ) { if ( 'post' === $post->post_type ) { $info = mysql2date( __( 'Y/m/d' ), $post->post_date ); } else { $info = $pts[ $post->post_type ]->labels->singular_name; } $results[] = array( 'ID' => $post->ID, 'title' => trim( esc_html( strip_tags( get_the_title( $post ) ) ) ), 'permalink' => get_permalink( $post->ID ), 'info' => $info, ); } /** * Filters the link query results. * * Allows modification of the returned link query results. * * @since 3.7.0 * * @see 'wp_link_query_args' filter * * @param array $results { * An array of associative arrays of query results. * * @type array ...$0 { * @type int $ID Post ID. * @type string $title The trimmed, escaped post title. * @type string $permalink Post permalink. * @type string $info A 'Y/m/d'-formatted date for 'post' post type, * the 'singular_name' post type label otherwise. * } * } * @param array $query An array of WP_Query arguments. */ $results = apply_filters( 'wp_link_query', $results, $query ); return ! empty( $results ) ? $results : false; } /** * Dialog for internal linking. * * @since 3.1.0 */ public static function wp_link_dialog() { // Run once. if ( self::$link_dialog_printed ) { return; } self::$link_dialog_printed = true; // `display: none` is required here, see #WP27605. ?> <div id="wp-link-backdrop" style="display: none"></div> <div id="wp-link-wrap" class="wp-core-ui" style="display: none" role="dialog" aria-modal="true" aria-labelledby="link-modal-title"> <form id="wp-link" tabindex="-1"> <?php wp_nonce_field( 'internal-linking', '_ajax_linking_nonce', false ); ?> <h1 id="link-modal-title"><?php _e( 'Insert/edit link' ); ?></h1> <button type="button" id="wp-link-close"><span class="screen-reader-text"> <?php /* translators: Hidden accessibility text. */ _e( 'Close' ); ?> </span></button> <div id="link-selector"> <div id="link-options"> <p class="howto" id="wplink-enter-url"><?php _e( 'Enter the destination URL' ); ?></p> <div> <label><span><?php _e( 'URL' ); ?></span> <input id="wp-link-url" type="text" aria-describedby="wplink-enter-url" /></label> </div> <div class="wp-link-text-field"> <label><span><?php _e( 'Link Text' ); ?></span> <input id="wp-link-text" type="text" /></label> </div> <div class="link-target"> <label><span></span> <input type="checkbox" id="wp-link-target" /> <?php _e( 'Open link in a new tab' ); ?></label> </div> </div> <p class="howto" id="wplink-link-existing-content"><?php _e( 'Or link to existing content' ); ?></p> <div id="search-panel"> <div class="link-search-wrapper"> <label> <span class="search-label"><?php _e( 'Search' ); ?></span> <input type="search" id="wp-link-search" class="link-search-field" autocomplete="off" aria-describedby="wplink-link-existing-content" /> <span class="spinner"></span> </label> </div> <div id="search-results" class="query-results" tabindex="0"> <ul></ul> <div class="river-waiting"> <span class="spinner"></span> </div> </div> <div id="most-recent-results" class="query-results" tabindex="0"> <div class="query-notice" id="query-notice-message"> <em class="query-notice-default"><?php _e( 'No search term specified. Showing recent items.' ); ?></em> <em class="query-notice-hint screen-reader-text"> <?php /* translators: Hidden accessibility text. */ _e( 'Search or use up and down arrow keys to select an item.' ); ?> </em> </div> <ul></ul> <div class="river-waiting"> <span class="spinner"></span> </div> </div> </div> </div> <div class="submitbox"> <div id="wp-link-cancel"> <button type="button" class="button"><?php _e( 'Cancel' ); ?></button> </div> <div id="wp-link-update"> <input type="submit" value="<?php esc_attr_e( 'Add Link' ); ?>" class="button button-primary" id="wp-link-submit" name="wp-link-submit"> </div> </div> </form> </div> <?php } } class-wp-dependency.php 0000666 00000005111 15226557730 0011140 0 ustar 00 <?php /** * Dependencies API: _WP_Dependency class * * @since 4.7.0 * * @package WordPress * @subpackage Dependencies */ /** * Class _WP_Dependency * * Helper class to register a handle and associated data. * * @access private * @since 2.6.0 */ #[AllowDynamicProperties] class _WP_Dependency { /** * The handle name. * * @since 2.6.0 * @var string */ public $handle; /** * The handle source. * * If source is set to false, the item is an alias of other items it depends on. * * @since 2.6.0 * @var string|false */ public $src; /** * An array of handle dependencies. * * @since 2.6.0 * @var string[] */ public $deps = array(); /** * The handle version. * * Used for cache-busting. * * @since 2.6.0 * @var string|false|null */ public $ver = false; /** * Additional arguments for the handle. * * @since 2.6.0 * @var mixed */ public $args = null; // Custom property, such as $in_footer or $media. /** * Extra data to supply to the handle. * * @since 2.6.0 * @var array */ public $extra = array(); /** * Translation textdomain set for this dependency. * * @since 5.0.0 * @var string */ public $textdomain; /** * Translation path set for this dependency. * * @since 5.0.0 * @var string */ public $translations_path; /** * Setup dependencies. * * @since 2.6.0 * @since 5.3.0 Formalized the existing `...$args` parameter by adding it * to the function signature. * * @param mixed ...$args Dependency information. */ public function __construct( ...$args ) { list( $this->handle, $this->src, $this->deps, $this->ver, $this->args ) = $args; if ( ! is_array( $this->deps ) ) { $this->deps = array(); } } /** * Add handle data. * * @since 2.6.0 * * @param string $name The data key to add. * @param mixed $data The data value to add. * @return bool False if not scalar, true otherwise. */ public function add_data( $name, $data ) { if ( ! is_scalar( $name ) ) { return false; } $this->extra[ $name ] = $data; return true; } /** * Sets the translation domain for this dependency. * * @since 5.0.0 * * @param string $domain The translation textdomain. * @param string $path Optional. The full file path to the directory containing translation files. * @return bool False if $domain is not a string, true otherwise. */ public function set_translations( $domain, $path = '' ) { if ( ! is_string( $domain ) ) { return false; } $this->textdomain = $domain; $this->translations_path = $path; return true; } } https-migration-20260606092011.php 0000666 00000011205 15226557730 0012005 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } class-wp-term.php 0000666 00000012262 15226557730 0007776 0 ustar 00 <?php /** * Taxonomy API: WP_Term class * * @package WordPress * @subpackage Taxonomy * @since 4.4.0 */ /** * Core class used to implement the WP_Term object. * * @since 4.4.0 * * @property-read object $data Sanitized term data. */ #[AllowDynamicProperties] final class WP_Term { /** * Term ID. * * @since 4.4.0 * @var int */ public $term_id; /** * The term's name. * * @since 4.4.0 * @var string */ public $name = ''; /** * The term's slug. * * @since 4.4.0 * @var string */ public $slug = ''; /** * The term's term_group. * * @since 4.4.0 * @var int */ public $term_group = ''; /** * Term Taxonomy ID. * * @since 4.4.0 * @var int */ public $term_taxonomy_id = 0; /** * The term's taxonomy name. * * @since 4.4.0 * @var string */ public $taxonomy = ''; /** * The term's description. * * @since 4.4.0 * @var string */ public $description = ''; /** * ID of a term's parent term. * * @since 4.4.0 * @var int */ public $parent = 0; /** * Cached object count for this term. * * @since 4.4.0 * @var int */ public $count = 0; /** * Stores the term object's sanitization level. * * Does not correspond to a database field. * * @since 4.4.0 * @var string */ public $filter = 'raw'; /** * Retrieve WP_Term instance. * * @since 4.4.0 * * @global wpdb $wpdb WordPress database abstraction object. * * @param int $term_id Term ID. * @param string $taxonomy Optional. Limit matched terms to those matching `$taxonomy`. Only used for * disambiguating potentially shared terms. * @return WP_Term|WP_Error|false Term object, if found. WP_Error if `$term_id` is shared between taxonomies and * there's insufficient data to distinguish which term is intended. * False for other failures. */ public static function get_instance( $term_id, $taxonomy = null ) { global $wpdb; $term_id = (int) $term_id; if ( ! $term_id ) { return false; } $_term = wp_cache_get( $term_id, 'terms' ); // If there isn't a cached version, hit the database. if ( ! $_term || ( $taxonomy && $taxonomy !== $_term->taxonomy ) ) { // Any term found in the cache is not a match, so don't use it. $_term = false; // Grab all matching terms, in case any are shared between taxonomies. $terms = $wpdb->get_results( $wpdb->prepare( "SELECT t.*, tt.* FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy AS tt ON t.term_id = tt.term_id WHERE t.term_id = %d", $term_id ) ); if ( ! $terms ) { return false; } // If a taxonomy was specified, find a match. if ( $taxonomy ) { foreach ( $terms as $match ) { if ( $taxonomy === $match->taxonomy ) { $_term = $match; break; } } // If only one match was found, it's the one we want. } elseif ( 1 === count( $terms ) ) { $_term = reset( $terms ); // Otherwise, the term must be shared between taxonomies. } else { // If the term is shared only with invalid taxonomies, return the one valid term. foreach ( $terms as $t ) { if ( ! taxonomy_exists( $t->taxonomy ) ) { continue; } // Only hit if we've already identified a term in a valid taxonomy. if ( $_term ) { return new WP_Error( 'ambiguous_term_id', __( 'Term ID is shared between multiple taxonomies' ), $term_id ); } $_term = $t; } } if ( ! $_term ) { return false; } // Don't return terms from invalid taxonomies. if ( ! taxonomy_exists( $_term->taxonomy ) ) { return new WP_Error( 'invalid_taxonomy', __( 'Invalid taxonomy.' ) ); } $_term = sanitize_term( $_term, $_term->taxonomy, 'raw' ); // Don't cache terms that are shared between taxonomies. if ( 1 === count( $terms ) ) { wp_cache_add( $term_id, $_term, 'terms' ); } } $term_obj = new WP_Term( $_term ); $term_obj->filter( $term_obj->filter ); return $term_obj; } /** * Constructor. * * @since 4.4.0 * * @param WP_Term|object $term Term object. */ public function __construct( $term ) { foreach ( get_object_vars( $term ) as $key => $value ) { $this->$key = $value; } } /** * Sanitizes term fields, according to the filter type provided. * * @since 4.4.0 * * @param string $filter Filter context. Accepts 'edit', 'db', 'display', 'attribute', 'js', 'rss', or 'raw'. */ public function filter( $filter ) { sanitize_term( $this, $this->taxonomy, $filter ); } /** * Converts an object to array. * * @since 4.4.0 * * @return array Object as array. */ public function to_array() { return get_object_vars( $this ); } /** * Getter. * * @since 4.4.0 * * @param string $key Property to get. * @return mixed Property value. */ public function __get( $key ) { switch ( $key ) { case 'data': $data = new stdClass(); $columns = array( 'term_id', 'name', 'slug', 'term_group', 'term_taxonomy_id', 'taxonomy', 'description', 'parent', 'count' ); foreach ( $columns as $column ) { $data->{$column} = isset( $this->{$column} ) ? $this->{$column} : null; } return sanitize_term( $data, $data->taxonomy, 'raw' ); } } } https-detection.php 0000666 00000013341 15226557730 0010415 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } class-wp-network.php 0000666 00000030010 15226557730 0010507 0 ustar 00 <?php /** * Network API: WP_Network class * * @package WordPress * @subpackage Multisite * @since 4.4.0 */ /** * Core class used for interacting with a multisite network. * * This class is used during load to populate the `$current_site` global and * setup the current network. * * This class is most useful in WordPress multi-network installations where the * ability to interact with any network of sites is required. * * @since 4.4.0 * * @property int $id * @property int $site_id */ #[AllowDynamicProperties] class WP_Network { /** * Network ID. * * @since 4.4.0 * @since 4.6.0 Converted from public to private to explicitly enable more intuitive * access via magic methods. As part of the access change, the type was * also changed from `string` to `int`. * @var int */ private $id; /** * Domain of the network. * * @since 4.4.0 * @var string */ public $domain = ''; /** * Path of the network. * * @since 4.4.0 * @var string */ public $path = ''; /** * The ID of the network's main site. * * Named "blog" vs. "site" for legacy reasons. A main site is mapped to * the network when the network is created. * * A numeric string, for compatibility reasons. * * @since 4.4.0 * @var string */ private $blog_id = '0'; /** * Domain used to set cookies for this network. * * @since 4.4.0 * @var string */ public $cookie_domain = ''; /** * Name of this network. * * Named "site" vs. "network" for legacy reasons. * * @since 4.4.0 * @var string */ public $site_name = ''; /** * Retrieves a network from the database by its ID. * * @since 4.4.0 * * @global wpdb $wpdb WordPress database abstraction object. * * @param int $network_id The ID of the network to retrieve. * @return WP_Network|false The network's object if found. False if not. */ public static function get_instance( $network_id ) { global $wpdb; $network_id = (int) $network_id; if ( ! $network_id ) { return false; } $_network = wp_cache_get( $network_id, 'networks' ); if ( false === $_network ) { $_network = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->site} WHERE id = %d LIMIT 1", $network_id ) ); if ( empty( $_network ) || is_wp_error( $_network ) ) { $_network = -1; } wp_cache_add( $network_id, $_network, 'networks' ); } if ( is_numeric( $_network ) ) { return false; } return new WP_Network( $_network ); } /** * Creates a new WP_Network object. * * Will populate object properties from the object provided and assign other * default properties based on that information. * * @since 4.4.0 * * @param WP_Network|object $network A network object. */ public function __construct( $network ) { foreach ( get_object_vars( $network ) as $key => $value ) { $this->__set( $key, $value ); } $this->_set_site_name(); $this->_set_cookie_domain(); } /** * Getter. * * Allows current multisite naming conventions when getting properties. * * @since 4.6.0 * * @param string $key Property to get. * @return mixed Value of the property. Null if not available. */ public function __get( $key ) { switch ( $key ) { case 'id': return (int) $this->id; case 'blog_id': return (string) $this->get_main_site_id(); case 'site_id': return $this->get_main_site_id(); } return null; } /** * Isset-er. * * Allows current multisite naming conventions when checking for properties. * * @since 4.6.0 * * @param string $key Property to check if set. * @return bool Whether the property is set. */ public function __isset( $key ) { switch ( $key ) { case 'id': case 'blog_id': case 'site_id': return true; } return false; } /** * Setter. * * Allows current multisite naming conventions while setting properties. * * @since 4.6.0 * * @param string $key Property to set. * @param mixed $value Value to assign to the property. */ public function __set( $key, $value ) { switch ( $key ) { case 'id': $this->id = (int) $value; break; case 'blog_id': case 'site_id': $this->blog_id = (string) $value; break; default: $this->$key = $value; } } /** * Returns the main site ID for the network. * * Internal method used by the magic getter for the 'blog_id' and 'site_id' * properties. * * @since 4.9.0 * * @return int The ID of the main site. */ private function get_main_site_id() { /** * Filters the main site ID. * * Returning a positive integer will effectively short-circuit the function. * * @since 4.9.0 * * @param int|null $main_site_id If a positive integer is returned, it is interpreted as the main site ID. * @param WP_Network $network The network object for which the main site was detected. */ $main_site_id = (int) apply_filters( 'pre_get_main_site_id', null, $this ); if ( 0 < $main_site_id ) { return $main_site_id; } if ( 0 < (int) $this->blog_id ) { return (int) $this->blog_id; } if ( ( defined( 'DOMAIN_CURRENT_SITE' ) && defined( 'PATH_CURRENT_SITE' ) && DOMAIN_CURRENT_SITE === $this->domain && PATH_CURRENT_SITE === $this->path ) || ( defined( 'SITE_ID_CURRENT_SITE' ) && (int) SITE_ID_CURRENT_SITE === $this->id ) ) { if ( defined( 'BLOG_ID_CURRENT_SITE' ) ) { $this->blog_id = (string) BLOG_ID_CURRENT_SITE; return (int) $this->blog_id; } if ( defined( 'BLOGID_CURRENT_SITE' ) ) { // Deprecated. $this->blog_id = (string) BLOGID_CURRENT_SITE; return (int) $this->blog_id; } } $site = get_site(); if ( $site->domain === $this->domain && $site->path === $this->path ) { $main_site_id = (int) $site->id; } else { $main_site_id = get_network_option( $this->id, 'main_site' ); if ( false === $main_site_id ) { $_sites = get_sites( array( 'fields' => 'ids', 'number' => 1, 'domain' => $this->domain, 'path' => $this->path, 'network_id' => $this->id, ) ); $main_site_id = ! empty( $_sites ) ? array_shift( $_sites ) : 0; update_network_option( $this->id, 'main_site', $main_site_id ); } } $this->blog_id = (string) $main_site_id; return (int) $this->blog_id; } /** * Sets the site name assigned to the network if one has not been populated. * * @since 4.4.0 */ private function _set_site_name() { if ( ! empty( $this->site_name ) ) { return; } $default = ucfirst( $this->domain ); $this->site_name = get_network_option( $this->id, 'site_name', $default ); } /** * Sets the cookie domain based on the network domain if one has * not been populated. * * @todo What if the domain of the network doesn't match the current site? * * @since 4.4.0 */ private function _set_cookie_domain() { if ( ! empty( $this->cookie_domain ) ) { return; } $domain = parse_url( $this->domain, PHP_URL_HOST ); $this->cookie_domain = is_string( $domain ) ? $domain : $this->domain; if ( str_starts_with( $this->cookie_domain, 'www.' ) ) { $this->cookie_domain = substr( $this->cookie_domain, 4 ); } } /** * Retrieves the closest matching network for a domain and path. * * This will not necessarily return an exact match for a domain and path. Instead, it * breaks the domain and path into pieces that are then used to match the closest * possibility from a query. * * The intent of this method is to match a network during bootstrap for a * requested site address. * * @since 4.4.0 * * @param string $domain Domain to check. * @param string $path Path to check. * @param int|null $segments Path segments to use. Defaults to null, or the full path. * @return WP_Network|false Network object if successful. False when no network is found. */ public static function get_by_path( $domain = '', $path = '', $segments = null ) { $domains = array( $domain ); $pieces = explode( '.', $domain ); /* * It's possible one domain to search is 'com', but it might as well * be 'localhost' or some other locally mapped domain. */ while ( array_shift( $pieces ) ) { if ( ! empty( $pieces ) ) { $domains[] = implode( '.', $pieces ); } } /* * If we've gotten to this function during normal execution, there is * more than one network installed. At this point, who knows how many * we have. Attempt to optimize for the situation where networks are * only domains, thus meaning paths never need to be considered. * * This is a very basic optimization; anything further could have * drawbacks depending on the setup, so this is best done per-installation. */ $using_paths = true; if ( wp_using_ext_object_cache() ) { $using_paths = get_networks( array( 'number' => 1, 'count' => true, 'path__not_in' => '/', ) ); } $paths = array(); if ( $using_paths ) { $path_segments = array_filter( explode( '/', trim( $path, '/' ) ) ); /** * Filters the number of path segments to consider when searching for a site. * * @since 3.9.0 * * @param int|null $segments The number of path segments to consider. WordPress by default looks at * one path segment. The function default of null only makes sense when you * know the requested path should match a network. * @param string $domain The requested domain. * @param string $path The requested path, in full. */ $segments = apply_filters( 'network_by_path_segments_count', $segments, $domain, $path ); if ( ( null !== $segments ) && count( $path_segments ) > $segments ) { $path_segments = array_slice( $path_segments, 0, $segments ); } while ( count( $path_segments ) ) { $paths[] = '/' . implode( '/', $path_segments ) . '/'; array_pop( $path_segments ); } $paths[] = '/'; } /** * Determines a network by its domain and path. * * This allows one to short-circuit the default logic, perhaps by * replacing it with a routine that is more optimal for your setup. * * Return null to avoid the short-circuit. Return false if no network * can be found at the requested domain and path. Otherwise, return * an object from wp_get_network(). * * @since 3.9.0 * * @param null|false|WP_Network $network Network value to return by path. Default null * to continue retrieving the network. * @param string $domain The requested domain. * @param string $path The requested path, in full. * @param int|null $segments The suggested number of paths to consult. * Default null, meaning the entire path was to be consulted. * @param string[] $paths Array of paths to search for, based on `$path` and `$segments`. */ $pre = apply_filters( 'pre_get_network_by_path', null, $domain, $path, $segments, $paths ); if ( null !== $pre ) { return $pre; } if ( ! $using_paths ) { $networks = get_networks( array( 'number' => 1, 'orderby' => array( 'domain_length' => 'DESC', ), 'domain__in' => $domains, ) ); if ( ! empty( $networks ) ) { return array_shift( $networks ); } return false; } $networks = get_networks( array( 'orderby' => array( 'domain_length' => 'DESC', 'path_length' => 'DESC', ), 'domain__in' => $domains, 'path__in' => $paths, ) ); /* * Domains are sorted by length of domain, then by length of path. * The domain must match for the path to be considered. Otherwise, * a network with the path of / will suffice. */ $found = false; foreach ( $networks as $network ) { if ( ( $network->domain === $domain ) || ( "www.{$network->domain}" === $domain ) ) { if ( in_array( $network->path, $paths, true ) ) { $found = true; break; } } if ( '/' === $network->path ) { $found = true; break; } } if ( true === $found ) { return $network; } return false; } } class-wp-customize-manager.php 0000666 00000614603 15226557730 0012470 0 ustar 00 <?php /** * WordPress Customize Manager classes * * @package WordPress * @subpackage Customize * @since 3.4.0 */ /** * Customize Manager class. * * Bootstraps the Customize experience on the server-side. * * Sets up the theme-switching process if a theme other than the active one is * being previewed and customized. * * Serves as a factory for Customize Controls and Settings, and * instantiates default Customize Controls and Settings. * * @since 3.4.0 */ #[AllowDynamicProperties] final class WP_Customize_Manager { /** * An instance of the theme being previewed. * * @since 3.4.0 * @var WP_Theme */ protected $theme; /** * The directory name of the previously active theme (within the theme_root). * * @since 3.4.0 * @var string */ protected $original_stylesheet; /** * Whether this is a Customizer pageload. * * @since 3.4.0 * @var bool */ protected $previewing = false; /** * Methods and properties dealing with managing widgets in the Customizer. * * @since 3.9.0 * @var WP_Customize_Widgets */ public $widgets; /** * Methods and properties dealing with managing nav menus in the Customizer. * * @since 4.3.0 * @var WP_Customize_Nav_Menus */ public $nav_menus; /** * Methods and properties dealing with selective refresh in the Customizer preview. * * @since 4.5.0 * @var WP_Customize_Selective_Refresh */ public $selective_refresh; /** * Registered instances of WP_Customize_Setting. * * @since 3.4.0 * @var array */ protected $settings = array(); /** * Sorted top-level instances of WP_Customize_Panel and WP_Customize_Section. * * @since 4.0.0 * @var array */ protected $containers = array(); /** * Registered instances of WP_Customize_Panel. * * @since 4.0.0 * @var array */ protected $panels = array(); /** * List of core components. * * @since 4.5.0 * @var array */ protected $components = array( 'nav_menus' ); /** * Registered instances of WP_Customize_Section. * * @since 3.4.0 * @var array */ protected $sections = array(); /** * Registered instances of WP_Customize_Control. * * @since 3.4.0 * @var array */ protected $controls = array(); /** * Panel types that may be rendered from JS templates. * * @since 4.3.0 * @var array */ protected $registered_panel_types = array(); /** * Section types that may be rendered from JS templates. * * @since 4.3.0 * @var array */ protected $registered_section_types = array(); /** * Control types that may be rendered from JS templates. * * @since 4.1.0 * @var array */ protected $registered_control_types = array(); /** * Initial URL being previewed. * * @since 4.4.0 * @var string */ protected $preview_url; /** * URL to link the user to when closing the Customizer. * * @since 4.4.0 * @var string */ protected $return_url; /** * Mapping of 'panel', 'section', 'control' to the ID which should be autofocused. * * @since 4.4.0 * @var string[] */ protected $autofocus = array(); /** * Messenger channel. * * @since 4.7.0 * @var string */ protected $messenger_channel; /** * Whether the autosave revision of the changeset should be loaded. * * @since 4.9.0 * @var bool */ protected $autosaved = false; /** * Whether the changeset branching is allowed. * * @since 4.9.0 * @var bool */ protected $branching = true; /** * Whether settings should be previewed. * * @since 4.9.0 * @var bool */ protected $settings_previewed = true; /** * Whether a starter content changeset was saved. * * @since 4.9.0 * @var bool */ protected $saved_starter_content_changeset = false; /** * Unsanitized values for Customize Settings parsed from $_POST['customized']. * * @var array */ private $_post_values; /** * Changeset UUID. * * @since 4.7.0 * @var string */ private $_changeset_uuid; /** * Changeset post ID. * * @since 4.7.0 * @var int|false */ private $_changeset_post_id; /** * Changeset data loaded from a customize_changeset post. * * @since 4.7.0 * @var array|null */ private $_changeset_data; /** * Constructor. * * @since 3.4.0 * @since 4.7.0 Added `$args` parameter. * * @param array $args { * Args. * * @type null|string|false $changeset_uuid Changeset UUID, the `post_name` for the customize_changeset post containing the customized state. * Defaults to `null` resulting in a UUID to be immediately generated. If `false` is provided, then * then the changeset UUID will be determined during `after_setup_theme`: when the * `customize_changeset_branching` filter returns false, then the default UUID will be that * of the most recent `customize_changeset` post that has a status other than 'auto-draft', * 'publish', or 'trash'. Otherwise, if changeset branching is enabled, then a random UUID will be used. * @type string $theme Theme to be previewed (for theme switch). Defaults to customize_theme or theme query params. * @type string $messenger_channel Messenger channel. Defaults to customize_messenger_channel query param. * @type bool $settings_previewed If settings should be previewed. Defaults to true. * @type bool $branching If changeset branching is allowed; otherwise, changesets are linear. Defaults to true. * @type bool $autosaved If data from a changeset's autosaved revision should be loaded if it exists. Defaults to false. * } */ public function __construct( $args = array() ) { $args = array_merge( array_fill_keys( array( 'changeset_uuid', 'theme', 'messenger_channel', 'settings_previewed', 'autosaved', 'branching' ), null ), $args ); // Note that the UUID format will be validated in the setup_theme() method. if ( ! isset( $args['changeset_uuid'] ) ) { $args['changeset_uuid'] = wp_generate_uuid4(); } /* * The theme and messenger_channel should be supplied via $args, * but they are also looked at in the $_REQUEST global here for back-compat. */ if ( ! isset( $args['theme'] ) ) { if ( isset( $_REQUEST['customize_theme'] ) ) { $args['theme'] = wp_unslash( $_REQUEST['customize_theme'] ); } elseif ( isset( $_REQUEST['theme'] ) ) { // Deprecated. $args['theme'] = wp_unslash( $_REQUEST['theme'] ); } } if ( ! isset( $args['messenger_channel'] ) && isset( $_REQUEST['customize_messenger_channel'] ) ) { $args['messenger_channel'] = sanitize_key( wp_unslash( $_REQUEST['customize_messenger_channel'] ) ); } // Do not load 'widgets' component if a block theme is activated. if ( ! wp_is_block_theme() ) { $this->components[] = 'widgets'; } $this->original_stylesheet = get_stylesheet(); $this->theme = wp_get_theme( 0 === validate_file( $args['theme'] ) ? $args['theme'] : null ); $this->messenger_channel = $args['messenger_channel']; $this->_changeset_uuid = $args['changeset_uuid']; foreach ( array( 'settings_previewed', 'autosaved', 'branching' ) as $key ) { if ( isset( $args[ $key ] ) ) { $this->$key = (bool) $args[ $key ]; } } require_once ABSPATH . WPINC . '/class-wp-customize-setting.php'; require_once ABSPATH . WPINC . '/class-wp-customize-panel.php'; require_once ABSPATH . WPINC . '/class-wp-customize-section.php'; require_once ABSPATH . WPINC . '/class-wp-customize-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-color-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-media-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-upload-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-image-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-background-image-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-background-position-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-cropped-image-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-site-icon-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-header-image-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-theme-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-code-editor-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-widget-area-customize-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-widget-form-customize-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-item-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-location-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-name-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-locations-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-auto-add-control.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menus-panel.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-themes-panel.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-themes-section.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-sidebar-section.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-section.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-custom-css-setting.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-filter-setting.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-header-image-setting.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-background-image-setting.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-item-setting.php'; require_once ABSPATH . WPINC . '/customize/class-wp-customize-nav-menu-setting.php'; /** * Filters the core Customizer components to load. * * This allows Core components to be excluded from being instantiated by * filtering them out of the array. Note that this filter generally runs * during the {@see 'plugins_loaded'} action, so it cannot be added * in a theme. * * @since 4.4.0 * * @see WP_Customize_Manager::__construct() * * @param string[] $components Array of core components to load. * @param WP_Customize_Manager $manager WP_Customize_Manager instance. */ $components = apply_filters( 'customize_loaded_components', $this->components, $this ); require_once ABSPATH . WPINC . '/customize/class-wp-customize-selective-refresh.php'; $this->selective_refresh = new WP_Customize_Selective_Refresh( $this ); if ( in_array( 'widgets', $components, true ) ) { require_once ABSPATH . WPINC . '/class-wp-customize-widgets.php'; $this->widgets = new WP_Customize_Widgets( $this ); } if ( in_array( 'nav_menus', $components, true ) ) { require_once ABSPATH . WPINC . '/class-wp-customize-nav-menus.php'; $this->nav_menus = new WP_Customize_Nav_Menus( $this ); } add_action( 'setup_theme', array( $this, 'setup_theme' ) ); add_action( 'wp_loaded', array( $this, 'wp_loaded' ) ); // Do not spawn cron (especially the alternate cron) while running the Customizer. remove_action( 'init', 'wp_cron' ); // Do not run update checks when rendering the controls. remove_action( 'admin_init', '_maybe_update_core' ); remove_action( 'admin_init', '_maybe_update_plugins' ); remove_action( 'admin_init', '_maybe_update_themes' ); add_action( 'wp_ajax_customize_save', array( $this, 'save' ) ); add_action( 'wp_ajax_customize_trash', array( $this, 'handle_changeset_trash_request' ) ); add_action( 'wp_ajax_customize_refresh_nonces', array( $this, 'refresh_nonces' ) ); add_action( 'wp_ajax_customize_load_themes', array( $this, 'handle_load_themes_request' ) ); add_filter( 'heartbeat_settings', array( $this, 'add_customize_screen_to_heartbeat_settings' ) ); add_filter( 'heartbeat_received', array( $this, 'check_changeset_lock_with_heartbeat' ), 10, 3 ); add_action( 'wp_ajax_customize_override_changeset_lock', array( $this, 'handle_override_changeset_lock_request' ) ); add_action( 'wp_ajax_customize_dismiss_autosave_or_lock', array( $this, 'handle_dismiss_autosave_or_lock_request' ) ); add_action( 'customize_register', array( $this, 'register_controls' ) ); add_action( 'customize_register', array( $this, 'register_dynamic_settings' ), 11 ); // Allow code to create settings first. add_action( 'customize_controls_init', array( $this, 'prepare_controls' ) ); add_action( 'customize_controls_enqueue_scripts', array( $this, 'enqueue_control_scripts' ) ); // Render Common, Panel, Section, and Control templates. add_action( 'customize_controls_print_footer_scripts', array( $this, 'render_panel_templates' ), 1 ); add_action( 'customize_controls_print_footer_scripts', array( $this, 'render_section_templates' ), 1 ); add_action( 'customize_controls_print_footer_scripts', array( $this, 'render_control_templates' ), 1 ); // Export header video settings with the partial response. add_filter( 'customize_render_partials_response', array( $this, 'export_header_video_settings' ), 10, 3 ); // Export the settings to JS via the _wpCustomizeSettings variable. add_action( 'customize_controls_print_footer_scripts', array( $this, 'customize_pane_settings' ), 1000 ); // Add theme update notices. if ( current_user_can( 'install_themes' ) || current_user_can( 'update_themes' ) ) { require_once ABSPATH . 'wp-admin/includes/update.php'; add_action( 'customize_controls_print_footer_scripts', 'wp_print_admin_notice_templates' ); } } /** * Returns true if it's an Ajax request. * * @since 3.4.0 * @since 4.2.0 Added `$action` param. * * @param string|null $action Whether the supplied Ajax action is being run. * @return bool True if it's an Ajax request, false otherwise. */ public function doing_ajax( $action = null ) { if ( ! wp_doing_ajax() ) { return false; } if ( ! $action ) { return true; } else { /* * Note: we can't just use doing_action( "wp_ajax_{$action}" ) because we need * to check before admin-ajax.php gets to that point. */ return isset( $_REQUEST['action'] ) && wp_unslash( $_REQUEST['action'] ) === $action; } } /** * Custom wp_die wrapper. Returns either the standard message for UI * or the Ajax message. * * @since 3.4.0 * * @param string|WP_Error $ajax_message Ajax return. * @param string $message Optional. UI message. */ protected function wp_die( $ajax_message, $message = null ) { if ( $this->doing_ajax() ) { wp_die( $ajax_message ); } if ( ! $message ) { $message = __( 'An error occurred while customizing. Please refresh the page and try again.' ); } if ( $this->messenger_channel ) { ob_start(); wp_enqueue_scripts(); wp_print_scripts( array( 'customize-base' ) ); $settings = array( 'messengerArgs' => array( 'channel' => $this->messenger_channel, 'url' => wp_customize_url(), ), 'error' => $ajax_message, ); $message .= ob_get_clean(); ob_start(); ?> <script> ( function( api, settings ) { var preview = new api.Messenger( settings.messengerArgs ); preview.send( 'iframe-loading-error', settings.error ); } )( wp.customize, <?php echo wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> ); </script> <?php $message .= wp_get_inline_script_tag( wp_remove_surrounding_empty_script_tags( ob_get_clean() ) . "\n//# sourceURL=" . rawurlencode( __METHOD__ ) ); } wp_die( $message ); } /** * Returns the Ajax wp_die() handler if it's a customized request. * * @since 3.4.0 * @deprecated 4.7.0 * * @return callable Die handler. */ public function wp_die_handler() { _deprecated_function( __METHOD__, '4.7.0' ); if ( $this->doing_ajax() || isset( $_POST['customized'] ) ) { return '_ajax_wp_die_handler'; } return '_default_wp_die_handler'; } /** * Starts preview and customize theme. * * Check if customize query variable exist. Init filters to filter the active theme. * * @since 3.4.0 * * @global string $pagenow The filename of the current screen. */ public function setup_theme() { global $pagenow; // Check permissions for customize.php access since this method is called before customize.php can run any code. if ( 'customize.php' === $pagenow && ! current_user_can( 'customize' ) ) { if ( ! is_user_logged_in() ) { auth_redirect(); } else { wp_die( '<h1>' . __( 'You need a higher level of permission.' ) . '</h1>' . '<p>' . __( 'Sorry, you are not allowed to customize this site.' ) . '</p>', 403 ); } return; } // If a changeset was provided is invalid. if ( isset( $this->_changeset_uuid ) && false !== $this->_changeset_uuid && ! wp_is_uuid( $this->_changeset_uuid ) ) { $this->wp_die( -1, __( 'Invalid changeset UUID' ) ); } /* * Clear incoming post data if the user lacks a CSRF token (nonce). Note that the customizer * application will inject the customize_preview_nonce query parameter into all Ajax requests. * For similar behavior elsewhere in WordPress, see rest_cookie_check_errors() which logs out * a user when a valid nonce isn't present. */ $has_post_data_nonce = ( check_ajax_referer( 'preview-customize_' . $this->get_stylesheet(), 'nonce', false ) || check_ajax_referer( 'save-customize_' . $this->get_stylesheet(), 'nonce', false ) || check_ajax_referer( 'preview-customize_' . $this->get_stylesheet(), 'customize_preview_nonce', false ) ); if ( ! current_user_can( 'customize' ) || ! $has_post_data_nonce ) { unset( $_POST['customized'] ); unset( $_REQUEST['customized'] ); } /* * If unauthenticated then require a valid changeset UUID to load the preview. * In this way, the UUID serves as a secret key. If the messenger channel is present, * then send unauthenticated code to prompt re-auth. */ if ( ! current_user_can( 'customize' ) && ! $this->changeset_post_id() ) { $this->wp_die( $this->messenger_channel ? 0 : -1, __( 'Non-existent changeset UUID.' ) ); } if ( ! headers_sent() ) { send_origin_headers(); } // Hide the admin bar if we're embedded in the customizer iframe. if ( $this->messenger_channel ) { show_admin_bar( false ); } if ( $this->is_theme_active() ) { // Once the theme is loaded, we'll validate it. add_action( 'after_setup_theme', array( $this, 'after_setup_theme' ) ); } else { /* * If the requested theme is not the active theme and the user doesn't have * the switch_themes cap, bail. */ if ( ! current_user_can( 'switch_themes' ) ) { $this->wp_die( -1, __( 'Sorry, you are not allowed to edit theme options on this site.' ) ); } // If the theme has errors while loading, bail. if ( $this->theme()->errors() ) { $this->wp_die( -1, $this->theme()->errors()->get_error_message() ); } // If the theme isn't allowed per multisite settings, bail. if ( ! $this->theme()->is_allowed() ) { $this->wp_die( -1, __( 'The requested theme does not exist.' ) ); } } // Make sure changeset UUID is established immediately after the theme is loaded. add_action( 'after_setup_theme', array( $this, 'establish_loaded_changeset' ), 5 ); /* * Import theme starter content for fresh installations when landing in the customizer. * Import starter content at after_setup_theme:100 so that any * add_theme_support( 'starter-content' ) calls will have been made. */ if ( get_option( 'fresh_site' ) && 'customize.php' === $pagenow ) { add_action( 'after_setup_theme', array( $this, 'import_theme_starter_content' ), 100 ); } $this->start_previewing_theme(); } /** * Establishes the loaded changeset. * * This method runs right at after_setup_theme and applies the 'customize_changeset_branching' filter to determine * whether concurrent changesets are allowed. Then if the Customizer is not initialized with a `changeset_uuid` param, * this method will determine which UUID should be used. If changeset branching is disabled, then the most saved * changeset will be loaded by default. Otherwise, if there are no existing saved changesets or if changeset branching is * enabled, then a new UUID will be generated. * * @since 4.9.0 * * @global string $pagenow The filename of the current screen. */ public function establish_loaded_changeset() { global $pagenow; if ( empty( $this->_changeset_uuid ) ) { $changeset_uuid = null; if ( ! $this->branching() && $this->is_theme_active() ) { $unpublished_changeset_posts = $this->get_changeset_posts( array( 'post_status' => array_diff( get_post_stati(), array( 'auto-draft', 'publish', 'trash', 'inherit', 'private' ) ), 'exclude_restore_dismissed' => false, 'author' => 'any', 'posts_per_page' => 1, 'order' => 'DESC', 'orderby' => 'date', ) ); $unpublished_changeset_post = array_shift( $unpublished_changeset_posts ); if ( ! empty( $unpublished_changeset_post ) && wp_is_uuid( $unpublished_changeset_post->post_name ) ) { $changeset_uuid = $unpublished_changeset_post->post_name; } } // If no changeset UUID has been set yet, then generate a new one. if ( empty( $changeset_uuid ) ) { $changeset_uuid = wp_generate_uuid4(); } $this->_changeset_uuid = $changeset_uuid; } if ( is_admin() && 'customize.php' === $pagenow ) { $this->set_changeset_lock( $this->changeset_post_id() ); } } /** * Callback to validate a theme once it is loaded * * @since 3.4.0 */ public function after_setup_theme() { $doing_ajax_or_is_customized = ( $this->doing_ajax() || isset( $_POST['customized'] ) ); if ( ! $doing_ajax_or_is_customized && ! validate_current_theme() ) { wp_redirect( 'themes.php?broken=true' ); exit; } } /** * If the theme to be previewed isn't the active theme, add filter callbacks * to swap it out at runtime. * * @since 3.4.0 */ public function start_previewing_theme() { // Bail if we're already previewing. if ( $this->is_preview() ) { return; } $this->previewing = true; if ( ! $this->is_theme_active() ) { add_filter( 'template', array( $this, 'get_template' ) ); add_filter( 'stylesheet', array( $this, 'get_stylesheet' ) ); add_filter( 'pre_option_current_theme', array( $this, 'current_theme' ) ); // @link: https://core.trac.wordpress.org/ticket/20027 add_filter( 'pre_option_stylesheet', array( $this, 'get_stylesheet' ) ); add_filter( 'pre_option_template', array( $this, 'get_template' ) ); // Handle custom theme roots. add_filter( 'pre_option_stylesheet_root', array( $this, 'get_stylesheet_root' ) ); add_filter( 'pre_option_template_root', array( $this, 'get_template_root' ) ); } /** * Fires once the Customizer theme preview has started. * * @since 3.4.0 * * @param WP_Customize_Manager $manager WP_Customize_Manager instance. */ do_action( 'start_previewing_theme', $this ); } /** * Stops previewing the selected theme. * * Removes filters to change the active theme. * * @since 3.4.0 */ public function stop_previewing_theme() { if ( ! $this->is_preview() ) { return; } $this->previewing = false; if ( ! $this->is_theme_active() ) { remove_filter( 'template', array( $this, 'get_template' ) ); remove_filter( 'stylesheet', array( $this, 'get_stylesheet' ) ); remove_filter( 'pre_option_current_theme', array( $this, 'current_theme' ) ); // @link: https://core.trac.wordpress.org/ticket/20027 remove_filter( 'pre_option_stylesheet', array( $this, 'get_stylesheet' ) ); remove_filter( 'pre_option_template', array( $this, 'get_template' ) ); // Handle custom theme roots. remove_filter( 'pre_option_stylesheet_root', array( $this, 'get_stylesheet_root' ) ); remove_filter( 'pre_option_template_root', array( $this, 'get_template_root' ) ); } /** * Fires once the Customizer theme preview has stopped. * * @since 3.4.0 * * @param WP_Customize_Manager $manager WP_Customize_Manager instance. */ do_action( 'stop_previewing_theme', $this ); } /** * Gets whether settings are or will be previewed. * * @since 4.9.0 * * @see WP_Customize_Setting::preview() * * @return bool */ public function settings_previewed() { return $this->settings_previewed; } /** * Gets whether data from a changeset's autosaved revision should be loaded if it exists. * * @since 4.9.0 * * @see WP_Customize_Manager::changeset_data() * * @return bool Is using autosaved changeset revision. */ public function autosaved() { return $this->autosaved; } /** * Whether the changeset branching is allowed. * * @since 4.9.0 * * @see WP_Customize_Manager::establish_loaded_changeset() * * @return bool Is changeset branching. */ public function branching() { /** * Filters whether or not changeset branching is allowed. * * By default in core, when changeset branching is not allowed, changesets will operate * linearly in that only one saved changeset will exist at a time (with a 'draft' or * 'future' status). This makes the Customizer operate in a way that is similar to going to * "edit" to one existing post: all users will be making changes to the same post, and autosave * revisions will be made for that post. * * By contrast, when changeset branching is allowed, then the model is like users going * to "add new" for a page and each user makes changes independently of each other since * they are all operating on their own separate pages, each getting their own separate * initial auto-drafts and then once initially saved, autosave revisions on top of that * user's specific post. * * Since linear changesets are deemed to be more suitable for the majority of WordPress users, * they are the default. For WordPress sites that have heavy site management in the Customizer * by multiple users then branching changesets should be enabled by means of this filter. * * @since 4.9.0 * * @param bool $allow_branching Whether branching is allowed. If `false`, the default, * then only one saved changeset exists at a time. * @param WP_Customize_Manager $wp_customize Manager instance. */ $this->branching = apply_filters( 'customize_changeset_branching', $this->branching, $this ); return $this->branching; } /** * Gets the changeset UUID. * * @since 4.7.0 * * @see WP_Customize_Manager::establish_loaded_changeset() * * @return string UUID. */ public function changeset_uuid() { if ( empty( $this->_changeset_uuid ) ) { $this->establish_loaded_changeset(); } return $this->_changeset_uuid; } /** * Gets the theme being customized. * * @since 3.4.0 * * @return WP_Theme */ public function theme() { if ( ! $this->theme ) { $this->theme = wp_get_theme(); } return $this->theme; } /** * Gets the registered settings. * * @since 3.4.0 * * @return array */ public function settings() { return $this->settings; } /** * Gets the registered controls. * * @since 3.4.0 * * @return array */ public function controls() { return $this->controls; } /** * Gets the registered containers. * * @since 4.0.0 * * @return array */ public function containers() { return $this->containers; } /** * Gets the registered sections. * * @since 3.4.0 * * @return array */ public function sections() { return $this->sections; } /** * Gets the registered panels. * * @since 4.0.0 * * @return array Panels. */ public function panels() { return $this->panels; } /** * Checks if the current theme is active. * * @since 3.4.0 * * @return bool */ public function is_theme_active() { return $this->get_stylesheet() === $this->original_stylesheet; } /** * Registers styles/scripts and initialize the preview of each setting * * @since 3.4.0 */ public function wp_loaded() { /* * Unconditionally register core types for panels, sections, and controls * in case plugin unhooks all customize_register actions. */ $this->register_panel_type( 'WP_Customize_Panel' ); $this->register_panel_type( 'WP_Customize_Themes_Panel' ); $this->register_section_type( 'WP_Customize_Section' ); $this->register_section_type( 'WP_Customize_Sidebar_Section' ); $this->register_section_type( 'WP_Customize_Themes_Section' ); $this->register_control_type( 'WP_Customize_Color_Control' ); $this->register_control_type( 'WP_Customize_Media_Control' ); $this->register_control_type( 'WP_Customize_Upload_Control' ); $this->register_control_type( 'WP_Customize_Image_Control' ); $this->register_control_type( 'WP_Customize_Background_Image_Control' ); $this->register_control_type( 'WP_Customize_Background_Position_Control' ); $this->register_control_type( 'WP_Customize_Cropped_Image_Control' ); $this->register_control_type( 'WP_Customize_Site_Icon_Control' ); $this->register_control_type( 'WP_Customize_Theme_Control' ); $this->register_control_type( 'WP_Customize_Code_Editor_Control' ); $this->register_control_type( 'WP_Customize_Date_Time_Control' ); /** * Fires once WordPress has loaded, allowing scripts and styles to be initialized. * * @since 3.4.0 * * @param WP_Customize_Manager $manager WP_Customize_Manager instance. */ do_action( 'customize_register', $this ); if ( $this->settings_previewed() ) { foreach ( $this->settings as $setting ) { $setting->preview(); } } if ( $this->is_preview() && ! is_admin() ) { $this->customize_preview_init(); } } /** * Prevents Ajax requests from following redirects when previewing a theme * by issuing a 200 response instead of a 30x. * * Instead, the JS will sniff out the location header. * * @since 3.4.0 * @deprecated 4.7.0 * * @param int $status Status. * @return int */ public function wp_redirect_status( $status ) { _deprecated_function( __FUNCTION__, '4.7.0' ); if ( $this->is_preview() && ! is_admin() ) { return 200; } return $status; } /** * Finds the changeset post ID for a given changeset UUID. * * @since 4.7.0 * * @param string $uuid Changeset UUID. * @return int|null Returns post ID on success and null on failure. */ public function find_changeset_post_id( $uuid ) { $cache_group = 'customize_changeset_post'; $changeset_post_id = wp_cache_get( $uuid, $cache_group ); if ( $changeset_post_id && 'customize_changeset' === get_post_type( $changeset_post_id ) ) { return $changeset_post_id; } $changeset_post_query = new WP_Query( array( 'post_type' => 'customize_changeset', 'post_status' => get_post_stati(), 'name' => $uuid, 'posts_per_page' => 1, 'no_found_rows' => true, 'cache_results' => true, 'update_post_meta_cache' => false, 'update_post_term_cache' => false, 'lazy_load_term_meta' => false, ) ); if ( ! empty( $changeset_post_query->posts ) ) { // Note: 'fields'=>'ids' is not being used in order to cache the post object as it will be needed. $changeset_post_id = $changeset_post_query->posts[0]->ID; wp_cache_set( $uuid, $changeset_post_id, $cache_group ); return $changeset_post_id; } return null; } /** * Gets changeset posts. * * @since 4.9.0 * * @param array $args { * Args to pass into `get_posts()` to query changesets. * * @type int $posts_per_page Number of posts to return. Defaults to -1 (all posts). * @type int $author Post author. Defaults to current user. * @type string $post_status Status of changeset. Defaults to 'auto-draft'. * @type bool $exclude_restore_dismissed Whether to exclude changeset auto-drafts that have been dismissed. Defaults to true. * } * @return WP_Post[] Auto-draft changesets. */ protected function get_changeset_posts( $args = array() ) { $default_args = array( 'exclude_restore_dismissed' => true, 'posts_per_page' => -1, 'post_type' => 'customize_changeset', 'post_status' => 'auto-draft', 'order' => 'DESC', 'orderby' => 'date', 'no_found_rows' => true, 'cache_results' => true, 'update_post_meta_cache' => false, 'update_post_term_cache' => false, 'lazy_load_term_meta' => false, ); if ( get_current_user_id() ) { $default_args['author'] = get_current_user_id(); } $args = array_merge( $default_args, $args ); if ( ! empty( $args['exclude_restore_dismissed'] ) ) { unset( $args['exclude_restore_dismissed'] ); $args['meta_query'] = array( array( 'key' => '_customize_restore_dismissed', 'compare' => 'NOT EXISTS', ), ); } return get_posts( $args ); } /** * Dismisses all of the current user's auto-drafts (other than the present one). * * @since 4.9.0 * @return int The number of auto-drafts that were dismissed. */ protected function dismiss_user_auto_draft_changesets() { $changeset_autodraft_posts = $this->get_changeset_posts( array( 'post_status' => 'auto-draft', 'exclude_restore_dismissed' => true, 'posts_per_page' => -1, ) ); $dismissed = 0; foreach ( $changeset_autodraft_posts as $autosave_autodraft_post ) { if ( $autosave_autodraft_post->ID === $this->changeset_post_id() ) { continue; } if ( update_post_meta( $autosave_autodraft_post->ID, '_customize_restore_dismissed', true ) ) { ++$dismissed; } } return $dismissed; } /** * Gets the changeset post ID for the loaded changeset. * * @since 4.7.0 * * @return int|null Post ID on success or null if there is no post yet saved. */ public function changeset_post_id() { if ( ! isset( $this->_changeset_post_id ) ) { $post_id = $this->find_changeset_post_id( $this->changeset_uuid() ); if ( ! $post_id ) { $post_id = false; } $this->_changeset_post_id = $post_id; } if ( false === $this->_changeset_post_id ) { return null; } return $this->_changeset_post_id; } /** * Gets the data stored in a changeset post. * * @since 4.7.0 * * @param int $post_id Changeset post ID. * @return array|WP_Error Changeset data or WP_Error on error. */ protected function get_changeset_post_data( $post_id ) { if ( ! $post_id ) { return new WP_Error( 'empty_post_id' ); } $changeset_post = get_post( $post_id ); if ( ! $changeset_post ) { return new WP_Error( 'missing_post' ); } if ( 'revision' === $changeset_post->post_type ) { if ( 'customize_changeset' !== get_post_type( $changeset_post->post_parent ) ) { return new WP_Error( 'wrong_post_type' ); } } elseif ( 'customize_changeset' !== $changeset_post->post_type ) { return new WP_Error( 'wrong_post_type' ); } $changeset_data = json_decode( $changeset_post->post_content, true ); $last_error = json_last_error(); if ( $last_error ) { return new WP_Error( 'json_parse_error', '', $last_error ); } if ( ! is_array( $changeset_data ) ) { return new WP_Error( 'expected_array' ); } return $changeset_data; } /** * Gets changeset data. * * @since 4.7.0 * @since 4.9.0 This will return the changeset's data with a user's autosave revision merged on top, if one exists and $autosaved is true. * * @return array Changeset data. */ public function changeset_data() { if ( isset( $this->_changeset_data ) ) { return $this->_changeset_data; } $changeset_post_id = $this->changeset_post_id(); if ( ! $changeset_post_id ) { $this->_changeset_data = array(); } else { if ( $this->autosaved() && is_user_logged_in() ) { $autosave_post = wp_get_post_autosave( $changeset_post_id, get_current_user_id() ); if ( $autosave_post ) { $data = $this->get_changeset_post_data( $autosave_post->ID ); if ( ! is_wp_error( $data ) ) { $this->_changeset_data = $data; } } } // Load data from the changeset if it was not loaded from an autosave. if ( ! isset( $this->_changeset_data ) ) { $data = $this->get_changeset_post_data( $changeset_post_id ); if ( ! is_wp_error( $data ) ) { $this->_changeset_data = $data; } else { $this->_changeset_data = array(); } } } return $this->_changeset_data; } /** * Starter content setting IDs. * * @since 4.7.0 * @var array */ protected $pending_starter_content_settings_ids = array(); /** * Imports theme starter content into the customized state. * * @since 4.7.0 * * @param array $starter_content Starter content. Defaults to `get_theme_starter_content()`. */ public function import_theme_starter_content( $starter_content = array() ) { if ( empty( $starter_content ) ) { $starter_content = get_theme_starter_content(); } $changeset_data = array(); if ( $this->changeset_post_id() ) { /* * Don't re-import starter content into a changeset saved persistently. * This will need to be revisited in the future once theme switching * is allowed with drafted/scheduled changesets, since switching to * another theme could result in more starter content being applied. * However, when doing an explicit save it is currently possible for * nav menus and nav menu items specifically to lose their starter_content * flags, thus resulting in duplicates being created since they fail * to get re-used. See #40146. */ if ( 'auto-draft' !== get_post_status( $this->changeset_post_id() ) ) { return; } $changeset_data = $this->get_changeset_post_data( $this->changeset_post_id() ); } $sidebars_widgets = isset( $starter_content['widgets'] ) && ! empty( $this->widgets ) ? $starter_content['widgets'] : array(); $attachments = isset( $starter_content['attachments'] ) && ! empty( $this->nav_menus ) ? $starter_content['attachments'] : array(); $posts = isset( $starter_content['posts'] ) && ! empty( $this->nav_menus ) ? $starter_content['posts'] : array(); $options = isset( $starter_content['options'] ) ? $starter_content['options'] : array(); $nav_menus = isset( $starter_content['nav_menus'] ) && ! empty( $this->nav_menus ) ? $starter_content['nav_menus'] : array(); $theme_mods = isset( $starter_content['theme_mods'] ) ? $starter_content['theme_mods'] : array(); // Widgets. $max_widget_numbers = array(); foreach ( $sidebars_widgets as $sidebar_id => $widgets ) { $sidebar_widget_ids = array(); foreach ( $widgets as $widget ) { list( $id_base, $instance ) = $widget; if ( ! isset( $max_widget_numbers[ $id_base ] ) ) { // When $settings is an array-like object, get an intrinsic array for use with array_keys(). $settings = get_option( "widget_{$id_base}", array() ); if ( $settings instanceof ArrayObject || $settings instanceof ArrayIterator ) { $settings = $settings->getArrayCopy(); } unset( $settings['_multiwidget'] ); // Find the max widget number for this type. $widget_numbers = array_keys( $settings ); if ( count( $widget_numbers ) > 0 ) { $widget_numbers[] = 1; $max_widget_numbers[ $id_base ] = max( ...$widget_numbers ); } else { $max_widget_numbers[ $id_base ] = 1; } } $max_widget_numbers[ $id_base ] += 1; $widget_id = sprintf( '%s-%d', $id_base, $max_widget_numbers[ $id_base ] ); $setting_id = sprintf( 'widget_%s[%d]', $id_base, $max_widget_numbers[ $id_base ] ); $setting_value = $this->widgets->sanitize_widget_js_instance( $instance ); if ( empty( $changeset_data[ $setting_id ] ) || ! empty( $changeset_data[ $setting_id ]['starter_content'] ) ) { $this->set_post_value( $setting_id, $setting_value ); $this->pending_starter_content_settings_ids[] = $setting_id; } $sidebar_widget_ids[] = $widget_id; } $setting_id = sprintf( 'sidebars_widgets[%s]', $sidebar_id ); if ( empty( $changeset_data[ $setting_id ] ) || ! empty( $changeset_data[ $setting_id ]['starter_content'] ) ) { $this->set_post_value( $setting_id, $sidebar_widget_ids ); $this->pending_starter_content_settings_ids[] = $setting_id; } } $starter_content_auto_draft_post_ids = array(); if ( ! empty( $changeset_data['nav_menus_created_posts']['value'] ) ) { $starter_content_auto_draft_post_ids = array_merge( $starter_content_auto_draft_post_ids, $changeset_data['nav_menus_created_posts']['value'] ); } // Make an index of all the posts needed and what their slugs are. $needed_posts = array(); $attachments = $this->prepare_starter_content_attachments( $attachments ); foreach ( $attachments as $attachment ) { $key = 'attachment:' . $attachment['post_name']; $needed_posts[ $key ] = true; } foreach ( array_keys( $posts ) as $post_symbol ) { if ( empty( $posts[ $post_symbol ]['post_name'] ) && empty( $posts[ $post_symbol ]['post_title'] ) ) { unset( $posts[ $post_symbol ] ); continue; } if ( empty( $posts[ $post_symbol ]['post_name'] ) ) { $posts[ $post_symbol ]['post_name'] = sanitize_title( $posts[ $post_symbol ]['post_title'] ); } if ( empty( $posts[ $post_symbol ]['post_type'] ) ) { $posts[ $post_symbol ]['post_type'] = 'post'; } $needed_posts[ $posts[ $post_symbol ]['post_type'] . ':' . $posts[ $post_symbol ]['post_name'] ] = true; } $all_post_slugs = array_merge( wp_list_pluck( $attachments, 'post_name' ), wp_list_pluck( $posts, 'post_name' ) ); /* * Obtain all post types referenced in starter content to use in query. * This is needed because 'any' will not account for post types not yet registered. */ $post_types = array_filter( array_merge( array( 'attachment' ), wp_list_pluck( $posts, 'post_type' ) ) ); // Re-use auto-draft starter content posts referenced in the current customized state. $existing_starter_content_posts = array(); if ( ! empty( $starter_content_auto_draft_post_ids ) ) { $existing_posts_query = new WP_Query( array( 'post__in' => $starter_content_auto_draft_post_ids, 'post_status' => 'auto-draft', 'post_type' => $post_types, 'posts_per_page' => -1, ) ); foreach ( $existing_posts_query->posts as $existing_post ) { $post_name = $existing_post->post_name; if ( empty( $post_name ) ) { $post_name = get_post_meta( $existing_post->ID, '_customize_draft_post_name', true ); } $existing_starter_content_posts[ $existing_post->post_type . ':' . $post_name ] = $existing_post; } } // Re-use non-auto-draft posts. if ( ! empty( $all_post_slugs ) ) { $existing_posts_query = new WP_Query( array( 'post_name__in' => $all_post_slugs, 'post_status' => array_diff( get_post_stati(), array( 'auto-draft' ) ), 'post_type' => 'any', 'posts_per_page' => -1, ) ); foreach ( $existing_posts_query->posts as $existing_post ) { $key = $existing_post->post_type . ':' . $existing_post->post_name; if ( isset( $needed_posts[ $key ] ) && ! isset( $existing_starter_content_posts[ $key ] ) ) { $existing_starter_content_posts[ $key ] = $existing_post; } } } // Attachments are technically posts but handled differently. if ( ! empty( $attachments ) ) { $attachment_ids = array(); foreach ( $attachments as $symbol => $attachment ) { $file_array = array( 'name' => $attachment['file_name'], ); $file_path = $attachment['file_path']; $attachment_id = null; $attached_file = null; if ( isset( $existing_starter_content_posts[ 'attachment:' . $attachment['post_name'] ] ) ) { $attachment_post = $existing_starter_content_posts[ 'attachment:' . $attachment['post_name'] ]; $attachment_id = $attachment_post->ID; $attached_file = get_attached_file( $attachment_id ); if ( empty( $attached_file ) || ! file_exists( $attached_file ) ) { $attachment_id = null; $attached_file = null; } elseif ( $this->get_stylesheet() !== get_post_meta( $attachment_post->ID, '_starter_content_theme', true ) ) { // Re-generate attachment metadata since it was previously generated for a different theme. $metadata = wp_generate_attachment_metadata( $attachment_post->ID, $attached_file ); wp_update_attachment_metadata( $attachment_id, $metadata ); update_post_meta( $attachment_id, '_starter_content_theme', $this->get_stylesheet() ); } } // Insert the attachment auto-draft because it doesn't yet exist or the attached file is gone. if ( ! $attachment_id ) { // Copy file to temp location so that original file won't get deleted from theme after sideloading. $temp_file_name = wp_tempnam( wp_basename( $file_path ) ); if ( $temp_file_name && copy( $file_path, $temp_file_name ) ) { $file_array['tmp_name'] = $temp_file_name; } if ( empty( $file_array['tmp_name'] ) ) { continue; } $attachment_post_data = array_merge( wp_array_slice_assoc( $attachment, array( 'post_title', 'post_content', 'post_excerpt' ) ), array( 'post_status' => 'auto-draft', // So attachment will be garbage collected in a week if changeset is never published. ) ); $attachment_id = media_handle_sideload( $file_array, 0, null, $attachment_post_data ); if ( is_wp_error( $attachment_id ) ) { continue; } update_post_meta( $attachment_id, '_starter_content_theme', $this->get_stylesheet() ); update_post_meta( $attachment_id, '_customize_draft_post_name', $attachment['post_name'] ); } $attachment_ids[ $symbol ] = $attachment_id; } $starter_content_auto_draft_post_ids = array_merge( $starter_content_auto_draft_post_ids, array_values( $attachment_ids ) ); } // Posts & pages. if ( ! empty( $posts ) ) { foreach ( array_keys( $posts ) as $post_symbol ) { if ( empty( $posts[ $post_symbol ]['post_type'] ) || empty( $posts[ $post_symbol ]['post_name'] ) ) { continue; } $post_type = $posts[ $post_symbol ]['post_type']; if ( ! empty( $posts[ $post_symbol ]['post_name'] ) ) { $post_name = $posts[ $post_symbol ]['post_name']; } elseif ( ! empty( $posts[ $post_symbol ]['post_title'] ) ) { $post_name = sanitize_title( $posts[ $post_symbol ]['post_title'] ); } else { continue; } // Use existing auto-draft post if one already exists with the same type and name. if ( isset( $existing_starter_content_posts[ $post_type . ':' . $post_name ] ) ) { $posts[ $post_symbol ]['ID'] = $existing_starter_content_posts[ $post_type . ':' . $post_name ]->ID; continue; } // Translate the featured image symbol. if ( ! empty( $posts[ $post_symbol ]['thumbnail'] ) && preg_match( '/^{{(?P<symbol>.+)}}$/', $posts[ $post_symbol ]['thumbnail'], $matches ) && isset( $attachment_ids[ $matches['symbol'] ] ) ) { $posts[ $post_symbol ]['meta_input']['_thumbnail_id'] = $attachment_ids[ $matches['symbol'] ]; } if ( ! empty( $posts[ $post_symbol ]['template'] ) ) { $posts[ $post_symbol ]['meta_input']['_wp_page_template'] = $posts[ $post_symbol ]['template']; } $r = $this->nav_menus->insert_auto_draft_post( $posts[ $post_symbol ] ); if ( $r instanceof WP_Post ) { $posts[ $post_symbol ]['ID'] = $r->ID; } } $starter_content_auto_draft_post_ids = array_merge( $starter_content_auto_draft_post_ids, wp_list_pluck( $posts, 'ID' ) ); } // The nav_menus_created_posts setting is why nav_menus component is dependency for adding posts. if ( ! empty( $this->nav_menus ) && ! empty( $starter_content_auto_draft_post_ids ) ) { $setting_id = 'nav_menus_created_posts'; $this->set_post_value( $setting_id, array_unique( array_values( $starter_content_auto_draft_post_ids ) ) ); $this->pending_starter_content_settings_ids[] = $setting_id; } // Nav menus. $placeholder_id = -1; $reused_nav_menu_setting_ids = array(); foreach ( $nav_menus as $nav_menu_location => $nav_menu ) { $nav_menu_term_id = null; $nav_menu_setting_id = null; $matches = array(); // Look for an existing placeholder menu with starter content to re-use. foreach ( $changeset_data as $setting_id => $setting_params ) { $can_reuse = ( ! empty( $setting_params['starter_content'] ) && ! in_array( $setting_id, $reused_nav_menu_setting_ids, true ) && preg_match( '#^nav_menu\[(?P<nav_menu_id>-?\d+)\]$#', $setting_id, $matches ) ); if ( $can_reuse ) { $nav_menu_term_id = (int) $matches['nav_menu_id']; $nav_menu_setting_id = $setting_id; $reused_nav_menu_setting_ids[] = $setting_id; break; } } if ( ! $nav_menu_term_id ) { while ( isset( $changeset_data[ sprintf( 'nav_menu[%d]', $placeholder_id ) ] ) ) { --$placeholder_id; } $nav_menu_term_id = $placeholder_id; $nav_menu_setting_id = sprintf( 'nav_menu[%d]', $placeholder_id ); } $this->set_post_value( $nav_menu_setting_id, array( 'name' => isset( $nav_menu['name'] ) ? $nav_menu['name'] : $nav_menu_location, ) ); $this->pending_starter_content_settings_ids[] = $nav_menu_setting_id; // @todo Add support for menu_item_parent. $position = 0; foreach ( $nav_menu['items'] as $nav_menu_item ) { $nav_menu_item_setting_id = sprintf( 'nav_menu_item[%d]', $placeholder_id-- ); if ( ! isset( $nav_menu_item['position'] ) ) { $nav_menu_item['position'] = $position++; } $nav_menu_item['nav_menu_term_id'] = $nav_menu_term_id; if ( isset( $nav_menu_item['object_id'] ) ) { if ( 'post_type' === $nav_menu_item['type'] && preg_match( '/^{{(?P<symbol>.+)}}$/', $nav_menu_item['object_id'], $matches ) && isset( $posts[ $matches['symbol'] ] ) ) { $nav_menu_item['object_id'] = $posts[ $matches['symbol'] ]['ID']; if ( empty( $nav_menu_item['title'] ) ) { $original_object = get_post( $nav_menu_item['object_id'] ); $nav_menu_item['title'] = $original_object->post_title; } } else { continue; } } else { $nav_menu_item['object_id'] = 0; } if ( empty( $changeset_data[ $nav_menu_item_setting_id ] ) || ! empty( $changeset_data[ $nav_menu_item_setting_id ]['starter_content'] ) ) { $this->set_post_value( $nav_menu_item_setting_id, $nav_menu_item ); $this->pending_starter_content_settings_ids[] = $nav_menu_item_setting_id; } } $setting_id = sprintf( 'nav_menu_locations[%s]', $nav_menu_location ); if ( empty( $changeset_data[ $setting_id ] ) || ! empty( $changeset_data[ $setting_id ]['starter_content'] ) ) { $this->set_post_value( $setting_id, $nav_menu_term_id ); $this->pending_starter_content_settings_ids[] = $setting_id; } } // Options. foreach ( $options as $name => $value ) { // Serialize the value to check for post symbols. $value = maybe_serialize( $value ); if ( is_serialized( $value ) ) { if ( preg_match( '/s:\d+:"{{(?P<symbol>.+)}}"/', $value, $matches ) ) { if ( isset( $posts[ $matches['symbol'] ] ) ) { $symbol_match = $posts[ $matches['symbol'] ]['ID']; } elseif ( isset( $attachment_ids[ $matches['symbol'] ] ) ) { $symbol_match = $attachment_ids[ $matches['symbol'] ]; } // If we have any symbol matches, update the values. if ( isset( $symbol_match ) ) { // Replace found string matches with post IDs. $value = str_replace( $matches[0], "i:{$symbol_match}", $value ); } else { continue; } } } elseif ( preg_match( '/^{{(?P<symbol>.+)}}$/', $value, $matches ) ) { if ( isset( $posts[ $matches['symbol'] ] ) ) { $value = $posts[ $matches['symbol'] ]['ID']; } elseif ( isset( $attachment_ids[ $matches['symbol'] ] ) ) { $value = $attachment_ids[ $matches['symbol'] ]; } else { continue; } } // Unserialize values after checking for post symbols, so they can be properly referenced. $value = maybe_unserialize( $value ); if ( empty( $changeset_data[ $name ] ) || ! empty( $changeset_data[ $name ]['starter_content'] ) ) { $this->set_post_value( $name, $value ); $this->pending_starter_content_settings_ids[] = $name; } } // Theme mods. foreach ( $theme_mods as $name => $value ) { // Serialize the value to check for post symbols. $value = maybe_serialize( $value ); // Check if value was serialized. if ( is_serialized( $value ) ) { if ( preg_match( '/s:\d+:"{{(?P<symbol>.+)}}"/', $value, $matches ) ) { if ( isset( $posts[ $matches['symbol'] ] ) ) { $symbol_match = $posts[ $matches['symbol'] ]['ID']; } elseif ( isset( $attachment_ids[ $matches['symbol'] ] ) ) { $symbol_match = $attachment_ids[ $matches['symbol'] ]; } // If we have any symbol matches, update the values. if ( isset( $symbol_match ) ) { // Replace found string matches with post IDs. $value = str_replace( $matches[0], "i:{$symbol_match}", $value ); } else { continue; } } } elseif ( preg_match( '/^{{(?P<symbol>.+)}}$/', $value, $matches ) ) { if ( isset( $posts[ $matches['symbol'] ] ) ) { $value = $posts[ $matches['symbol'] ]['ID']; } elseif ( isset( $attachment_ids[ $matches['symbol'] ] ) ) { $value = $attachment_ids[ $matches['symbol'] ]; } else { continue; } } // Unserialize values after checking for post symbols, so they can be properly referenced. $value = maybe_unserialize( $value ); // Handle header image as special case since setting has a legacy format. if ( 'header_image' === $name ) { $name = 'header_image_data'; $metadata = wp_get_attachment_metadata( $value ); if ( empty( $metadata ) ) { continue; } $value = array( 'attachment_id' => $value, 'url' => wp_get_attachment_url( $value ), 'height' => $metadata['height'], 'width' => $metadata['width'], ); } elseif ( 'background_image' === $name ) { $value = wp_get_attachment_url( $value ); } if ( empty( $changeset_data[ $name ] ) || ! empty( $changeset_data[ $name ]['starter_content'] ) ) { $this->set_post_value( $name, $value ); $this->pending_starter_content_settings_ids[] = $name; } } if ( ! empty( $this->pending_starter_content_settings_ids ) ) { if ( did_action( 'customize_register' ) ) { $this->_save_starter_content_changeset(); } else { add_action( 'customize_register', array( $this, '_save_starter_content_changeset' ), 1000 ); } } } /** * Prepares starter content attachments. * * Ensure that the attachments are valid and that they have slugs and file name/path. * * @since 4.7.0 * * @param array $attachments Attachments. * @return array Prepared attachments. */ protected function prepare_starter_content_attachments( $attachments ) { $prepared_attachments = array(); if ( empty( $attachments ) ) { return $prepared_attachments; } // Such is The WordPress Way. require_once ABSPATH . 'wp-admin/includes/file.php'; require_once ABSPATH . 'wp-admin/includes/media.php'; require_once ABSPATH . 'wp-admin/includes/image.php'; foreach ( $attachments as $symbol => $attachment ) { // A file is required and URLs to files are not currently allowed. if ( empty( $attachment['file'] ) || preg_match( '#^https?://$#', $attachment['file'] ) ) { continue; } $file_path = null; if ( file_exists( $attachment['file'] ) ) { $file_path = $attachment['file']; // Could be absolute path to file in plugin. } elseif ( is_child_theme() && file_exists( get_stylesheet_directory() . '/' . $attachment['file'] ) ) { $file_path = get_stylesheet_directory() . '/' . $attachment['file']; } elseif ( file_exists( get_template_directory() . '/' . $attachment['file'] ) ) { $file_path = get_template_directory() . '/' . $attachment['file']; } else { continue; } $file_name = wp_basename( $attachment['file'] ); // Skip file types that are not recognized. $checked_filetype = wp_check_filetype( $file_name ); if ( empty( $checked_filetype['type'] ) ) { continue; } // Ensure post_name is set since not automatically derived from post_title for new auto-draft posts. if ( empty( $attachment['post_name'] ) ) { if ( ! empty( $attachment['post_title'] ) ) { $attachment['post_name'] = sanitize_title( $attachment['post_title'] ); } else { $attachment['post_name'] = sanitize_title( preg_replace( '/\.\w+$/', '', $file_name ) ); } } $attachment['file_name'] = $file_name; $attachment['file_path'] = $file_path; $prepared_attachments[ $symbol ] = $attachment; } return $prepared_attachments; } /** * Saves starter content changeset. * * @since 4.7.0 */ public function _save_starter_content_changeset() { if ( empty( $this->pending_starter_content_settings_ids ) ) { return; } $this->save_changeset_post( array( 'data' => array_fill_keys( $this->pending_starter_content_settings_ids, array( 'starter_content' => true ) ), 'starter_content' => true, ) ); $this->saved_starter_content_changeset = true; $this->pending_starter_content_settings_ids = array(); } /** * Gets dirty pre-sanitized setting values in the current customized state. * * The returned array consists of a merge of three sources: * 1. If the theme is not currently active, then the base array is any stashed * theme mods that were modified previously but never published. * 2. The values from the current changeset, if it exists. * 3. If the user can customize, the values parsed from the incoming * `$_POST['customized']` JSON data. * 4. Any programmatically-set post values via `WP_Customize_Manager::set_post_value()`. * * The name "unsanitized_post_values" is a carry-over from when the customized * state was exclusively sourced from `$_POST['customized']`. Nevertheless, * the value returned will come from the current changeset post and from the * incoming post data. * * @since 4.1.1 * @since 4.7.0 Added `$args` parameter and merging with changeset values and stashed theme mods. * * @param array $args { * Args. * * @type bool $exclude_changeset Whether the changeset values should also be excluded. Defaults to false. * @type bool $exclude_post_data Whether the post input values should also be excluded. Defaults to false when lacking the customize capability. * } * @return array */ public function unsanitized_post_values( $args = array() ) { $args = array_merge( array( 'exclude_changeset' => false, 'exclude_post_data' => ! current_user_can( 'customize' ), ), $args ); $values = array(); // Let default values be from the stashed theme mods if doing a theme switch and if no changeset is present. if ( ! $this->is_theme_active() ) { $stashed_theme_mods = get_option( 'customize_stashed_theme_mods' ); $stylesheet = $this->get_stylesheet(); if ( isset( $stashed_theme_mods[ $stylesheet ] ) ) { $values = array_merge( $values, wp_list_pluck( $stashed_theme_mods[ $stylesheet ], 'value' ) ); } } if ( ! $args['exclude_changeset'] ) { foreach ( $this->changeset_data() as $setting_id => $setting_params ) { if ( ! array_key_exists( 'value', $setting_params ) ) { continue; } if ( isset( $setting_params['type'] ) && 'theme_mod' === $setting_params['type'] ) { // Ensure that theme mods values are only used if they were saved under the active theme. $namespace_pattern = '/^(?P<stylesheet>.+?)::(?P<setting_id>.+)$/'; if ( preg_match( $namespace_pattern, $setting_id, $matches ) && $this->get_stylesheet() === $matches['stylesheet'] ) { $values[ $matches['setting_id'] ] = $setting_params['value']; } } else { $values[ $setting_id ] = $setting_params['value']; } } } if ( ! $args['exclude_post_data'] ) { if ( ! isset( $this->_post_values ) ) { if ( isset( $_POST['customized'] ) ) { $post_values = json_decode( wp_unslash( $_POST['customized'] ), true ); } else { $post_values = array(); } if ( is_array( $post_values ) ) { $this->_post_values = $post_values; } else { $this->_post_values = array(); } } $values = array_merge( $values, $this->_post_values ); } return $values; } /** * Returns the sanitized value for a given setting from the current customized state. * * The name "post_value" is a carry-over from when the customized state was exclusively * sourced from `$_POST['customized']`. Nevertheless, the value returned will come * from the current changeset post and from the incoming post data. * * @since 3.4.0 * @since 4.1.1 Introduced the `$default_value` parameter. * @since 4.6.0 `$default_value` is now returned early when the setting post value is invalid. * * @see WP_REST_Server::dispatch() * @see WP_REST_Request::sanitize_params() * @see WP_REST_Request::has_valid_params() * * @param WP_Customize_Setting $setting A WP_Customize_Setting derived object. * @param mixed $default_value Value returned if `$setting` has no post value (added in 4.2.0) * or the post value is invalid (added in 4.6.0). * @return string|mixed Sanitized value or the `$default_value` provided. */ public function post_value( $setting, $default_value = null ) { $post_values = $this->unsanitized_post_values(); if ( ! array_key_exists( $setting->id, $post_values ) ) { return $default_value; } $value = $post_values[ $setting->id ]; $valid = $setting->validate( $value ); if ( is_wp_error( $valid ) ) { return $default_value; } $value = $setting->sanitize( $value ); if ( is_null( $value ) || is_wp_error( $value ) ) { return $default_value; } return $value; } /** * Overrides a setting's value in the current customized state. * * The name "post_value" is a carry-over from when the customized state was * exclusively sourced from `$_POST['customized']`. * * @since 4.2.0 * * @param string $setting_id ID for the WP_Customize_Setting instance. * @param mixed $value Post value. */ public function set_post_value( $setting_id, $value ) { $this->unsanitized_post_values(); // Populate _post_values from $_POST['customized']. $this->_post_values[ $setting_id ] = $value; /** * Announces when a specific setting's unsanitized post value has been set. * * Fires when the WP_Customize_Manager::set_post_value() method is called. * * The dynamic portion of the hook name, `$setting_id`, refers to the setting ID. * * @since 4.4.0 * * @param mixed $value Unsanitized setting post value. * @param WP_Customize_Manager $manager WP_Customize_Manager instance. */ do_action( "customize_post_value_set_{$setting_id}", $value, $this ); /** * Announces when any setting's unsanitized post value has been set. * * Fires when the WP_Customize_Manager::set_post_value() method is called. * * This is useful for `WP_Customize_Setting` instances to watch * in order to update a cached previewed value. * * @since 4.4.0 * * @param string $setting_id Setting ID. * @param mixed $value Unsanitized setting post value. * @param WP_Customize_Manager $manager WP_Customize_Manager instance. */ do_action( 'customize_post_value_set', $setting_id, $value, $this ); } /** * Prints JavaScript settings. * * @since 3.4.0 */ public function customize_preview_init() { /* * Now that Customizer previews are loaded into iframes via GET requests * and natural URLs with transaction UUIDs added, we need to ensure that * the responses are never cached by proxies. In practice, this will not * be needed if the user is logged-in anyway. But if anonymous access is * allowed then the auth cookies would not be sent and WordPress would * not send no-cache headers by default. */ if ( ! headers_sent() ) { nocache_headers(); header( 'X-Robots: noindex, nofollow, noarchive' ); header( 'X-Robots-Tag: noindex, nofollow, noarchive' ); } add_filter( 'wp_robots', 'wp_robots_no_robots' ); add_filter( 'wp_headers', array( $this, 'filter_iframe_security_headers' ) ); /* * If preview is being served inside the customizer preview iframe, and * if the user doesn't have customize capability, then it is assumed * that the user's session has expired and they need to re-authenticate. */ if ( $this->messenger_channel && ! current_user_can( 'customize' ) ) { $this->wp_die( -1, sprintf( /* translators: %s: customize_messenger_channel */ __( 'Unauthorized. You may remove the %s param to preview as frontend.' ), '<code>customize_messenger_channel<code>' ) ); return; } $this->prepare_controls(); add_filter( 'wp_redirect', array( $this, 'add_state_query_params' ) ); wp_enqueue_script( 'customize-preview' ); wp_enqueue_style( 'customize-preview' ); add_action( 'wp_head', array( $this, 'customize_preview_loading_style' ) ); add_action( 'wp_head', array( $this, 'remove_frameless_preview_messenger_channel' ) ); add_action( 'wp_footer', array( $this, 'customize_preview_settings' ), 20 ); add_filter( 'get_edit_post_link', '__return_empty_string' ); /** * Fires once the Customizer preview has initialized and JavaScript * settings have been printed. * * @since 3.4.0 * * @param WP_Customize_Manager $manager WP_Customize_Manager instance. */ do_action( 'customize_preview_init', $this ); } /** * Filters the X-Frame-Options and Content-Security-Policy headers to ensure frontend can load in customizer. * * @since 4.7.0 * * @param array $headers Headers. * @return array Headers. */ public function filter_iframe_security_headers( $headers ) { $headers['X-Frame-Options'] = 'SAMEORIGIN'; $headers['Content-Security-Policy'] = "frame-ancestors 'self'"; return $headers; } /** * Adds customize state query params to a given URL if preview is allowed. * * @since 4.7.0 * * @see wp_redirect() * @see WP_Customize_Manager::get_allowed_url() * * @param string $url URL. * @return string URL. */ public function add_state_query_params( $url ) { $parsed_original_url = wp_parse_url( $url ); $is_allowed = false; foreach ( $this->get_allowed_urls() as $allowed_url ) { $parsed_allowed_url = wp_parse_url( $allowed_url ); $is_allowed = ( $parsed_allowed_url['scheme'] === $parsed_original_url['scheme'] && $parsed_allowed_url['host'] === $parsed_original_url['host'] && str_starts_with( $parsed_original_url['path'], $parsed_allowed_url['path'] ) ); if ( $is_allowed ) { break; } } if ( $is_allowed ) { $query_params = array( 'customize_changeset_uuid' => $this->changeset_uuid(), ); if ( ! $this->is_theme_active() ) { $query_params['customize_theme'] = $this->get_stylesheet(); } if ( $this->messenger_channel ) { $query_params['customize_messenger_channel'] = $this->messenger_channel; } $url = add_query_arg( $query_params, $url ); } return $url; } /** * Prevents sending a 404 status when returning the response for the customize * preview, since it causes the jQuery Ajax to fail. Send 200 instead. * * @since 4.0.0 * @deprecated 4.7.0 */ public function customize_preview_override_404_status() { _deprecated_function( __METHOD__, '4.7.0' ); } /** * Prints base element for preview frame. * * @since 3.4.0 * @deprecated 4.7.0 */ public function customize_preview_base() { _deprecated_function( __METHOD__, '4.7.0' ); } /** * Prints a workaround to handle HTML5 tags in IE < 9. * * @since 3.4.0 * @deprecated 4.7.0 Customizer no longer supports IE8, so all supported browsers recognize HTML5. */ public function customize_preview_html5() { _deprecated_function( __FUNCTION__, '4.7.0' ); } /** * Prints CSS for loading indicators for the Customizer preview. * * @since 4.2.0 */ public function customize_preview_loading_style() { ?> <style> body.wp-customizer-unloading { opacity: 0.25; cursor: progress !important; -webkit-transition: opacity 0.5s; transition: opacity 0.5s; } body.wp-customizer-unloading * { pointer-events: none !important; } form.customize-unpreviewable, form.customize-unpreviewable input, form.customize-unpreviewable select, form.customize-unpreviewable button, a.customize-unpreviewable, area.customize-unpreviewable { cursor: not-allowed !important; } </style> <?php } /** * Removes customize_messenger_channel query parameter from the preview window when it is not in an iframe. * * This ensures that the admin bar will be shown. It also ensures that link navigation will * work as expected since the parent frame is not being sent the URL to navigate to. * * @since 4.7.0 */ public function remove_frameless_preview_messenger_channel() { if ( ! $this->messenger_channel ) { return; } ob_start(); ?> <script> ( function() { if ( parent !== window ) { return; } const url = new URL( location.href ); if ( url.searchParams.has( 'customize_messenger_channel' ) ) { url.searchParams.delete( 'customize_messenger_channel' ); location.replace( url ); } } )(); </script> <?php wp_print_inline_script_tag( wp_remove_surrounding_empty_script_tags( ob_get_clean() ) . "\n//# sourceURL=" . rawurlencode( __METHOD__ ) ); } /** * Prints JavaScript settings for preview frame. * * @since 3.4.0 */ public function customize_preview_settings() { $post_values = $this->unsanitized_post_values( array( 'exclude_changeset' => true ) ); $setting_validities = $this->validate_setting_values( $post_values ); $exported_setting_validities = array_map( array( $this, 'prepare_setting_validity_for_js' ), $setting_validities ); // Note that the REQUEST_URI is not passed into home_url() since this breaks subdirectory installations. $self_url = empty( $_SERVER['REQUEST_URI'] ) ? home_url( '/' ) : sanitize_url( wp_unslash( $_SERVER['REQUEST_URI'] ) ); $state_query_params = array( 'customize_theme', 'customize_changeset_uuid', 'customize_messenger_channel', ); $self_url = remove_query_arg( $state_query_params, $self_url ); $allowed_urls = $this->get_allowed_urls(); $allowed_hosts = array(); foreach ( $allowed_urls as $allowed_url ) { $parsed = wp_parse_url( $allowed_url ); if ( empty( $parsed['host'] ) ) { continue; } $host = $parsed['host']; if ( ! empty( $parsed['port'] ) ) { $host .= ':' . $parsed['port']; } $allowed_hosts[] = $host; } $switched_locale = switch_to_user_locale( get_current_user_id() ); $l10n = array( 'shiftClickToEdit' => __( 'Shift-click to edit this element.' ), 'linkUnpreviewable' => __( 'This link is not live-previewable.' ), 'formUnpreviewable' => __( 'This form is not live-previewable.' ), ); if ( $switched_locale ) { restore_previous_locale(); } $settings = array( 'changeset' => array( 'uuid' => $this->changeset_uuid(), 'autosaved' => $this->autosaved(), ), 'timeouts' => array( 'selectiveRefresh' => 250, 'keepAliveSend' => 1000, ), 'theme' => array( 'stylesheet' => $this->get_stylesheet(), 'active' => $this->is_theme_active(), 'isBlockTheme' => wp_is_block_theme(), ), 'url' => array( 'self' => $self_url, 'allowed' => array_map( 'sanitize_url', $this->get_allowed_urls() ), 'allowedHosts' => array_unique( $allowed_hosts ), 'isCrossDomain' => $this->is_cross_domain(), ), 'channel' => $this->messenger_channel, 'activePanels' => array(), 'activeSections' => array(), 'activeControls' => array(), 'settingValidities' => $exported_setting_validities, 'nonce' => current_user_can( 'customize' ) ? $this->get_nonces() : array(), 'l10n' => $l10n, '_dirty' => array_keys( $post_values ), ); foreach ( $this->panels as $panel_id => $panel ) { if ( $panel->check_capabilities() ) { $settings['activePanels'][ $panel_id ] = $panel->active(); foreach ( $panel->sections as $section_id => $section ) { if ( $section->check_capabilities() ) { $settings['activeSections'][ $section_id ] = $section->active(); } } } } foreach ( $this->sections as $id => $section ) { if ( $section->check_capabilities() ) { $settings['activeSections'][ $id ] = $section->active(); } } foreach ( $this->controls as $id => $control ) { if ( $control->check_capabilities() ) { $settings['activeControls'][ $id ] = $control->active(); } } ob_start(); ?> <script> var _wpCustomizeSettings = <?php echo wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>; _wpCustomizeSettings.values = {}; (function( v ) { <?php /* * Serialize settings separately from the initial _wpCustomizeSettings * serialization in order to avoid a peak memory usage spike. * @todo We may not even need to export the values at all since the pane syncs them anyway. */ foreach ( $this->settings as $id => $setting ) { if ( $setting->check_capabilities() ) { printf( "v[%s] = %s;\n", wp_json_encode( $id, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ), wp_json_encode( $setting->js_value(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ); } } ?> })( _wpCustomizeSettings.values ); </script> <?php wp_print_inline_script_tag( wp_remove_surrounding_empty_script_tags( ob_get_clean() ) . "\n//# sourceURL=" . rawurlencode( __METHOD__ ) ); } /** * Prints a signature so we can ensure the Customizer was properly executed. * * @since 3.4.0 * @deprecated 4.7.0 */ public function customize_preview_signature() { _deprecated_function( __METHOD__, '4.7.0' ); } /** * Removes the signature in case we experience a case where the Customizer was not properly executed. * * @since 3.4.0 * @deprecated 4.7.0 * * @param callable|null $callback Optional. Value passed through for {@see 'wp_die_handler'} filter. * Default null. * @return callable|null Value passed through for {@see 'wp_die_handler'} filter. */ public function remove_preview_signature( $callback = null ) { _deprecated_function( __METHOD__, '4.7.0' ); return $callback; } /** * Determines whether it is a theme preview or not. * * @since 3.4.0 * * @return bool True if it's a preview, false if not. */ public function is_preview() { return (bool) $this->previewing; } /** * Retrieves the template name of the previewed theme. * * @since 3.4.0 * * @return string Template name. */ public function get_template() { return $this->theme()->get_template(); } /** * Retrieves the stylesheet name of the previewed theme. * * @since 3.4.0 * * @return string Stylesheet name. */ public function get_stylesheet() { return $this->theme()->get_stylesheet(); } /** * Retrieves the template root of the previewed theme. * * @since 3.4.0 * * @return string Theme root. */ public function get_template_root() { return get_raw_theme_root( $this->get_template(), true ); } /** * Retrieves the stylesheet root of the previewed theme. * * @since 3.4.0 * * @return string Theme root. */ public function get_stylesheet_root() { return get_raw_theme_root( $this->get_stylesheet(), true ); } /** * Filters the active theme and return the name of the previewed theme. * * @since 3.4.0 * * @param mixed $current_theme {@internal Parameter is not used} * @return string Theme name. */ public function current_theme( $current_theme ) { return $this->theme()->display( 'Name' ); } /** * Validates setting values. * * Validation is skipped for unregistered settings or for values that are * already null since they will be skipped anyway. Sanitization is applied * to values that pass validation, and values that become null or `WP_Error` * after sanitizing are marked invalid. * * @since 4.6.0 * * @see WP_REST_Request::has_valid_params() * @see WP_Customize_Setting::validate() * * @param array $setting_values Mapping of setting IDs to values to validate and sanitize. * @param array $options { * Options. * * @type bool $validate_existence Whether a setting's existence will be checked. * @type bool $validate_capability Whether the setting capability will be checked. * } * @return array Mapping of setting IDs to return value of validate method calls, either `true` or `WP_Error`. */ public function validate_setting_values( $setting_values, $options = array() ) { $options = wp_parse_args( $options, array( 'validate_capability' => false, 'validate_existence' => false, ) ); $validities = array(); foreach ( $setting_values as $setting_id => $unsanitized_value ) { $setting = $this->get_setting( $setting_id ); if ( ! $setting ) { if ( $options['validate_existence'] ) { $validities[ $setting_id ] = new WP_Error( 'unrecognized', __( 'Setting does not exist or is unrecognized.' ) ); } continue; } if ( $options['validate_capability'] && ! current_user_can( $setting->capability ) ) { $validity = new WP_Error( 'unauthorized', __( 'Unauthorized to modify setting due to capability.' ) ); } else { if ( is_null( $unsanitized_value ) ) { continue; } $validity = $setting->validate( $unsanitized_value ); } if ( ! is_wp_error( $validity ) ) { /** This filter is documented in wp-includes/class-wp-customize-setting.php */ $late_validity = apply_filters( "customize_validate_{$setting->id}", new WP_Error(), $unsanitized_value, $setting ); if ( is_wp_error( $late_validity ) && $late_validity->has_errors() ) { $validity = $late_validity; } } if ( ! is_wp_error( $validity ) ) { $value = $setting->sanitize( $unsanitized_value ); if ( is_null( $value ) ) { $validity = false; } elseif ( is_wp_error( $value ) ) { $validity = $value; } } if ( false === $validity ) { $validity = new WP_Error( 'invalid_value', __( 'Invalid value.' ) ); } $validities[ $setting_id ] = $validity; } return $validities; } /** * Prepares setting validity for exporting to the client (JS). * * Converts `WP_Error` instance into array suitable for passing into the * `wp.customize.Notification` JS model. * * @since 4.6.0 * * @param true|WP_Error $validity Setting validity. * @return true|array If `$validity` was a WP_Error, the error codes will be array-mapped * to their respective `message` and `data` to pass into the * `wp.customize.Notification` JS model. */ public function prepare_setting_validity_for_js( $validity ) { if ( is_wp_error( $validity ) ) { $notification = array(); foreach ( $validity->errors as $error_code => $error_messages ) { $notification[ $error_code ] = array( 'message' => implode( ' ', $error_messages ), 'data' => $validity->get_error_data( $error_code ), ); } return $notification; } else { return true; } } /** * Handles customize_save WP Ajax request to save/update a changeset. * * @since 3.4.0 * @since 4.7.0 The semantics of this method have changed to update a changeset, optionally to also change the status and other attributes. */ public function save() { if ( ! is_user_logged_in() ) { wp_send_json_error( 'unauthenticated' ); } if ( ! $this->is_preview() ) { wp_send_json_error( 'not_preview' ); } $action = 'save-customize_' . $this->get_stylesheet(); if ( ! check_ajax_referer( $action, 'nonce', false ) ) { wp_send_json_error( 'invalid_nonce' ); } $changeset_post_id = $this->changeset_post_id(); $is_new_changeset = empty( $changeset_post_id ); if ( $is_new_changeset ) { if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->create_posts ) ) { wp_send_json_error( 'cannot_create_changeset_post' ); } } else { if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->edit_post, $changeset_post_id ) ) { wp_send_json_error( 'cannot_edit_changeset_post' ); } } if ( ! empty( $_POST['customize_changeset_data'] ) ) { $input_changeset_data = json_decode( wp_unslash( $_POST['customize_changeset_data'] ), true ); if ( ! is_array( $input_changeset_data ) ) { wp_send_json_error( 'invalid_customize_changeset_data' ); } } else { $input_changeset_data = array(); } // Validate title. $changeset_title = null; if ( isset( $_POST['customize_changeset_title'] ) ) { $changeset_title = sanitize_text_field( wp_unslash( $_POST['customize_changeset_title'] ) ); } // Validate changeset status param. $is_publish = null; $changeset_status = null; if ( isset( $_POST['customize_changeset_status'] ) ) { $changeset_status = wp_unslash( $_POST['customize_changeset_status'] ); if ( ! get_post_status_object( $changeset_status ) || ! in_array( $changeset_status, array( 'draft', 'pending', 'publish', 'future' ), true ) ) { wp_send_json_error( 'bad_customize_changeset_status', 400 ); } $is_publish = ( 'publish' === $changeset_status || 'future' === $changeset_status ); if ( $is_publish && ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->publish_posts ) ) { wp_send_json_error( 'changeset_publish_unauthorized', 403 ); } } /* * Validate changeset date param. Date is assumed to be in local time for * the WP if in MySQL format (YYYY-MM-DD HH:MM:SS). Otherwise, the date * is parsed with strtotime() so that ISO date format may be supplied * or a string like "+10 minutes". */ $changeset_date_gmt = null; if ( isset( $_POST['customize_changeset_date'] ) ) { $changeset_date = wp_unslash( $_POST['customize_changeset_date'] ); if ( preg_match( '/^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d$/', $changeset_date ) ) { $mm = substr( $changeset_date, 5, 2 ); $jj = substr( $changeset_date, 8, 2 ); $aa = substr( $changeset_date, 0, 4 ); $valid_date = wp_checkdate( $mm, $jj, $aa, $changeset_date ); if ( ! $valid_date ) { wp_send_json_error( 'bad_customize_changeset_date', 400 ); } $changeset_date_gmt = get_gmt_from_date( $changeset_date ); } else { $timestamp = strtotime( $changeset_date ); if ( ! $timestamp ) { wp_send_json_error( 'bad_customize_changeset_date', 400 ); } $changeset_date_gmt = gmdate( 'Y-m-d H:i:s', $timestamp ); } } $lock_user_id = null; $autosave = ! empty( $_POST['customize_changeset_autosave'] ); if ( ! $is_new_changeset ) { $lock_user_id = wp_check_post_lock( $this->changeset_post_id() ); } // Force request to autosave when changeset is locked. if ( $lock_user_id && ! $autosave ) { $autosave = true; $changeset_status = null; $changeset_date_gmt = null; } if ( $autosave && ! defined( 'DOING_AUTOSAVE' ) ) { // Back-compat. define( 'DOING_AUTOSAVE', true ); } $autosaved = false; $r = $this->save_changeset_post( array( 'status' => $changeset_status, 'title' => $changeset_title, 'date_gmt' => $changeset_date_gmt, 'data' => $input_changeset_data, 'autosave' => $autosave, ) ); if ( $autosave && ! is_wp_error( $r ) ) { $autosaved = true; } // If the changeset was locked and an autosave request wasn't itself an error, then now explicitly return with a failure. if ( $lock_user_id && ! is_wp_error( $r ) ) { $r = new WP_Error( 'changeset_locked', __( 'Changeset is being edited by other user.' ), array( 'lock_user' => $this->get_lock_user_data( $lock_user_id ), ) ); } if ( is_wp_error( $r ) ) { $response = array( 'message' => $r->get_error_message(), 'code' => $r->get_error_code(), ); if ( is_array( $r->get_error_data() ) ) { $response = array_merge( $response, $r->get_error_data() ); } else { $response['data'] = $r->get_error_data(); } } else { $response = $r; $changeset_post = get_post( $this->changeset_post_id() ); // Dismiss all other auto-draft changeset posts for this user (they serve like autosave revisions), as there should only be one. if ( $is_new_changeset ) { $this->dismiss_user_auto_draft_changesets(); } // Note that if the changeset status was publish, then it will get set to Trash if revisions are not supported. $response['changeset_status'] = $changeset_post->post_status; if ( $is_publish && 'trash' === $response['changeset_status'] ) { $response['changeset_status'] = 'publish'; } if ( 'publish' !== $response['changeset_status'] ) { $this->set_changeset_lock( $changeset_post->ID ); } if ( 'future' === $response['changeset_status'] ) { $response['changeset_date'] = $changeset_post->post_date; } if ( 'publish' === $response['changeset_status'] || 'trash' === $response['changeset_status'] ) { $response['next_changeset_uuid'] = wp_generate_uuid4(); } } if ( $autosave ) { $response['autosaved'] = $autosaved; } if ( isset( $response['setting_validities'] ) ) { $response['setting_validities'] = array_map( array( $this, 'prepare_setting_validity_for_js' ), $response['setting_validities'] ); } /** * Filters response data for a successful customize_save Ajax request. * * This filter does not apply if there was a nonce or authentication failure. * * @since 4.2.0 * * @param array $response Additional information passed back to the 'saved' * event on `wp.customize`. * @param WP_Customize_Manager $manager WP_Customize_Manager instance. */ $response = apply_filters( 'customize_save_response', $response, $this ); if ( is_wp_error( $r ) ) { wp_send_json_error( $response ); } else { wp_send_json_success( $response ); } } /** * Saves the post for the loaded changeset. * * @since 4.7.0 * * @param array $args { * Args for changeset post. * * @type array $data Optional additional changeset data. Values will be merged on top of any existing post values. * @type string $status Post status. Optional. If supplied, the save will be transactional and a post revision will be allowed. * @type string $title Post title. Optional. * @type string $date_gmt Date in GMT. Optional. * @type int $user_id ID for user who is saving the changeset. Optional, defaults to the current user ID. * @type bool $starter_content Whether the data is starter content. If false (default), then $starter_content will be cleared for any $data being saved. * @type bool $autosave Whether this is a request to create an autosave revision. * } * * @return array|WP_Error Returns array on success and WP_Error with array data on error. */ public function save_changeset_post( $args = array() ) { $args = array_merge( array( 'status' => null, 'title' => null, 'data' => array(), 'date_gmt' => null, 'user_id' => get_current_user_id(), 'starter_content' => false, 'autosave' => false, ), $args ); $changeset_post_id = $this->changeset_post_id(); $existing_changeset_data = array(); if ( $changeset_post_id ) { $existing_status = get_post_status( $changeset_post_id ); if ( 'publish' === $existing_status || 'trash' === $existing_status ) { return new WP_Error( 'changeset_already_published', __( 'The previous set of changes has already been published. Please try saving your current set of changes again.' ), array( 'next_changeset_uuid' => wp_generate_uuid4(), ) ); } $existing_changeset_data = $this->get_changeset_post_data( $changeset_post_id ); if ( is_wp_error( $existing_changeset_data ) ) { return $existing_changeset_data; } } // Fail if attempting to publish but publish hook is missing. if ( 'publish' === $args['status'] && false === has_action( 'transition_post_status', '_wp_customize_publish_changeset' ) ) { return new WP_Error( 'missing_publish_callback' ); } // Validate date. $now = gmdate( 'Y-m-d H:i:59' ); if ( $args['date_gmt'] ) { $is_future_dated = ( mysql2date( 'U', $args['date_gmt'], false ) > mysql2date( 'U', $now, false ) ); if ( ! $is_future_dated ) { return new WP_Error( 'not_future_date', __( 'You must supply a future date to schedule.' ) ); // Only future dates are allowed. } if ( ! $this->is_theme_active() && ( 'future' === $args['status'] || $is_future_dated ) ) { return new WP_Error( 'cannot_schedule_theme_switches' ); // This should be allowed in the future, when theme is a regular setting. } $will_remain_auto_draft = ( ! $args['status'] && ( ! $changeset_post_id || 'auto-draft' === get_post_status( $changeset_post_id ) ) ); if ( $will_remain_auto_draft ) { return new WP_Error( 'cannot_supply_date_for_auto_draft_changeset' ); } } elseif ( $changeset_post_id && 'future' === $args['status'] ) { // Fail if the new status is future but the existing post's date is not in the future. $changeset_post = get_post( $changeset_post_id ); if ( mysql2date( 'U', $changeset_post->post_date_gmt, false ) <= mysql2date( 'U', $now, false ) ) { return new WP_Error( 'not_future_date', __( 'You must supply a future date to schedule.' ) ); } } if ( ! empty( $is_future_dated ) && 'publish' === $args['status'] ) { $args['status'] = 'future'; } // Validate autosave param. See _wp_post_revision_fields() for why these fields are disallowed. if ( $args['autosave'] ) { if ( $args['date_gmt'] ) { return new WP_Error( 'illegal_autosave_with_date_gmt' ); } elseif ( $args['status'] ) { return new WP_Error( 'illegal_autosave_with_status' ); } elseif ( $args['user_id'] && get_current_user_id() !== $args['user_id'] ) { return new WP_Error( 'illegal_autosave_with_non_current_user' ); } } // The request was made via wp.customize.previewer.save(). $update_transactionally = (bool) $args['status']; $allow_revision = (bool) $args['status']; // Amend post values with any supplied data. foreach ( $args['data'] as $setting_id => $setting_params ) { if ( is_array( $setting_params ) && array_key_exists( 'value', $setting_params ) ) { $this->set_post_value( $setting_id, $setting_params['value'] ); // Add to post values so that they can be validated and sanitized. } } // Note that in addition to post data, this will include any stashed theme mods. $post_values = $this->unsanitized_post_values( array( 'exclude_changeset' => true, 'exclude_post_data' => false, ) ); $this->add_dynamic_settings( array_keys( $post_values ) ); // Ensure settings get created even if they lack an input value. /* * Get list of IDs for settings that have values different from what is currently * saved in the changeset. By skipping any values that are already the same, the * subset of changed settings can be passed into validate_setting_values to prevent * an underprivileged modifying a single setting for which they have the capability * from being blocked from saving. This also prevents a user from touching of the * previous saved settings and overriding the associated user_id if they made no change. */ $changed_setting_ids = array(); foreach ( $post_values as $setting_id => $setting_value ) { $setting = $this->get_setting( $setting_id ); if ( $setting && 'theme_mod' === $setting->type ) { $prefixed_setting_id = $this->get_stylesheet() . '::' . $setting->id; } else { $prefixed_setting_id = $setting_id; } $is_value_changed = ( ! isset( $existing_changeset_data[ $prefixed_setting_id ] ) || ! array_key_exists( 'value', $existing_changeset_data[ $prefixed_setting_id ] ) || $existing_changeset_data[ $prefixed_setting_id ]['value'] !== $setting_value ); if ( $is_value_changed ) { $changed_setting_ids[] = $setting_id; } } /** * Fires before save validation happens. * * Plugins can add just-in-time {@see 'customize_validate_{$this->ID}'} filters * at this point to catch any settings registered after `customize_register`. * The dynamic portion of the hook name, `$this->ID` refers to the setting ID. * * @since 4.6.0 * * @param WP_Customize_Manager $manager WP_Customize_Manager instance. */ do_action( 'customize_save_validation_before', $this ); // Validate settings. $validated_values = array_merge( array_fill_keys( array_keys( $args['data'] ), null ), // Make sure existence/capability checks are done on value-less setting updates. $post_values ); $setting_validities = $this->validate_setting_values( $validated_values, array( 'validate_capability' => true, 'validate_existence' => true, ) ); $invalid_setting_count = count( array_filter( $setting_validities, 'is_wp_error' ) ); /* * Short-circuit if there are invalid settings the update is transactional. * A changeset update is transactional when a status is supplied in the request. */ if ( $update_transactionally && $invalid_setting_count > 0 ) { $response = array( 'setting_validities' => $setting_validities, /* translators: %s: Number of invalid settings. */ 'message' => sprintf( _n( 'Unable to save due to %s invalid setting.', 'Unable to save due to %s invalid settings.', $invalid_setting_count ), number_format_i18n( $invalid_setting_count ) ), ); return new WP_Error( 'transaction_fail', '', $response ); } // Obtain/merge data for changeset. $original_changeset_data = $this->get_changeset_post_data( $changeset_post_id ); $data = $original_changeset_data; if ( is_wp_error( $data ) ) { $data = array(); } // Ensure that all post values are included in the changeset data. foreach ( $post_values as $setting_id => $post_value ) { if ( ! isset( $args['data'][ $setting_id ] ) ) { $args['data'][ $setting_id ] = array(); } if ( ! isset( $args['data'][ $setting_id ]['value'] ) ) { $args['data'][ $setting_id ]['value'] = $post_value; } } foreach ( $args['data'] as $setting_id => $setting_params ) { $setting = $this->get_setting( $setting_id ); if ( ! $setting || ! $setting->check_capabilities() ) { continue; } // Skip updating changeset for invalid setting values. if ( isset( $setting_validities[ $setting_id ] ) && is_wp_error( $setting_validities[ $setting_id ] ) ) { continue; } $changeset_setting_id = $setting_id; if ( 'theme_mod' === $setting->type ) { $changeset_setting_id = sprintf( '%s::%s', $this->get_stylesheet(), $setting_id ); } if ( null === $setting_params ) { // Remove setting from changeset entirely. unset( $data[ $changeset_setting_id ] ); } else { if ( ! isset( $data[ $changeset_setting_id ] ) ) { $data[ $changeset_setting_id ] = array(); } // Merge any additional setting params that have been supplied with the existing params. $merged_setting_params = array_merge( $data[ $changeset_setting_id ], $setting_params ); // Skip updating setting params if unchanged (ensuring the user_id is not overwritten). if ( $data[ $changeset_setting_id ] === $merged_setting_params ) { continue; } $data[ $changeset_setting_id ] = array_merge( $merged_setting_params, array( 'type' => $setting->type, 'user_id' => $args['user_id'], 'date_modified_gmt' => current_time( 'mysql', true ), ) ); // Clear starter_content flag in data if changeset is not explicitly being updated for starter content. if ( empty( $args['starter_content'] ) ) { unset( $data[ $changeset_setting_id ]['starter_content'] ); } } } $filter_context = array( 'uuid' => $this->changeset_uuid(), 'title' => $args['title'], 'status' => $args['status'], 'date_gmt' => $args['date_gmt'], 'post_id' => $changeset_post_id, 'previous_data' => is_wp_error( $original_changeset_data ) ? array() : $original_changeset_data, 'manager' => $this, ); /** * Filters the settings' data that will be persisted into the changeset. * * Plugins may amend additional data (such as additional meta for settings) into the changeset with this filter. * * @since 4.7.0 * * @param array $data Updated changeset data, mapping setting IDs to arrays containing a $value item and optionally other metadata. * @param array $context { * Filter context. * * @type string $uuid Changeset UUID. * @type string $title Requested title for the changeset post. * @type string $status Requested status for the changeset post. * @type string $date_gmt Requested date for the changeset post in MySQL format and GMT timezone. * @type int|false $post_id Post ID for the changeset, or false if it doesn't exist yet. * @type array $previous_data Previous data contained in the changeset. * @type WP_Customize_Manager $manager Manager instance. * } */ $data = apply_filters( 'customize_changeset_save_data', $data, $filter_context ); // Switch theme if publishing changes now. if ( 'publish' === $args['status'] && ! $this->is_theme_active() ) { // Temporarily stop previewing the theme to allow switch_themes() to operate properly. $this->stop_previewing_theme(); switch_theme( $this->get_stylesheet() ); update_option( 'theme_switched_via_customizer', true ); $this->start_previewing_theme(); } // Gather the data for wp_insert_post()/wp_update_post(). $post_array = array( // JSON_UNESCAPED_SLASHES is only to improve readability as slashes needn't be escaped in storage. 'post_content' => wp_json_encode( $data, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT ), ); if ( $args['title'] ) { $post_array['post_title'] = $args['title']; } if ( $changeset_post_id ) { $post_array['ID'] = $changeset_post_id; } else { $post_array['post_type'] = 'customize_changeset'; $post_array['post_name'] = $this->changeset_uuid(); $post_array['post_status'] = 'auto-draft'; } if ( $args['status'] ) { $post_array['post_status'] = $args['status']; } // Reset post date to now if we are publishing, otherwise pass post_date_gmt and translate for post_date. if ( 'publish' === $args['status'] ) { $post_array['post_date_gmt'] = '0000-00-00 00:00:00'; $post_array['post_date'] = '0000-00-00 00:00:00'; } elseif ( $args['date_gmt'] ) { $post_array['post_date_gmt'] = $args['date_gmt']; $post_array['post_date'] = get_date_from_gmt( $args['date_gmt'] ); } elseif ( $changeset_post_id && 'auto-draft' === get_post_status( $changeset_post_id ) ) { /* * Keep bumping the date for the auto-draft whenever it is modified; * this extends its life, preserving it from garbage-collection via * wp_delete_auto_drafts(). */ $post_array['post_date'] = current_time( 'mysql' ); $post_array['post_date_gmt'] = ''; } $this->store_changeset_revision = $allow_revision; add_filter( 'wp_save_post_revision_post_has_changed', array( $this, '_filter_revision_post_has_changed' ), 5, 3 ); /* * Update the changeset post. The publish_customize_changeset action will cause the settings in the * changeset to be saved via WP_Customize_Setting::save(). Updating a post with publish status will * trigger WP_Customize_Manager::publish_changeset_values(). */ add_filter( 'wp_insert_post_data', array( $this, 'preserve_insert_changeset_post_content' ), 5, 3 ); if ( $changeset_post_id ) { if ( $args['autosave'] && 'auto-draft' !== get_post_status( $changeset_post_id ) ) { // See _wp_translate_postdata() for why this is required as it will use the edit_post meta capability. add_filter( 'map_meta_cap', array( $this, 'grant_edit_post_capability_for_changeset' ), 10, 4 ); $post_array['post_ID'] = $post_array['ID']; $post_array['post_type'] = 'customize_changeset'; $r = wp_create_post_autosave( wp_slash( $post_array ) ); remove_filter( 'map_meta_cap', array( $this, 'grant_edit_post_capability_for_changeset' ), 10 ); } else { $post_array['edit_date'] = true; // Prevent date clearing. $r = wp_update_post( wp_slash( $post_array ), true ); // Delete autosave revision for user when the changeset is updated. if ( ! empty( $args['user_id'] ) ) { $autosave_draft = wp_get_post_autosave( $changeset_post_id, $args['user_id'] ); if ( $autosave_draft ) { wp_delete_post( $autosave_draft->ID, true ); } } } } else { $r = wp_insert_post( wp_slash( $post_array ), true ); if ( ! is_wp_error( $r ) ) { $this->_changeset_post_id = $r; // Update cached post ID for the loaded changeset. } } remove_filter( 'wp_insert_post_data', array( $this, 'preserve_insert_changeset_post_content' ), 5 ); $this->_changeset_data = null; // Reset so WP_Customize_Manager::changeset_data() will re-populate with updated contents. remove_filter( 'wp_save_post_revision_post_has_changed', array( $this, '_filter_revision_post_has_changed' ) ); $response = array( 'setting_validities' => $setting_validities, ); if ( is_wp_error( $r ) ) { $response['changeset_post_save_failure'] = $r->get_error_code(); return new WP_Error( 'changeset_post_save_failure', '', $response ); } return $response; } /** * Preserves the initial JSON post_content passed to save into the post. * * This is needed to prevent KSES and other {@see 'content_save_pre'} filters * from corrupting JSON data. * * Note that WP_Customize_Manager::validate_setting_values() have already * run on the setting values being serialized as JSON into the post content * so it is pre-sanitized. * * Also, the sanitization logic is re-run through the respective * WP_Customize_Setting::sanitize() method when being read out of the * changeset, via WP_Customize_Manager::post_value(), and this sanitized * value will also be sent into WP_Customize_Setting::update() for * persisting to the DB. * * Multiple users can collaborate on a single changeset, where one user may * have the unfiltered_html capability but another may not. A user with * unfiltered_html may add a script tag to some field which needs to be kept * intact even when another user updates the changeset to modify another field * when they do not have unfiltered_html. * * @since 5.4.1 * * @param array $data An array of slashed and processed post data. * @param array $postarr An array of sanitized (and slashed) but otherwise unmodified post data. * @param array $unsanitized_postarr An array of slashed yet *unsanitized* and unprocessed post data as originally passed to wp_insert_post(). * @return array Filtered post data. */ public function preserve_insert_changeset_post_content( $data, $postarr, $unsanitized_postarr ) { if ( isset( $data['post_type'] ) && isset( $unsanitized_postarr['post_content'] ) && 'customize_changeset' === $data['post_type'] || ( 'revision' === $data['post_type'] && ! empty( $data['post_parent'] ) && 'customize_changeset' === get_post_type( $data['post_parent'] ) ) ) { $data['post_content'] = $unsanitized_postarr['post_content']; } return $data; } /** * Trashes or deletes a changeset post. * * The following re-formulates the logic from `wp_trash_post()` as done in * `wp_publish_post()`. The reason for bypassing `wp_trash_post()` is that it * will mutate the the `post_content` and the `post_name` when they should be * untouched. * * @since 4.9.0 * * @see wp_trash_post() * @global wpdb $wpdb WordPress database abstraction object. * * @param int|WP_Post $post The changeset post. * @return mixed A WP_Post object for the trashed post or an empty value on failure. */ public function trash_changeset_post( $post ) { global $wpdb; $post = get_post( $post ); if ( ! ( $post instanceof WP_Post ) ) { return $post; } $post_id = $post->ID; if ( ! EMPTY_TRASH_DAYS ) { return wp_delete_post( $post_id, true ); } if ( 'trash' === get_post_status( $post ) ) { return false; } $previous_status = $post->post_status; /** This filter is documented in wp-includes/post.php */ $check = apply_filters( 'pre_trash_post', null, $post, $previous_status ); if ( null !== $check ) { return $check; } /** This action is documented in wp-includes/post.php */ do_action( 'wp_trash_post', $post_id, $previous_status ); add_post_meta( $post_id, '_wp_trash_meta_status', $previous_status ); add_post_meta( $post_id, '_wp_trash_meta_time', time() ); $new_status = 'trash'; $wpdb->update( $wpdb->posts, array( 'post_status' => $new_status ), array( 'ID' => $post->ID ) ); clean_post_cache( $post->ID ); $post->post_status = $new_status; wp_transition_post_status( $new_status, $previous_status, $post ); /** This action is documented in wp-includes/post.php */ do_action( "edit_post_{$post->post_type}", $post->ID, $post ); /** This action is documented in wp-includes/post.php */ do_action( 'edit_post', $post->ID, $post ); /** This action is documented in wp-includes/post.php */ do_action( "save_post_{$post->post_type}", $post->ID, $post, true ); /** This action is documented in wp-includes/post.php */ do_action( 'save_post', $post->ID, $post, true ); /** This action is documented in wp-includes/post.php */ do_action( 'wp_insert_post', $post->ID, $post, true ); wp_after_insert_post( get_post( $post_id ), true, $post ); wp_trash_post_comments( $post_id ); /** This action is documented in wp-includes/post.php */ do_action( 'trashed_post', $post_id, $previous_status ); return $post; } /** * Handles request to trash a changeset. * * @since 4.9.0 */ public function handle_changeset_trash_request() { if ( ! is_user_logged_in() ) { wp_send_json_error( 'unauthenticated' ); } if ( ! $this->is_preview() ) { wp_send_json_error( 'not_preview' ); } if ( ! check_ajax_referer( 'trash_customize_changeset', 'nonce', false ) ) { wp_send_json_error( array( 'code' => 'invalid_nonce', 'message' => __( 'There was an authentication problem. Please reload and try again.' ), ) ); } $changeset_post_id = $this->changeset_post_id(); if ( ! $changeset_post_id ) { wp_send_json_error( array( 'message' => __( 'No changes saved yet, so there is nothing to trash.' ), 'code' => 'non_existent_changeset', ) ); return; } if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->delete_post, $changeset_post_id ) ) { wp_send_json_error( array( 'code' => 'changeset_trash_unauthorized', 'message' => __( 'Unable to trash changes.' ), ) ); } $lock_user = (int) wp_check_post_lock( $changeset_post_id ); if ( $lock_user && get_current_user_id() !== $lock_user ) { wp_send_json_error( array( 'code' => 'changeset_locked', 'message' => __( 'Changeset is being edited by other user.' ), 'lockUser' => $this->get_lock_user_data( $lock_user ), ) ); } if ( 'trash' === get_post_status( $changeset_post_id ) ) { wp_send_json_error( array( 'message' => __( 'Changes have already been trashed.' ), 'code' => 'changeset_already_trashed', ) ); return; } $r = $this->trash_changeset_post( $changeset_post_id ); if ( ! ( $r instanceof WP_Post ) ) { wp_send_json_error( array( 'code' => 'changeset_trash_failure', 'message' => __( 'Unable to trash changes.' ), ) ); } wp_send_json_success( array( 'message' => __( 'Changes trashed successfully.' ), ) ); } /** * Re-maps 'edit_post' meta cap for a customize_changeset post to be the same as 'customize' maps. * * There is essentially a "meta meta" cap in play here, where 'edit_post' meta cap maps to * the 'customize' meta cap which then maps to 'edit_theme_options'. This is currently * required in core for `wp_create_post_autosave()` because it will call * `_wp_translate_postdata()` which in turn will check if a user can 'edit_post', but the * the caps for the customize_changeset post type are all mapping to the meta capability. * This should be able to be removed once #40922 is addressed in core. * * @since 4.9.0 * * @link https://core.trac.wordpress.org/ticket/40922 * @see WP_Customize_Manager::save_changeset_post() * @see _wp_translate_postdata() * * @param string[] $caps Array of the user's capabilities. * @param string $cap Capability name. * @param int $user_id The user ID. * @param array $args Adds the context to the cap. Typically the object ID. * @return array Capabilities. */ public function grant_edit_post_capability_for_changeset( $caps, $cap, $user_id, $args ) { if ( 'edit_post' === $cap && ! empty( $args[0] ) && 'customize_changeset' === get_post_type( $args[0] ) ) { $post_type_obj = get_post_type_object( 'customize_changeset' ); $caps = map_meta_cap( $post_type_obj->cap->$cap, $user_id ); } return $caps; } /** * Marks the changeset post as being currently edited by the current user. * * @since 4.9.0 * * @param int $changeset_post_id Changeset post ID. * @param bool $take_over Whether to take over the changeset. Default false. */ public function set_changeset_lock( $changeset_post_id, $take_over = false ) { if ( $changeset_post_id ) { $can_override = ! (bool) get_post_meta( $changeset_post_id, '_edit_lock', true ); if ( $take_over ) { $can_override = true; } if ( $can_override ) { $lock = sprintf( '%s:%s', time(), get_current_user_id() ); update_post_meta( $changeset_post_id, '_edit_lock', $lock ); } else { $this->refresh_changeset_lock( $changeset_post_id ); } } } /** * Refreshes changeset lock with the current time if current user edited the changeset before. * * @since 4.9.0 * * @param int $changeset_post_id Changeset post ID. */ public function refresh_changeset_lock( $changeset_post_id ) { if ( ! $changeset_post_id ) { return; } $lock = get_post_meta( $changeset_post_id, '_edit_lock', true ); $lock = explode( ':', $lock ); if ( $lock && ! empty( $lock[1] ) ) { $user_id = (int) $lock[1]; $current_user_id = get_current_user_id(); if ( $user_id === $current_user_id ) { $lock = sprintf( '%s:%s', time(), $user_id ); update_post_meta( $changeset_post_id, '_edit_lock', $lock ); } } } /** * Filters heartbeat settings for the Customizer. * * @since 4.9.0 * * @global string $pagenow The filename of the current screen. * * @param array $settings Current settings to filter. * @return array Heartbeat settings. */ public function add_customize_screen_to_heartbeat_settings( $settings ) { global $pagenow; if ( 'customize.php' === $pagenow ) { $settings['screenId'] = 'customize'; } return $settings; } /** * Gets lock user data. * * @since 4.9.0 * * @param int $user_id User ID. * @return array|null User data formatted for client. */ protected function get_lock_user_data( $user_id ) { if ( ! $user_id ) { return null; } $lock_user = get_userdata( $user_id ); if ( ! $lock_user ) { return null; } $user_details = array( 'id' => $lock_user->ID, 'name' => $lock_user->display_name, ); if ( get_option( 'show_avatars' ) ) { $user_details['avatar'] = get_avatar_url( $lock_user->ID, array( 'size' => 128 ) ); } return $user_details; } /** * Checks locked changeset with heartbeat API. * * @since 4.9.0 * * @param array $response The Heartbeat response. * @param array $data The $_POST data sent. * @param string $screen_id The screen id. * @return array The Heartbeat response. */ public function check_changeset_lock_with_heartbeat( $response, $data, $screen_id ) { if ( isset( $data['changeset_uuid'] ) ) { $changeset_post_id = $this->find_changeset_post_id( $data['changeset_uuid'] ); } else { $changeset_post_id = $this->changeset_post_id(); } if ( array_key_exists( 'check_changeset_lock', $data ) && 'customize' === $screen_id && $changeset_post_id && current_user_can( get_post_type_object( 'customize_changeset' )->cap->edit_post, $changeset_post_id ) ) { $lock_user_id = wp_check_post_lock( $changeset_post_id ); if ( $lock_user_id ) { $response['customize_changeset_lock_user'] = $this->get_lock_user_data( $lock_user_id ); } else { // Refreshing time will ensure that the user is sitting on customizer and has not closed the customizer tab. $this->refresh_changeset_lock( $changeset_post_id ); } } return $response; } /** * Removes changeset lock when take over request is sent via Ajax. * * @since 4.9.0 */ public function handle_override_changeset_lock_request() { if ( ! $this->is_preview() ) { wp_send_json_error( 'not_preview', 400 ); } if ( ! check_ajax_referer( 'customize_override_changeset_lock', 'nonce', false ) ) { wp_send_json_error( array( 'code' => 'invalid_nonce', 'message' => __( 'Security check failed.' ), ) ); } $changeset_post_id = $this->changeset_post_id(); if ( empty( $changeset_post_id ) ) { wp_send_json_error( array( 'code' => 'no_changeset_found_to_take_over', 'message' => __( 'No changeset found to take over' ), ) ); } if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->edit_post, $changeset_post_id ) ) { wp_send_json_error( array( 'code' => 'cannot_remove_changeset_lock', 'message' => __( 'Sorry, you are not allowed to take over.' ), ) ); } $this->set_changeset_lock( $changeset_post_id, true ); wp_send_json_success( 'changeset_taken_over' ); } /** * Determines whether a changeset revision should be made. * * @since 4.7.0 * @var bool */ protected $store_changeset_revision; /** * Filters whether a changeset has changed to create a new revision. * * Note that this will not be called while a changeset post remains in auto-draft status. * * @since 4.7.0 * * @param bool $post_has_changed Whether the post has changed. * @param WP_Post $latest_revision The latest revision post object. * @param WP_Post $post The post object. * @return bool Whether a revision should be made. */ public function _filter_revision_post_has_changed( $post_has_changed, $latest_revision, $post ) { unset( $latest_revision ); if ( 'customize_changeset' === $post->post_type ) { $post_has_changed = $this->store_changeset_revision; } return $post_has_changed; } /** * Publishes the values of a changeset. * * This will publish the values contained in a changeset, even changesets that do not * correspond to current manager instance. This is called by * `_wp_customize_publish_changeset()` when a customize_changeset post is * transitioned to the `publish` status. As such, this method should not be * called directly and instead `wp_publish_post()` should be used. * * Please note that if the settings in the changeset are for a non-activated * theme, the theme must first be switched to (via `switch_theme()`) before * invoking this method. * * @since 4.7.0 * * @see _wp_customize_publish_changeset() * @global wpdb $wpdb WordPress database abstraction object. * * @param int $changeset_post_id ID for customize_changeset post. Defaults to the changeset for the current manager instance. * @return true|WP_Error True or error info. */ public function _publish_changeset_values( $changeset_post_id ) { global $wpdb; $publishing_changeset_data = $this->get_changeset_post_data( $changeset_post_id ); if ( is_wp_error( $publishing_changeset_data ) ) { return $publishing_changeset_data; } $changeset_post = get_post( $changeset_post_id ); /* * Temporarily override the changeset context so that it will be read * in calls to unsanitized_post_values() and so that it will be available * on the $wp_customize object passed to hooks during the save logic. */ $previous_changeset_post_id = $this->_changeset_post_id; $this->_changeset_post_id = $changeset_post_id; $previous_changeset_uuid = $this->_changeset_uuid; $this->_changeset_uuid = $changeset_post->post_name; $previous_changeset_data = $this->_changeset_data; $this->_changeset_data = $publishing_changeset_data; // Parse changeset data to identify theme mod settings and user IDs associated with settings to be saved. $setting_user_ids = array(); $theme_mod_settings = array(); $namespace_pattern = '/^(?P<stylesheet>.+?)::(?P<setting_id>.+)$/'; $matches = array(); foreach ( $this->_changeset_data as $raw_setting_id => $setting_params ) { $actual_setting_id = null; $is_theme_mod_setting = ( isset( $setting_params['value'] ) && isset( $setting_params['type'] ) && 'theme_mod' === $setting_params['type'] && preg_match( $namespace_pattern, $raw_setting_id, $matches ) ); if ( $is_theme_mod_setting ) { if ( ! isset( $theme_mod_settings[ $matches['stylesheet'] ] ) ) { $theme_mod_settings[ $matches['stylesheet'] ] = array(); } $theme_mod_settings[ $matches['stylesheet'] ][ $matches['setting_id'] ] = $setting_params; if ( $this->get_stylesheet() === $matches['stylesheet'] ) { $actual_setting_id = $matches['setting_id']; } } else { $actual_setting_id = $raw_setting_id; } // Keep track of the user IDs for settings actually for this theme. if ( $actual_setting_id && isset( $setting_params['user_id'] ) ) { $setting_user_ids[ $actual_setting_id ] = $setting_params['user_id']; } } $changeset_setting_values = $this->unsanitized_post_values( array( 'exclude_post_data' => true, 'exclude_changeset' => false, ) ); $changeset_setting_ids = array_keys( $changeset_setting_values ); $this->add_dynamic_settings( $changeset_setting_ids ); /** * Fires once the theme has switched in the Customizer, but before settings * have been saved. * * @since 3.4.0 * * @param WP_Customize_Manager $manager WP_Customize_Manager instance. */ do_action( 'customize_save', $this ); /* * Ensure that all settings will allow themselves to be saved. Note that * this is safe because the setting would have checked the capability * when the setting value was written into the changeset. So this is why * an additional capability check is not required here. */ $original_setting_capabilities = array(); foreach ( $changeset_setting_ids as $setting_id ) { $setting = $this->get_setting( $setting_id ); if ( $setting && ! isset( $setting_user_ids[ $setting_id ] ) ) { $original_setting_capabilities[ $setting->id ] = $setting->capability; $setting->capability = 'exist'; } } $original_user_id = get_current_user_id(); foreach ( $changeset_setting_ids as $setting_id ) { $setting = $this->get_setting( $setting_id ); if ( $setting ) { /* * Set the current user to match the user who saved the value into * the changeset so that any filters that apply during the save * process will respect the original user's capabilities. This * will ensure, for example, that KSES won't strip unsafe HTML * when a scheduled changeset publishes via WP Cron. */ if ( isset( $setting_user_ids[ $setting_id ] ) ) { wp_set_current_user( $setting_user_ids[ $setting_id ] ); } else { wp_set_current_user( $original_user_id ); } $setting->save(); } } wp_set_current_user( $original_user_id ); // Update the stashed theme mod settings, removing the active theme's stashed settings, if activated. if ( did_action( 'switch_theme' ) ) { $other_theme_mod_settings = $theme_mod_settings; unset( $other_theme_mod_settings[ $this->get_stylesheet() ] ); $this->update_stashed_theme_mod_settings( $other_theme_mod_settings ); } /** * Fires after Customize settings have been saved. * * @since 3.6.0 * * @param WP_Customize_Manager $manager WP_Customize_Manager instance. */ do_action( 'customize_save_after', $this ); // Restore original capabilities. foreach ( $original_setting_capabilities as $setting_id => $capability ) { $setting = $this->get_setting( $setting_id ); if ( $setting ) { $setting->capability = $capability; } } // Restore original changeset data. $this->_changeset_data = $previous_changeset_data; $this->_changeset_post_id = $previous_changeset_post_id; $this->_changeset_uuid = $previous_changeset_uuid; /* * Convert all autosave revisions into their own auto-drafts so that users can be prompted to * restore them when a changeset is published, but they had been locked out from including * their changes in the changeset. */ $revisions = wp_get_post_revisions( $changeset_post_id, array( 'check_enabled' => false ) ); foreach ( $revisions as $revision ) { if ( str_contains( $revision->post_name, "{$changeset_post_id}-autosave" ) ) { $wpdb->update( $wpdb->posts, array( 'post_status' => 'auto-draft', 'post_type' => 'customize_changeset', 'post_name' => wp_generate_uuid4(), 'post_parent' => 0, ), array( 'ID' => $revision->ID, ) ); clean_post_cache( $revision->ID ); } } return true; } /** * Updates stashed theme mod settings. * * @since 4.7.0 * * @param array $inactive_theme_mod_settings Mapping of stylesheet to arrays of theme mod settings. * @return array|false Returns array of updated stashed theme mods or false if the update failed or there were no changes. */ protected function update_stashed_theme_mod_settings( $inactive_theme_mod_settings ) { $stashed_theme_mod_settings = get_option( 'customize_stashed_theme_mods' ); if ( empty( $stashed_theme_mod_settings ) ) { $stashed_theme_mod_settings = array(); } // Delete any stashed theme mods for the active theme since they would have been loaded and saved upon activation. unset( $stashed_theme_mod_settings[ $this->get_stylesheet() ] ); // Merge inactive theme mods with the stashed theme mod settings. foreach ( $inactive_theme_mod_settings as $stylesheet => $theme_mod_settings ) { if ( ! isset( $stashed_theme_mod_settings[ $stylesheet ] ) ) { $stashed_theme_mod_settings[ $stylesheet ] = array(); } $stashed_theme_mod_settings[ $stylesheet ] = array_merge( $stashed_theme_mod_settings[ $stylesheet ], $theme_mod_settings ); } $autoload = false; $result = update_option( 'customize_stashed_theme_mods', $stashed_theme_mod_settings, $autoload ); if ( ! $result ) { return false; } return $stashed_theme_mod_settings; } /** * Refreshes nonces for the current preview. * * @since 4.2.0 */ public function refresh_nonces() { if ( ! $this->is_preview() ) { wp_send_json_error( 'not_preview' ); } wp_send_json_success( $this->get_nonces() ); } /** * Deletes a given auto-draft changeset or the autosave revision for a given changeset or delete changeset lock. * * @since 4.9.0 */ public function handle_dismiss_autosave_or_lock_request() { // Calls to dismiss_user_auto_draft_changesets() and wp_get_post_autosave() require non-zero get_current_user_id(). if ( ! is_user_logged_in() ) { wp_send_json_error( 'unauthenticated', 401 ); } if ( ! $this->is_preview() ) { wp_send_json_error( 'not_preview', 400 ); } if ( ! check_ajax_referer( 'customize_dismiss_autosave_or_lock', 'nonce', false ) ) { wp_send_json_error( 'invalid_nonce', 403 ); } $changeset_post_id = $this->changeset_post_id(); $dismiss_lock = ! empty( $_POST['dismiss_lock'] ); $dismiss_autosave = ! empty( $_POST['dismiss_autosave'] ); if ( $dismiss_lock ) { if ( empty( $changeset_post_id ) && ! $dismiss_autosave ) { wp_send_json_error( 'no_changeset_to_dismiss_lock', 404 ); } if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->edit_post, $changeset_post_id ) && ! $dismiss_autosave ) { wp_send_json_error( 'cannot_remove_changeset_lock', 403 ); } delete_post_meta( $changeset_post_id, '_edit_lock' ); if ( ! $dismiss_autosave ) { wp_send_json_success( 'changeset_lock_dismissed' ); } } if ( $dismiss_autosave ) { if ( empty( $changeset_post_id ) || 'auto-draft' === get_post_status( $changeset_post_id ) ) { $dismissed = $this->dismiss_user_auto_draft_changesets(); if ( $dismissed > 0 ) { wp_send_json_success( 'auto_draft_dismissed' ); } else { wp_send_json_error( 'no_auto_draft_to_delete', 404 ); } } else { $revision = wp_get_post_autosave( $changeset_post_id, get_current_user_id() ); if ( $revision ) { if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->delete_post, $changeset_post_id ) ) { wp_send_json_error( 'cannot_delete_autosave_revision', 403 ); } if ( ! wp_delete_post( $revision->ID, true ) ) { wp_send_json_error( 'autosave_revision_deletion_failure', 500 ); } else { wp_send_json_success( 'autosave_revision_deleted' ); } } else { wp_send_json_error( 'no_autosave_revision_to_delete', 404 ); } } } wp_send_json_error( 'unknown_error', 500 ); } /** * Adds a customize setting. * * @since 3.4.0 * @since 4.5.0 Return added WP_Customize_Setting instance. * * @see WP_Customize_Setting::__construct() * @link https://developer.wordpress.org/themes/customize-api * * @param WP_Customize_Setting|string $id Customize Setting object, or ID. * @param array $args Optional. Array of properties for the new Setting object. * See WP_Customize_Setting::__construct() for information * on accepted arguments. Default empty array. * @return WP_Customize_Setting The instance of the setting that was added. */ public function add_setting( $id, $args = array() ) { if ( $id instanceof WP_Customize_Setting ) { $setting = $id; } else { $class = 'WP_Customize_Setting'; /** This filter is documented in wp-includes/class-wp-customize-manager.php */ $args = apply_filters( 'customize_dynamic_setting_args', $args, $id ); /** This filter is documented in wp-includes/class-wp-customize-manager.php */ $class = apply_filters( 'customize_dynamic_setting_class', $class, $id, $args ); $setting = new $class( $this, $id, $args ); } $this->settings[ $setting->id ] = $setting; return $setting; } /** * Registers any dynamically-created settings, such as those from $_POST['customized'] * that have no corresponding setting created. * * This is a mechanism to "wake up" settings that have been dynamically created * on the front end and have been sent to WordPress in `$_POST['customized']`. When WP * loads, the dynamically-created settings then will get created and previewed * even though they are not directly created statically with code. * * @since 4.2.0 * * @param array $setting_ids The setting IDs to add. * @return array The WP_Customize_Setting objects added. */ public function add_dynamic_settings( $setting_ids ) { $new_settings = array(); foreach ( $setting_ids as $setting_id ) { // Skip settings already created. if ( $this->get_setting( $setting_id ) ) { continue; } $setting_args = false; $setting_class = 'WP_Customize_Setting'; /** * Filters a dynamic setting's constructor args. * * For a dynamic setting to be registered, this filter must be employed * to override the default false value with an array of args to pass to * the WP_Customize_Setting constructor. * * @since 4.2.0 * * @param false|array $setting_args The arguments to the WP_Customize_Setting constructor. * @param string $setting_id ID for dynamic setting, usually coming from `$_POST['customized']`. */ $setting_args = apply_filters( 'customize_dynamic_setting_args', $setting_args, $setting_id ); if ( false === $setting_args ) { continue; } /** * Allow non-statically created settings to be constructed with custom WP_Customize_Setting subclass. * * @since 4.2.0 * * @param string $setting_class WP_Customize_Setting or a subclass. * @param string $setting_id ID for dynamic setting, usually coming from `$_POST['customized']`. * @param array $setting_args WP_Customize_Setting or a subclass. */ $setting_class = apply_filters( 'customize_dynamic_setting_class', $setting_class, $setting_id, $setting_args ); $setting = new $setting_class( $this, $setting_id, $setting_args ); $this->add_setting( $setting ); $new_settings[] = $setting; } return $new_settings; } /** * Retrieves a customize setting. * * @since 3.4.0 * * @param string $id Customize Setting ID. * @return WP_Customize_Setting|void The setting, if set. */ public function get_setting( $id ) { if ( isset( $this->settings[ $id ] ) ) { return $this->settings[ $id ]; } } /** * Removes a customize setting. * * Note that removing the setting doesn't destroy the WP_Customize_Setting instance or remove its filters. * * @since 3.4.0 * * @param string $id Customize Setting ID. */ public function remove_setting( $id ) { unset( $this->settings[ $id ] ); } /** * Adds a customize panel. * * @since 4.0.0 * @since 4.5.0 Return added WP_Customize_Panel instance. * * @see WP_Customize_Panel::__construct() * * @param WP_Customize_Panel|string $id Customize Panel object, or ID. * @param array $args Optional. Array of properties for the new Panel object. * See WP_Customize_Panel::__construct() for information * on accepted arguments. Default empty array. * @return WP_Customize_Panel The instance of the panel that was added. */ public function add_panel( $id, $args = array() ) { if ( $id instanceof WP_Customize_Panel ) { $panel = $id; } else { $panel = new WP_Customize_Panel( $this, $id, $args ); } $this->panels[ $panel->id ] = $panel; return $panel; } /** * Retrieves a customize panel. * * @since 4.0.0 * * @param string $id Panel ID to get. * @return WP_Customize_Panel|void Requested panel instance, if set. */ public function get_panel( $id ) { if ( isset( $this->panels[ $id ] ) ) { return $this->panels[ $id ]; } } /** * Removes a customize panel. * * Note that removing the panel doesn't destroy the WP_Customize_Panel instance or remove its filters. * * @since 4.0.0 * * @param string $id Panel ID to remove. */ public function remove_panel( $id ) { // Removing core components this way is _doing_it_wrong(). if ( in_array( $id, $this->components, true ) ) { _doing_it_wrong( __METHOD__, sprintf( /* translators: 1: Panel ID, 2: Link to 'customize_loaded_components' filter reference. */ __( 'Removing %1$s manually will cause PHP warnings. Use the %2$s filter instead.' ), $id, sprintf( '<a href="%1$s">%2$s</a>', esc_url( 'https://developer.wordpress.org/reference/hooks/customize_loaded_components/' ), '<code>customize_loaded_components</code>' ) ), '4.5.0' ); } unset( $this->panels[ $id ] ); } /** * Registers a customize panel type. * * Registered types are eligible to be rendered via JS and created dynamically. * * @since 4.3.0 * * @see WP_Customize_Panel * * @param string $panel Name of a custom panel which is a subclass of WP_Customize_Panel. */ public function register_panel_type( $panel ) { $this->registered_panel_types[] = $panel; } /** * Renders JS templates for all registered panel types. * * @since 4.3.0 */ public function render_panel_templates() { foreach ( $this->registered_panel_types as $panel_type ) { $panel = new $panel_type( $this, 'temp', array() ); $panel->print_template(); } } /** * Adds a customize section. * * @since 3.4.0 * @since 4.5.0 Return added WP_Customize_Section instance. * * @see WP_Customize_Section::__construct() * * @param WP_Customize_Section|string $id Customize Section object, or ID. * @param array $args Optional. Array of properties for the new Section object. * See WP_Customize_Section::__construct() for information * on accepted arguments. Default empty array. * @return WP_Customize_Section The instance of the section that was added. */ public function add_section( $id, $args = array() ) { if ( $id instanceof WP_Customize_Section ) { $section = $id; } else { $section = new WP_Customize_Section( $this, $id, $args ); } $this->sections[ $section->id ] = $section; return $section; } /** * Retrieves a customize section. * * @since 3.4.0 * * @param string $id Section ID. * @return WP_Customize_Section|void The section, if set. */ public function get_section( $id ) { if ( isset( $this->sections[ $id ] ) ) { return $this->sections[ $id ]; } } /** * Removes a customize section. * * Note that removing the section doesn't destroy the WP_Customize_Section instance or remove its filters. * * @since 3.4.0 * * @param string $id Section ID. */ public function remove_section( $id ) { unset( $this->sections[ $id ] ); } /** * Registers a customize section type. * * Registered types are eligible to be rendered via JS and created dynamically. * * @since 4.3.0 * * @see WP_Customize_Section * * @param string $section Name of a custom section which is a subclass of WP_Customize_Section. */ public function register_section_type( $section ) { $this->registered_section_types[] = $section; } /** * Renders JS templates for all registered section types. * * @since 4.3.0 */ public function render_section_templates() { foreach ( $this->registered_section_types as $section_type ) { $section = new $section_type( $this, 'temp', array() ); $section->print_template(); } } /** * Adds a customize control. * * @since 3.4.0 * @since 4.5.0 Return added WP_Customize_Control instance. * * @see WP_Customize_Control::__construct() * * @param WP_Customize_Control|string $id Customize Control object, or ID. * @param array $args Optional. Array of properties for the new Control object. * See WP_Customize_Control::__construct() for information * on accepted arguments. Default empty array. * @return WP_Customize_Control The instance of the control that was added. */ public function add_control( $id, $args = array() ) { if ( $id instanceof WP_Customize_Control ) { $control = $id; } else { $control = new WP_Customize_Control( $this, $id, $args ); } $this->controls[ $control->id ] = $control; return $control; } /** * Retrieves a customize control. * * @since 3.4.0 * * @param string $id ID of the control. * @return WP_Customize_Control|void The control object, if set. */ public function get_control( $id ) { if ( isset( $this->controls[ $id ] ) ) { return $this->controls[ $id ]; } } /** * Removes a customize control. * * Note that removing the control doesn't destroy the WP_Customize_Control instance or remove its filters. * * @since 3.4.0 * * @param string $id ID of the control. */ public function remove_control( $id ) { unset( $this->controls[ $id ] ); } /** * Registers a customize control type. * * Registered types are eligible to be rendered via JS and created dynamically. * * @since 4.1.0 * * @param string $control Name of a custom control which is a subclass of * WP_Customize_Control. */ public function register_control_type( $control ) { $this->registered_control_types[] = $control; } /** * Renders JS templates for all registered control types. * * @since 4.1.0 */ public function render_control_templates() { if ( $this->branching() ) { $l10n = array( /* translators: %s: User who is customizing the changeset in customizer. */ 'locked' => __( '%s is already customizing this changeset. Please wait until they are done to try customizing. Your latest changes have been autosaved.' ), /* translators: %s: User who is customizing the changeset in customizer. */ 'locked_allow_override' => __( '%s is already customizing this changeset. Do you want to take over?' ), ); } else { $l10n = array( /* translators: %s: User who is customizing the changeset in customizer. */ 'locked' => __( '%s is already customizing this site. Please wait until they are done to try customizing. Your latest changes have been autosaved.' ), /* translators: %s: User who is customizing the changeset in customizer. */ 'locked_allow_override' => __( '%s is already customizing this site. Do you want to take over?' ), ); } foreach ( $this->registered_control_types as $control_type ) { $control = new $control_type( $this, 'temp', array( 'settings' => array(), ) ); $control->print_template(); } ?> <script type="text/html" id="tmpl-customize-control-default-content"> <# var inputId = _.uniqueId( 'customize-control-default-input-' ); var descriptionId = _.uniqueId( 'customize-control-default-description-' ); var describedByAttr = data.description ? ' aria-describedby="' + descriptionId + '" ' : ''; #> <# switch ( data.type ) { case 'checkbox': #> <span class="customize-inside-control-row"> <input id="{{ inputId }}" {{{ describedByAttr }}} type="checkbox" value="{{ data.value }}" data-customize-setting-key-link="default" > <label for="{{ inputId }}"> {{ data.label }} </label> <# if ( data.description ) { #> <span id="{{ descriptionId }}" class="description customize-control-description">{{{ data.description }}}</span> <# } #> </span> <# break; case 'radio': if ( ! data.choices ) { return; } #> <# if ( data.label ) { #> <label for="{{ inputId }}" class="customize-control-title"> {{ data.label }} </label> <# } #> <# if ( data.description ) { #> <span id="{{ descriptionId }}" class="description customize-control-description">{{{ data.description }}}</span> <# } #> <# _.each( data.choices, function( val, key ) { #> <span class="customize-inside-control-row"> <# var value, text; if ( _.isObject( val ) ) { value = val.value; text = val.text; } else { value = key; text = val; } #> <input id="{{ inputId + '-' + value }}" type="radio" value="{{ value }}" name="{{ inputId }}" data-customize-setting-key-link="default" {{{ describedByAttr }}} > <label for="{{ inputId + '-' + value }}">{{ text }}</label> </span> <# } ); #> <# break; default: #> <# if ( data.label ) { #> <label for="{{ inputId }}" class="customize-control-title"> {{ data.label }} </label> <# } #> <# if ( data.description ) { #> <span id="{{ descriptionId }}" class="description customize-control-description">{{{ data.description }}}</span> <# } #> <# var inputAttrs = { id: inputId, 'data-customize-setting-key-link': 'default' }; if ( 'textarea' === data.type ) { inputAttrs.rows = '5'; } else if ( 'button' === data.type ) { inputAttrs['class'] = 'button button-secondary'; inputAttrs.type = 'button'; } else { inputAttrs.type = data.type; } if ( data.description ) { inputAttrs['aria-describedby'] = descriptionId; } _.extend( inputAttrs, data.input_attrs ); #> <# if ( 'button' === data.type ) { #> <button <# _.each( _.extend( inputAttrs ), function( value, key ) { #> {{{ key }}}="{{ value }}" <# } ); #> >{{ inputAttrs.value }}</button> <# } else if ( 'textarea' === data.type ) { #> <textarea <# _.each( _.extend( inputAttrs ), function( value, key ) { #> {{{ key }}}="{{ value }}" <# }); #> >{{ inputAttrs.value }}</textarea> <# } else if ( 'select' === data.type ) { #> <# delete inputAttrs.type; #> <select <# _.each( _.extend( inputAttrs ), function( value, key ) { #> {{{ key }}}="{{ value }}" <# }); #> > <# _.each( data.choices, function( val, key ) { #> <# var value, text; if ( _.isObject( val ) ) { value = val.value; text = val.text; } else { value = key; text = val; } #> <option value="{{ value }}">{{ text }}</option> <# } ); #> </select> <# } else { #> <input <# _.each( _.extend( inputAttrs ), function( value, key ) { #> {{{ key }}}="{{ value }}" <# }); #> > <# } #> <# } #> </script> <script type="text/html" id="tmpl-customize-notification"> <li class="notice notice-{{ data.type || 'info' }} {{ data.alt ? 'notice-alt' : '' }} {{ data.dismissible ? 'is-dismissible' : '' }} {{ data.containerClasses || '' }}" data-code="{{ data.code }}" data-type="{{ data.type }}"> <div class="notification-message">{{{ data.message || data.code }}}</div> <# if ( data.dismissible ) { #> <button type="button" class="notice-dismiss"><span class="screen-reader-text"> <?php /* translators: Hidden accessibility text. */ _e( 'Dismiss' ); ?> </span></button> <# } #> </li> </script> <script type="text/html" id="tmpl-customize-changeset-locked-notification"> <li class="notice notice-{{ data.type || 'info' }} {{ data.containerClasses || '' }}" data-code="{{ data.code }}" data-type="{{ data.type }}"> <div class="notification-message customize-changeset-locked-message {{ data.lockUser.avatar ? 'has-avatar' : '' }}"> <# if ( data.lockUser.avatar ) { #> <img class="customize-changeset-locked-avatar" src="{{ data.lockUser.avatar }}" alt="{{ data.lockUser.name }}" /> <# } #> <p class="currently-editing"> <# if ( data.message ) { #> {{{ data.message }}} <# } else if ( data.allowOverride ) { #> <?php echo esc_html( sprintf( $l10n['locked_allow_override'], '{{ data.lockUser.name }}' ) ); ?> <# } else { #> <?php echo esc_html( sprintf( $l10n['locked'], '{{ data.lockUser.name }}' ) ); ?> <# } #> </p> <p class="notice notice-error notice-alt" hidden></p> <p class="action-buttons"> <# if ( data.returnUrl !== data.previewUrl ) { #> <a class="button customize-notice-go-back-button" href="{{ data.returnUrl }}"><?php _e( 'Go back' ); ?></a> <# } #> <a class="button customize-notice-preview-button" href="{{ data.frontendPreviewUrl }}"><?php _e( 'Preview' ); ?></a> <# if ( data.allowOverride ) { #> <button class="button button-primary wp-tab-last customize-notice-take-over-button"><?php _e( 'Take over' ); ?></button> <# } #> </p> </div> </li> </script> <script type="text/html" id="tmpl-customize-code-editor-lint-error-notification"> <li class="notice notice-{{ data.type || 'info' }} {{ data.alt ? 'notice-alt' : '' }} {{ data.dismissible ? 'is-dismissible' : '' }} {{ data.containerClasses || '' }}" data-code="{{ data.code }}" data-type="{{ data.type }}"> <div class="notification-message">{{{ data.message || data.code }}}</div> <p> <# var elementId = 'el-' + String( Math.random() ); #> <input id="{{ elementId }}" type="checkbox"> <label for="{{ elementId }}"><?php _e( 'Update anyway, even though it might break your site?' ); ?></label> </p> </li> </script> <?php /* The following template is obsolete in core but retained for plugins. */ ?> <script type="text/html" id="tmpl-customize-control-notifications"> <ul> <# _.each( data.notifications, function( notification ) { #> <li class="notice notice-{{ notification.type || 'info' }} {{ data.altNotice ? 'notice-alt' : '' }}" data-code="{{ notification.code }}" data-type="{{ notification.type }}">{{{ notification.message || notification.code }}}</li> <# } ); #> </ul> </script> <script type="text/html" id="tmpl-customize-preview-link-control" > <# var elementPrefix = _.uniqueId( 'el' ) + '-' #> <p class="customize-control-title"> <?php esc_html_e( 'Share Preview Link' ); ?> </p> <p class="description customize-control-description"><?php esc_html_e( 'See how changes would look live on your website, and share the preview with people who can\'t access the Customizer.' ); ?></p> <div class="customize-control-notifications-container"></div> <div class="preview-link-wrapper"> <label for="{{ elementPrefix }}customize-preview-link-input" class="screen-reader-text"> <?php /* translators: Hidden accessibility text. */ esc_html_e( 'Preview Link' ); ?> </label> <a href="" target=""> <span class="preview-control-element" data-component="url"></span> <span class="screen-reader-text"> <?php /* translators: Hidden accessibility text. */ _e( '(opens in a new tab)' ); ?> </span> </a> <input id="{{ elementPrefix }}customize-preview-link-input" readonly tabindex="-1" class="preview-control-element" data-component="input"> <button class="customize-copy-preview-link preview-control-element button button-secondary" data-component="button" data-copy-text="<?php esc_attr_e( 'Copy' ); ?>" data-copied-text="<?php esc_attr_e( 'Copied' ); ?>" ><?php esc_html_e( 'Copy' ); ?></button> </div> </script> <script type="text/html" id="tmpl-customize-selected-changeset-status-control"> <# var inputId = _.uniqueId( 'customize-selected-changeset-status-control-input-' ); #> <# var descriptionId = _.uniqueId( 'customize-selected-changeset-status-control-description-' ); #> <# if ( data.label ) { #> <label for="{{ inputId }}" class="customize-control-title">{{ data.label }}</label> <# } #> <# if ( data.description ) { #> <span id="{{ descriptionId }}" class="description customize-control-description">{{{ data.description }}}</span> <# } #> <# _.each( data.choices, function( choice ) { #> <# var choiceId = inputId + '-' + choice.status; #> <span class="customize-inside-control-row"> <input id="{{ choiceId }}" type="radio" value="{{ choice.status }}" name="{{ inputId }}" data-customize-setting-key-link="default"> <label for="{{ choiceId }}">{{ choice.label }}</label> </span> <# } ); #> </script> <?php } /** * Helper function to compare two objects by priority, ensuring sort stability via instance_number. * * @since 3.4.0 * @deprecated 4.7.0 Use wp_list_sort() * * @param WP_Customize_Panel|WP_Customize_Section|WP_Customize_Control $a Object A. * @param WP_Customize_Panel|WP_Customize_Section|WP_Customize_Control $b Object B. * @return int */ protected function _cmp_priority( $a, $b ) { _deprecated_function( __METHOD__, '4.7.0', 'wp_list_sort' ); if ( $a->priority === $b->priority ) { return $a->instance_number - $b->instance_number; } else { return $a->priority - $b->priority; } } /** * Prepares panels, sections, and controls. * * For each, check if required related components exist, * whether the user has the necessary capabilities, * and sort by priority. * * @since 3.4.0 */ public function prepare_controls() { $controls = array(); $this->controls = wp_list_sort( $this->controls, array( 'priority' => 'ASC', 'instance_number' => 'ASC', ), 'ASC', true ); foreach ( $this->controls as $id => $control ) { if ( ! isset( $this->sections[ $control->section ] ) || ! $control->check_capabilities() ) { continue; } $this->sections[ $control->section ]->controls[] = $control; $controls[ $id ] = $control; } $this->controls = $controls; // Prepare sections. $this->sections = wp_list_sort( $this->sections, array( 'priority' => 'ASC', 'instance_number' => 'ASC', ), 'ASC', true ); $sections = array(); foreach ( $this->sections as $section ) { if ( ! $section->check_capabilities() ) { continue; } $section->controls = wp_list_sort( $section->controls, array( 'priority' => 'ASC', 'instance_number' => 'ASC', ) ); if ( ! $section->panel ) { // Top-level section. $sections[ $section->id ] = $section; } else { // This section belongs to a panel. if ( isset( $this->panels [ $section->panel ] ) ) { $this->panels[ $section->panel ]->sections[ $section->id ] = $section; } } } $this->sections = $sections; // Prepare panels. $this->panels = wp_list_sort( $this->panels, array( 'priority' => 'ASC', 'instance_number' => 'ASC', ), 'ASC', true ); $panels = array(); foreach ( $this->panels as $panel ) { if ( ! $panel->check_capabilities() ) { continue; } $panel->sections = wp_list_sort( $panel->sections, array( 'priority' => 'ASC', 'instance_number' => 'ASC', ), 'ASC', true ); $panels[ $panel->id ] = $panel; } $this->panels = $panels; // Sort panels and top-level sections together. $this->containers = array_merge( $this->panels, $this->sections ); $this->containers = wp_list_sort( $this->containers, array( 'priority' => 'ASC', 'instance_number' => 'ASC', ), 'ASC', true ); } /** * Enqueues scripts for customize controls. * * @since 3.4.0 */ public function enqueue_control_scripts() { foreach ( $this->controls as $control ) { $control->enqueue(); } if ( ! is_multisite() && ( current_user_can( 'install_themes' ) || current_user_can( 'update_themes' ) || current_user_can( 'delete_themes' ) ) ) { wp_enqueue_script( 'updates' ); wp_localize_script( 'updates', '_wpUpdatesItemCounts', array( 'totals' => wp_get_update_data(), ) ); } } /** * Determines whether the user agent is iOS. * * @since 4.4.0 * * @return bool Whether the user agent is iOS. */ public function is_ios() { return wp_is_mobile() && preg_match( '/iPad|iPod|iPhone/', $_SERVER['HTTP_USER_AGENT'] ); } /** * Gets the template string for the Customizer pane document title. * * @since 4.4.0 * * @return string The template string for the document title. */ public function get_document_title_template() { if ( $this->is_theme_active() ) { /* translators: %s: Document title from the preview. */ $document_title_tmpl = __( 'Customize: %s' ); } else { /* translators: %s: Document title from the preview. */ $document_title_tmpl = __( 'Live Preview: %s' ); } $document_title_tmpl = html_entity_decode( $document_title_tmpl, ENT_QUOTES, 'UTF-8' ); // Because exported to JS and assigned to document.title. return $document_title_tmpl; } /** * Sets the initial URL to be previewed. * * URL is validated. * * @since 4.4.0 * * @param string $preview_url URL to be previewed. */ public function set_preview_url( $preview_url ) { $preview_url = sanitize_url( $preview_url ); $this->preview_url = wp_validate_redirect( $preview_url, home_url( '/' ) ); } /** * Gets the initial URL to be previewed. * * @since 4.4.0 * * @return string URL being previewed. */ public function get_preview_url() { if ( empty( $this->preview_url ) ) { $preview_url = home_url( '/' ); } else { $preview_url = $this->preview_url; } return $preview_url; } /** * Determines whether the admin and the frontend are on different domains. * * @since 4.7.0 * * @return bool Whether cross-domain. */ public function is_cross_domain() { $admin_origin = wp_parse_url( admin_url() ); $home_origin = wp_parse_url( home_url() ); $cross_domain = ( strtolower( $admin_origin['host'] ) !== strtolower( $home_origin['host'] ) ); return $cross_domain; } /** * Gets URLs allowed to be previewed. * * If the front end and the admin are served from the same domain, load the * preview over ssl if the Customizer is being loaded over ssl. This avoids * insecure content warnings. This is not attempted if the admin and front end * are on different domains to avoid the case where the front end doesn't have * ssl certs. Domain mapping plugins can allow other urls in these conditions * using the customize_allowed_urls filter. * * @since 4.7.0 * * @return array Allowed URLs. */ public function get_allowed_urls() { $allowed_urls = array( home_url( '/' ) ); if ( is_ssl() && ! $this->is_cross_domain() ) { $allowed_urls[] = home_url( '/', 'https' ); } /** * Filters the list of URLs allowed to be clicked and followed in the Customizer preview. * * @since 3.4.0 * * @param string[] $allowed_urls An array of allowed URLs. */ $allowed_urls = array_unique( apply_filters( 'customize_allowed_urls', $allowed_urls ) ); return $allowed_urls; } /** * Gets messenger channel. * * @since 4.7.0 * * @return string Messenger channel. */ public function get_messenger_channel() { return $this->messenger_channel; } /** * Sets URL to link the user to when closing the Customizer. * * URL is validated. * * @since 4.4.0 * * @param string $return_url URL for return link. */ public function set_return_url( $return_url ) { $return_url = sanitize_url( $return_url ); $return_url = remove_query_arg( wp_removable_query_args(), $return_url ); $return_url = wp_validate_redirect( $return_url ); $this->return_url = $return_url; } /** * Gets URL to link the user to when closing the Customizer. * * @since 4.4.0 * * @global array $_registered_pages * * @return string URL for link to close Customizer. */ public function get_return_url() { global $_registered_pages; $referer = wp_get_referer(); $excluded_referer_basenames = array( 'customize.php', 'wp-login.php' ); if ( $this->return_url ) { $return_url = $this->return_url; $return_url_basename = wp_basename( parse_url( $this->return_url, PHP_URL_PATH ) ); $return_url_query = parse_url( $this->return_url, PHP_URL_QUERY ); if ( 'themes.php' === $return_url_basename && $return_url_query ) { parse_str( $return_url_query, $query_vars ); /* * If the return URL is a page added by a theme to the Appearance menu via add_submenu_page(), * verify that it belongs to the active theme, otherwise fall back to the Themes screen. */ if ( isset( $query_vars['page'] ) && ! isset( $_registered_pages[ "appearance_page_{$query_vars['page']}" ] ) ) { $return_url = admin_url( 'themes.php' ); } } } elseif ( $referer && ! in_array( wp_basename( parse_url( $referer, PHP_URL_PATH ) ), $excluded_referer_basenames, true ) ) { $return_url = $referer; } elseif ( $this->preview_url ) { $return_url = $this->preview_url; } else { $return_url = home_url( '/' ); } return $return_url; } /** * Sets the autofocused constructs. * * @since 4.4.0 * * @param array $autofocus { * Mapping of 'panel', 'section', 'control' to the ID which should be autofocused. * * @type string $control ID for control to be autofocused. * @type string $section ID for section to be autofocused. * @type string $panel ID for panel to be autofocused. * } */ public function set_autofocus( $autofocus ) { $this->autofocus = array_filter( wp_array_slice_assoc( $autofocus, array( 'panel', 'section', 'control' ) ), 'is_string' ); } /** * Gets the autofocused constructs. * * @since 4.4.0 * * @return string[] { * Mapping of 'panel', 'section', 'control' to the ID which should be autofocused. * * @type string $control ID for control to be autofocused. * @type string $section ID for section to be autofocused. * @type string $panel ID for panel to be autofocused. * } */ public function get_autofocus() { return $this->autofocus; } /** * Gets nonces for the Customizer. * * @since 4.5.0 * * @return array Nonces. */ public function get_nonces() { $nonces = array( 'save' => wp_create_nonce( 'save-customize_' . $this->get_stylesheet() ), 'preview' => wp_create_nonce( 'preview-customize_' . $this->get_stylesheet() ), 'switch_themes' => wp_create_nonce( 'switch_themes' ), 'dismiss_autosave_or_lock' => wp_create_nonce( 'customize_dismiss_autosave_or_lock' ), 'override_lock' => wp_create_nonce( 'customize_override_changeset_lock' ), 'trash' => wp_create_nonce( 'trash_customize_changeset' ), ); /** * Filters nonces for Customizer. * * @since 4.2.0 * * @param string[] $nonces Array of refreshed nonces for save and * preview actions. * @param WP_Customize_Manager $manager WP_Customize_Manager instance. */ $nonces = apply_filters( 'customize_refresh_nonces', $nonces, $this ); return $nonces; } /** * Prints JavaScript settings for parent window. * * @since 4.4.0 */ public function customize_pane_settings() { $login_url = add_query_arg( array( 'interim-login' => 1, 'customize-login' => 1, ), wp_login_url() ); // Ensure dirty flags are set for modified settings. foreach ( array_keys( $this->unsanitized_post_values() ) as $setting_id ) { $setting = $this->get_setting( $setting_id ); if ( $setting ) { $setting->dirty = true; } } $autosave_revision_post = null; $autosave_autodraft_post = null; $changeset_post_id = $this->changeset_post_id(); if ( ! $this->saved_starter_content_changeset && ! $this->autosaved() ) { if ( $changeset_post_id ) { if ( is_user_logged_in() ) { $autosave_revision_post = wp_get_post_autosave( $changeset_post_id, get_current_user_id() ); } } else { $autosave_autodraft_posts = $this->get_changeset_posts( array( 'posts_per_page' => 1, 'post_status' => 'auto-draft', 'exclude_restore_dismissed' => true, ) ); if ( ! empty( $autosave_autodraft_posts ) ) { $autosave_autodraft_post = array_shift( $autosave_autodraft_posts ); } } } $current_user_can_publish = current_user_can( get_post_type_object( 'customize_changeset' )->cap->publish_posts ); // @todo Include all of the status labels here from script-loader.php, and then allow it to be filtered. $status_choices = array(); if ( $current_user_can_publish ) { $status_choices[] = array( 'status' => 'publish', 'label' => __( 'Publish' ), ); } $status_choices[] = array( 'status' => 'draft', 'label' => __( 'Save Draft' ), ); if ( $current_user_can_publish ) { $status_choices[] = array( 'status' => 'future', 'label' => _x( 'Schedule', 'customizer changeset action/button label' ), ); } // Prepare Customizer settings to pass to JavaScript. $changeset_post = null; if ( $changeset_post_id ) { $changeset_post = get_post( $changeset_post_id ); } // Determine initial date to be at present or future, not past. $current_time = current_time( 'mysql', false ); $initial_date = $current_time; if ( $changeset_post ) { $initial_date = get_the_time( 'Y-m-d H:i:s', $changeset_post->ID ); if ( $initial_date < $current_time ) { $initial_date = $current_time; } } $lock_user_id = false; if ( $this->changeset_post_id() ) { $lock_user_id = wp_check_post_lock( $this->changeset_post_id() ); } $settings = array( 'changeset' => array( 'uuid' => $this->changeset_uuid(), 'branching' => $this->branching(), 'autosaved' => $this->autosaved(), 'hasAutosaveRevision' => ! empty( $autosave_revision_post ), 'latestAutoDraftUuid' => $autosave_autodraft_post ? $autosave_autodraft_post->post_name : null, 'status' => $changeset_post ? $changeset_post->post_status : '', 'currentUserCanPublish' => $current_user_can_publish, 'publishDate' => $initial_date, 'statusChoices' => $status_choices, 'lockUser' => $lock_user_id ? $this->get_lock_user_data( $lock_user_id ) : null, ), 'initialServerDate' => $current_time, 'dateFormat' => get_option( 'date_format' ), 'timeFormat' => get_option( 'time_format' ), 'initialServerTimestamp' => floor( microtime( true ) * 1000 ), 'initialClientTimestamp' => -1, // To be set with JS below. 'timeouts' => array( 'windowRefresh' => 250, 'changesetAutoSave' => AUTOSAVE_INTERVAL * 1000, 'keepAliveCheck' => 2500, 'reflowPaneContents' => 100, 'previewFrameSensitivity' => 2000, ), 'theme' => array( 'stylesheet' => $this->get_stylesheet(), 'active' => $this->is_theme_active(), '_canInstall' => current_user_can( 'install_themes' ), ), 'url' => array( 'preview' => sanitize_url( $this->get_preview_url() ), 'return' => sanitize_url( $this->get_return_url() ), 'parent' => sanitize_url( admin_url() ), 'activated' => sanitize_url( home_url( '/' ) ), 'ajax' => sanitize_url( admin_url( 'admin-ajax.php', 'relative' ) ), 'allowed' => array_map( 'sanitize_url', $this->get_allowed_urls() ), 'isCrossDomain' => $this->is_cross_domain(), 'home' => sanitize_url( home_url( '/' ) ), 'login' => sanitize_url( $login_url ), ), 'browser' => array( 'mobile' => wp_is_mobile(), 'ios' => $this->is_ios(), ), 'panels' => array(), 'sections' => array(), 'nonce' => $this->get_nonces(), 'autofocus' => $this->get_autofocus(), 'documentTitleTmpl' => $this->get_document_title_template(), 'previewableDevices' => $this->get_previewable_devices(), 'l10n' => array( 'confirmDeleteTheme' => __( 'Are you sure you want to delete this theme?' ), /* translators: %d: Number of theme search results, which cannot currently consider singular vs. plural forms. */ 'themeSearchResults' => __( '%d themes found' ), /* translators: %d: Number of themes being displayed, which cannot currently consider singular vs. plural forms. */ 'announceThemeCount' => __( 'Displaying %d themes' ), /* translators: %s: Theme name. */ 'announceThemeDetails' => __( 'Showing details for theme: %s' ), ), ); // Temporarily disable installation in Customizer. See #42184. $filesystem_method = get_filesystem_method(); ob_start(); $filesystem_credentials_are_stored = request_filesystem_credentials( self_admin_url() ); ob_end_clean(); if ( 'direct' !== $filesystem_method && ! $filesystem_credentials_are_stored ) { $settings['theme']['_filesystemCredentialsNeeded'] = true; } // Prepare Customize Section objects to pass to JavaScript. foreach ( $this->sections() as $id => $section ) { if ( $section->check_capabilities() ) { $settings['sections'][ $id ] = $section->json(); } } // Prepare Customize Panel objects to pass to JavaScript. foreach ( $this->panels() as $panel_id => $panel ) { if ( $panel->check_capabilities() ) { $settings['panels'][ $panel_id ] = $panel->json(); foreach ( $panel->sections as $section_id => $section ) { if ( $section->check_capabilities() ) { $settings['sections'][ $section_id ] = $section->json(); } } } } ob_start(); ?> <script> var _wpCustomizeSettings = <?php echo wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>; _wpCustomizeSettings.initialClientTimestamp = _.now(); _wpCustomizeSettings.controls = {}; _wpCustomizeSettings.settings = {}; <?php // Serialize settings one by one to improve memory usage. echo "(function ( s ){\n"; foreach ( $this->settings() as $setting ) { if ( $setting->check_capabilities() ) { printf( "s[%s] = %s;\n", wp_json_encode( $setting->id, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ), wp_json_encode( $setting->json(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ); } } echo "})( _wpCustomizeSettings.settings );\n"; // Serialize controls one by one to improve memory usage. echo "(function ( c ){\n"; foreach ( $this->controls() as $control ) { if ( $control->check_capabilities() ) { printf( "c[%s] = %s;\n", wp_json_encode( $control->id, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ), wp_json_encode( $control->json(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ); } } echo "})( _wpCustomizeSettings.controls );\n"; ?> </script> <?php wp_print_inline_script_tag( wp_remove_surrounding_empty_script_tags( ob_get_clean() ) . "\n//# sourceURL=" . rawurlencode( __METHOD__ ) ); } /** * Returns a list of devices to allow previewing. * * @since 4.5.0 * * @return array List of devices with labels and default setting. */ public function get_previewable_devices() { $devices = array( 'desktop' => array( 'label' => __( 'Enter desktop preview mode' ), 'default' => true, ), 'tablet' => array( 'label' => __( 'Enter tablet preview mode' ), ), 'mobile' => array( 'label' => __( 'Enter mobile preview mode' ), ), ); /** * Filters the available devices to allow previewing in the Customizer. * * @since 4.5.0 * * @see WP_Customize_Manager::get_previewable_devices() * * @param array $devices List of devices with labels and default setting. */ $devices = apply_filters( 'customize_previewable_devices', $devices ); return $devices; } /** * Registers some default controls. * * @since 3.4.0 */ public function register_controls() { /* Themes (controls are loaded via ajax) */ $this->add_panel( new WP_Customize_Themes_Panel( $this, 'themes', array( 'title' => $this->theme()->display( 'Name' ), 'description' => ( '<p>' . __( 'Looking for a theme? You can search or browse the WordPress.org theme directory, install and preview themes, then activate them right here.' ) . '</p>' . '<p>' . __( 'While previewing a new theme, you can continue to tailor things like widgets and menus, and explore theme-specific options.' ) . '</p>' ), 'capability' => 'switch_themes', 'priority' => 0, ) ) ); $this->add_section( new WP_Customize_Themes_Section( $this, 'installed_themes', array( 'title' => __( 'Installed themes' ), 'action' => 'installed', 'capability' => 'switch_themes', 'panel' => 'themes', 'priority' => 0, ) ) ); if ( ! is_multisite() ) { $this->add_section( new WP_Customize_Themes_Section( $this, 'wporg_themes', array( 'title' => __( 'WordPress.org themes' ), 'action' => 'wporg', 'filter_type' => 'remote', 'capability' => 'install_themes', 'panel' => 'themes', 'priority' => 5, ) ) ); } // Themes Setting (unused - the theme is considerably more fundamental to the Customizer experience). $this->add_setting( new WP_Customize_Filter_Setting( $this, 'active_theme', array( 'capability' => 'switch_themes', ) ) ); /* Site Identity */ $this->add_section( 'title_tagline', array( 'title' => __( 'Site Identity' ), 'priority' => 20, ) ); $this->add_setting( 'blogname', array( 'default' => get_option( 'blogname' ), 'type' => 'option', 'capability' => 'manage_options', ) ); $this->add_control( 'blogname', array( 'label' => __( 'Site Title' ), 'section' => 'title_tagline', ) ); $this->add_setting( 'blogdescription', array( 'default' => get_option( 'blogdescription' ), 'type' => 'option', 'capability' => 'manage_options', ) ); $this->add_control( 'blogdescription', array( 'label' => __( 'Tagline' ), 'section' => 'title_tagline', ) ); // Add a setting to hide header text if the theme doesn't support custom headers. if ( ! current_theme_supports( 'custom-header', 'header-text' ) ) { $this->add_setting( 'header_text', array( 'theme_supports' => array( 'custom-logo', 'header-text' ), 'default' => 1, 'sanitize_callback' => 'absint', ) ); $this->add_control( 'header_text', array( 'label' => __( 'Display Site Title and Tagline' ), 'section' => 'title_tagline', 'settings' => 'header_text', 'type' => 'checkbox', ) ); } $this->add_setting( 'site_icon', array( 'type' => 'option', 'capability' => 'manage_options', 'transport' => 'postMessage', // Previewed with JS in the Customizer controls window. ) ); $this->add_control( new WP_Customize_Site_Icon_Control( $this, 'site_icon', array( 'label' => __( 'Site Icon' ), 'description' => sprintf( /* translators: 1: pixel value for icon size. 2: pixel value for icon size. */ '<p>' . __( 'The Site Icon is what you see in browser tabs, bookmark bars, and within the WordPress mobile apps. It should be square and at least <code>%1$s by %2$s</code> pixels.' ) . '</p>', 512, 512 ), 'section' => 'title_tagline', 'priority' => 60, 'height' => 512, 'width' => 512, ) ) ); $this->add_setting( 'custom_logo', array( 'theme_supports' => array( 'custom-logo' ), 'transport' => 'postMessage', ) ); $custom_logo_args = get_theme_support( 'custom-logo' ); $this->add_control( new WP_Customize_Cropped_Image_Control( $this, 'custom_logo', array( 'label' => __( 'Logo' ), 'section' => 'title_tagline', 'priority' => 8, 'height' => isset( $custom_logo_args[0]['height'] ) ? $custom_logo_args[0]['height'] : null, 'width' => isset( $custom_logo_args[0]['width'] ) ? $custom_logo_args[0]['width'] : null, 'flex_height' => isset( $custom_logo_args[0]['flex-height'] ) ? $custom_logo_args[0]['flex-height'] : null, 'flex_width' => isset( $custom_logo_args[0]['flex-width'] ) ? $custom_logo_args[0]['flex-width'] : null, 'button_labels' => array( 'select' => __( 'Select logo' ), 'change' => __( 'Change logo' ), 'remove' => __( 'Remove' ), 'default' => __( 'Default' ), 'placeholder' => __( 'No logo selected' ), 'frame_title' => __( 'Select logo' ), 'frame_button' => __( 'Choose logo' ), ), ) ) ); $this->selective_refresh->add_partial( 'custom_logo', array( 'settings' => array( 'custom_logo' ), 'selector' => '.custom-logo-link', 'render_callback' => array( $this, '_render_custom_logo_partial' ), 'container_inclusive' => true, ) ); /* Colors */ $this->add_section( 'colors', array( 'title' => __( 'Colors' ), 'priority' => 40, ) ); $this->add_setting( 'header_textcolor', array( 'theme_supports' => array( 'custom-header', 'header-text' ), 'default' => get_theme_support( 'custom-header', 'default-text-color' ), 'sanitize_callback' => array( $this, '_sanitize_header_textcolor' ), 'sanitize_js_callback' => 'maybe_hash_hex_color', ) ); // Input type: checkbox, with custom value. $this->add_control( 'display_header_text', array( 'settings' => 'header_textcolor', 'label' => __( 'Display Site Title and Tagline' ), 'section' => 'title_tagline', 'type' => 'checkbox', 'priority' => 40, ) ); $this->add_control( new WP_Customize_Color_Control( $this, 'header_textcolor', array( 'label' => __( 'Header Text Color' ), 'section' => 'colors', ) ) ); // Input type: color, with sanitize_callback. $this->add_setting( 'background_color', array( 'default' => get_theme_support( 'custom-background', 'default-color' ), 'theme_supports' => 'custom-background', 'sanitize_callback' => 'sanitize_hex_color_no_hash', 'sanitize_js_callback' => 'maybe_hash_hex_color', ) ); $this->add_control( new WP_Customize_Color_Control( $this, 'background_color', array( 'label' => __( 'Background Color' ), 'section' => 'colors', ) ) ); /* Custom Header */ if ( current_theme_supports( 'custom-header', 'video' ) ) { $title = __( 'Header Media' ); $description = '<p>' . __( 'If you add a video, the image will be used as a fallback while the video loads.' ) . '</p>'; $width = absint( get_theme_support( 'custom-header', 'width' ) ); $height = absint( get_theme_support( 'custom-header', 'height' ) ); if ( $width && $height ) { $control_description = sprintf( /* translators: 1: .mp4, 2: Header size in pixels. */ __( 'Upload your video in %1$s format and minimize its file size for best results. Your theme recommends dimensions of %2$s pixels.' ), '<code>.mp4</code>', sprintf( '<strong>%s × %s</strong>', $width, $height ) ); } elseif ( $width ) { $control_description = sprintf( /* translators: 1: .mp4, 2: Header width in pixels. */ __( 'Upload your video in %1$s format and minimize its file size for best results. Your theme recommends a width of %2$s pixels.' ), '<code>.mp4</code>', sprintf( '<strong>%s</strong>', $width ) ); } else { $control_description = sprintf( /* translators: 1: .mp4, 2: Header height in pixels. */ __( 'Upload your video in %1$s format and minimize its file size for best results. Your theme recommends a height of %2$s pixels.' ), '<code>.mp4</code>', sprintf( '<strong>%s</strong>', $height ) ); } } else { $title = __( 'Header Image' ); $description = ''; $control_description = ''; } $this->add_section( 'header_image', array( 'title' => $title, 'description' => $description, 'theme_supports' => 'custom-header', 'priority' => 60, ) ); $this->add_setting( 'header_video', array( 'theme_supports' => array( 'custom-header', 'video' ), 'transport' => 'postMessage', 'sanitize_callback' => 'absint', 'validate_callback' => array( $this, '_validate_header_video' ), ) ); $this->add_setting( 'external_header_video', array( 'theme_supports' => array( 'custom-header', 'video' ), 'transport' => 'postMessage', 'sanitize_callback' => array( $this, '_sanitize_external_header_video' ), 'validate_callback' => array( $this, '_validate_external_header_video' ), ) ); $this->add_setting( new WP_Customize_Filter_Setting( $this, 'header_image', array( 'default' => sprintf( get_theme_support( 'custom-header', 'default-image' ), get_template_directory_uri(), get_stylesheet_directory_uri() ), 'theme_supports' => 'custom-header', ) ) ); $this->add_setting( new WP_Customize_Header_Image_Setting( $this, 'header_image_data', array( 'theme_supports' => 'custom-header', ) ) ); /* * Switch image settings to postMessage when video support is enabled since * it entails that the_custom_header_markup() will be used, and thus selective * refresh can be utilized. */ if ( current_theme_supports( 'custom-header', 'video' ) ) { $this->get_setting( 'header_image' )->transport = 'postMessage'; $this->get_setting( 'header_image_data' )->transport = 'postMessage'; } $this->add_control( new WP_Customize_Media_Control( $this, 'header_video', array( 'theme_supports' => array( 'custom-header', 'video' ), 'label' => __( 'Header Video' ), 'description' => $control_description, 'section' => 'header_image', 'mime_type' => 'video', 'active_callback' => 'is_header_video_active', ) ) ); $this->add_control( 'external_header_video', array( 'theme_supports' => array( 'custom-header', 'video' ), 'type' => 'url', 'description' => __( 'Or, enter a YouTube URL:' ), 'section' => 'header_image', 'active_callback' => 'is_header_video_active', ) ); $this->add_control( new WP_Customize_Header_Image_Control( $this ) ); $this->selective_refresh->add_partial( 'custom_header', array( 'selector' => '#wp-custom-header', 'render_callback' => 'the_custom_header_markup', 'settings' => array( 'header_video', 'external_header_video', 'header_image' ), // The image is used as a video fallback here. 'container_inclusive' => true, ) ); /* Custom Background */ $this->add_section( 'background_image', array( 'title' => __( 'Background Image' ), 'theme_supports' => 'custom-background', 'priority' => 80, ) ); $this->add_setting( 'background_image', array( 'default' => get_theme_support( 'custom-background', 'default-image' ), 'theme_supports' => 'custom-background', 'sanitize_callback' => array( $this, '_sanitize_background_setting' ), ) ); $this->add_setting( new WP_Customize_Background_Image_Setting( $this, 'background_image_thumb', array( 'theme_supports' => 'custom-background', 'sanitize_callback' => array( $this, '_sanitize_background_setting' ), ) ) ); $this->add_control( new WP_Customize_Background_Image_Control( $this ) ); $this->add_setting( 'background_preset', array( 'default' => get_theme_support( 'custom-background', 'default-preset' ), 'theme_supports' => 'custom-background', 'sanitize_callback' => array( $this, '_sanitize_background_setting' ), ) ); $this->add_control( 'background_preset', array( 'label' => _x( 'Preset', 'Background Preset' ), 'section' => 'background_image', 'type' => 'select', 'choices' => array( 'default' => _x( 'Default', 'Default Preset' ), 'fill' => __( 'Fill Screen' ), 'fit' => __( 'Fit to Screen' ), 'repeat' => _x( 'Repeat', 'Repeat Image' ), 'custom' => _x( 'Custom', 'Custom Preset' ), ), ) ); $this->add_setting( 'background_position_x', array( 'default' => get_theme_support( 'custom-background', 'default-position-x' ), 'theme_supports' => 'custom-background', 'sanitize_callback' => array( $this, '_sanitize_background_setting' ), ) ); $this->add_setting( 'background_position_y', array( 'default' => get_theme_support( 'custom-background', 'default-position-y' ), 'theme_supports' => 'custom-background', 'sanitize_callback' => array( $this, '_sanitize_background_setting' ), ) ); $this->add_control( new WP_Customize_Background_Position_Control( $this, 'background_position', array( 'label' => __( 'Image Position' ), 'section' => 'background_image', 'settings' => array( 'x' => 'background_position_x', 'y' => 'background_position_y', ), ) ) ); $this->add_setting( 'background_size', array( 'default' => get_theme_support( 'custom-background', 'default-size' ), 'theme_supports' => 'custom-background', 'sanitize_callback' => array( $this, '_sanitize_background_setting' ), ) ); $this->add_control( 'background_size', array( 'label' => __( 'Image Size' ), 'section' => 'background_image', 'type' => 'select', 'choices' => array( 'auto' => _x( 'Original', 'Original Size' ), 'contain' => __( 'Fit to Screen' ), 'cover' => __( 'Fill Screen' ), ), ) ); $this->add_setting( 'background_repeat', array( 'default' => get_theme_support( 'custom-background', 'default-repeat' ), 'sanitize_callback' => array( $this, '_sanitize_background_setting' ), 'theme_supports' => 'custom-background', ) ); $this->add_control( 'background_repeat', array( 'label' => __( 'Repeat Background Image' ), 'section' => 'background_image', 'type' => 'checkbox', ) ); $this->add_setting( 'background_attachment', array( 'default' => get_theme_support( 'custom-background', 'default-attachment' ), 'sanitize_callback' => array( $this, '_sanitize_background_setting' ), 'theme_supports' => 'custom-background', ) ); $this->add_control( 'background_attachment', array( 'label' => __( 'Scroll with Page' ), 'section' => 'background_image', 'type' => 'checkbox', ) ); /* * If the theme is using the default background callback, we can update * the background CSS using postMessage. */ if ( get_theme_support( 'custom-background', 'wp-head-callback' ) === '_custom_background_cb' ) { foreach ( array( 'color', 'image', 'preset', 'position_x', 'position_y', 'size', 'repeat', 'attachment' ) as $prop ) { $this->get_setting( 'background_' . $prop )->transport = 'postMessage'; } } /* * Static Front Page * See also https://core.trac.wordpress.org/ticket/19627 which introduces the static-front-page theme_support. * The following replicates behavior from options-reading.php. */ $this->add_section( 'static_front_page', array( 'title' => __( 'Homepage Settings' ), 'priority' => 120, 'description' => __( 'You can choose what’s displayed on the homepage of your site. It can be posts in reverse chronological order (classic blog), or a fixed/static page. To set a static homepage, you first need to create two Pages. One will become the homepage, and the other will be where your posts are displayed.' ), 'active_callback' => array( $this, 'has_published_pages' ), ) ); $this->add_setting( 'show_on_front', array( 'default' => get_option( 'show_on_front' ), 'capability' => 'manage_options', 'type' => 'option', ) ); $this->add_control( 'show_on_front', array( 'label' => __( 'Your homepage displays' ), 'section' => 'static_front_page', 'type' => 'radio', 'choices' => array( 'posts' => __( 'Your latest posts' ), 'page' => __( 'A static page' ), ), ) ); $this->add_setting( 'page_on_front', array( 'type' => 'option', 'capability' => 'manage_options', ) ); $this->add_control( 'page_on_front', array( 'label' => __( 'Homepage' ), 'section' => 'static_front_page', 'type' => 'dropdown-pages', 'allow_addition' => true, ) ); $this->add_setting( 'page_for_posts', array( 'type' => 'option', 'capability' => 'manage_options', ) ); $this->add_control( 'page_for_posts', array( 'label' => __( 'Posts page' ), 'section' => 'static_front_page', 'type' => 'dropdown-pages', 'allow_addition' => true, ) ); /* Custom CSS */ $section_description = '<p>'; $section_description .= __( 'Add your own CSS code here to customize the appearance and layout of your site.' ); $section_description .= sprintf( ' <a href="%1$s" class="external-link" target="_blank">%2$s<span class="screen-reader-text"> %3$s</span></a>', esc_url( __( 'https://developer.wordpress.org/advanced-administration/wordpress/css/' ) ), __( 'Learn more about CSS' ), /* translators: Hidden accessibility text. */ __( '(opens in a new tab)' ) ); $section_description .= '</p>'; $section_description .= '<p id="editor-keyboard-trap-help-1">' . __( 'When using a keyboard to navigate:' ) . '</p>'; $section_description .= '<ul>'; $section_description .= '<li id="editor-keyboard-trap-help-2">' . __( 'In the editing area, the Tab key enters a tab character.' ) . '</li>'; $section_description .= '<li id="editor-keyboard-trap-help-3">' . __( 'To move away from this area, press the Esc key followed by the Tab key.' ) . '</li>'; $section_description .= '<li id="editor-keyboard-trap-help-4">' . __( 'Screen reader users: when in forms mode, you may need to press the Esc key twice.' ) . '</li>'; $section_description .= '</ul>'; if ( 'false' !== wp_get_current_user()->syntax_highlighting ) { $section_description .= '<p>'; $section_description .= sprintf( /* translators: 1: Link to user profile, 2: Additional link attributes, 3: Accessibility text. */ __( 'The edit field automatically highlights code syntax. You can disable this in your <a href="%1$s" %2$s>user profile%3$s</a> to work in plain text mode.' ), esc_url( get_edit_profile_url() ), 'class="external-link" target="_blank"', sprintf( '<span class="screen-reader-text"> %s</span>', /* translators: Hidden accessibility text. */ __( '(opens in a new tab)' ) ) ); $section_description .= '</p>'; } $section_description .= '<p class="section-description-buttons">'; $section_description .= '<button type="button" class="button-link section-description-close">' . __( 'Close' ) . '</button>'; $section_description .= '</p>'; $this->add_section( 'custom_css', array( 'title' => __( 'Additional CSS' ), 'priority' => 200, 'description_hidden' => true, 'description' => $section_description, ) ); $custom_css_setting = new WP_Customize_Custom_CSS_Setting( $this, sprintf( 'custom_css[%s]', get_stylesheet() ), array( 'capability' => 'edit_css', 'default' => '', ) ); $this->add_setting( $custom_css_setting ); $this->add_control( new WP_Customize_Code_Editor_Control( $this, 'custom_css', array( 'label' => __( 'CSS code' ), 'section' => 'custom_css', 'settings' => array( 'default' => $custom_css_setting->id ), 'code_type' => 'text/css', 'input_attrs' => array( 'aria-describedby' => 'editor-keyboard-trap-help-1 editor-keyboard-trap-help-2 editor-keyboard-trap-help-3 editor-keyboard-trap-help-4', ), ) ) ); } /** * Returns whether there are published pages. * * Used as active callback for static front page section and controls. * * @since 4.7.0 * * @return bool Whether there are published (or to be published) pages. */ public function has_published_pages() { $setting = $this->get_setting( 'nav_menus_created_posts' ); if ( $setting ) { foreach ( $setting->value() as $post_id ) { if ( 'page' === get_post_type( $post_id ) ) { return true; } } } return 0 !== count( get_pages( array( 'number' => 1, 'hierarchical' => 0, ) ) ); } /** * Adds settings from the POST data that were not added with code, e.g. dynamically-created settings for Widgets * * @since 4.2.0 * * @see add_dynamic_settings() */ public function register_dynamic_settings() { $setting_ids = array_keys( $this->unsanitized_post_values() ); $this->add_dynamic_settings( $setting_ids ); } /** * Loads themes into the theme browsing/installation UI. * * @since 4.9.0 */ public function handle_load_themes_request() { check_ajax_referer( 'switch_themes', 'nonce' ); if ( ! current_user_can( 'switch_themes' ) ) { wp_die( -1 ); } if ( empty( $_POST['theme_action'] ) ) { wp_send_json_error( 'missing_theme_action' ); } $theme_action = sanitize_key( $_POST['theme_action'] ); $themes = array(); $args = array(); // Define query filters based on user input. if ( ! array_key_exists( 'search', $_POST ) ) { $args['search'] = ''; } else { $args['search'] = sanitize_text_field( wp_unslash( $_POST['search'] ) ); } if ( ! array_key_exists( 'tags', $_POST ) ) { $args['tag'] = ''; } else { $args['tag'] = array_map( 'sanitize_text_field', wp_unslash( (array) $_POST['tags'] ) ); } if ( ! array_key_exists( 'page', $_POST ) ) { $args['page'] = 1; } else { $args['page'] = absint( $_POST['page'] ); } require_once ABSPATH . 'wp-admin/includes/theme.php'; if ( 'installed' === $theme_action ) { // Load all installed themes from wp_prepare_themes_for_js(). $themes = array( 'themes' => array() ); foreach ( wp_prepare_themes_for_js() as $theme ) { $theme['type'] = 'installed'; $theme['active'] = ( isset( $_POST['customized_theme'] ) && $_POST['customized_theme'] === $theme['id'] ); $themes['themes'][] = $theme; } } elseif ( 'wporg' === $theme_action ) { // Load WordPress.org themes from the .org API and normalize data to match installed theme objects. if ( ! current_user_can( 'install_themes' ) ) { wp_die( -1 ); } // Arguments for all queries. $wporg_args = array( 'per_page' => 100, 'fields' => array( 'reviews_url' => true, // Explicitly request the reviews URL to be linked from the customizer. ), ); $args = array_merge( $wporg_args, $args ); if ( '' === $args['search'] && '' === $args['tag'] ) { $args['browse'] = 'new'; // Sort by latest themes by default. } // Load themes from the .org API. $themes = themes_api( 'query_themes', $args ); if ( is_wp_error( $themes ) ) { wp_send_json_error(); } // This list matches the allowed tags in wp-admin/includes/theme-install.php. $themes_allowedtags = array_fill_keys( array( 'a', 'abbr', 'acronym', 'code', 'pre', 'em', 'strong', 'div', 'p', 'ul', 'ol', 'li', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'img' ), array() ); $themes_allowedtags['a'] = array_fill_keys( array( 'href', 'title', 'target' ), true ); $themes_allowedtags['acronym']['title'] = true; $themes_allowedtags['abbr']['title'] = true; $themes_allowedtags['img'] = array_fill_keys( array( 'src', 'class', 'alt' ), true ); // Prepare a list of installed themes to check against before the loop. $installed_themes = array(); $wp_themes = wp_get_themes(); foreach ( $wp_themes as $theme ) { $installed_themes[] = $theme->get_stylesheet(); } $update_php = network_admin_url( 'update.php?action=install-theme' ); // Set up properties for themes available on WordPress.org. foreach ( $themes->themes as &$theme ) { $theme->install_url = add_query_arg( array( 'theme' => $theme->slug, '_wpnonce' => wp_create_nonce( 'install-theme_' . $theme->slug ), ), $update_php ); $theme->name = wp_kses( $theme->name, $themes_allowedtags ); $theme->version = wp_kses( $theme->version, $themes_allowedtags ); $theme->description = wp_kses( $theme->description, $themes_allowedtags ); $theme->stars = wp_star_rating( array( 'rating' => $theme->rating, 'type' => 'percent', 'number' => $theme->num_ratings, 'echo' => false, ) ); $theme->num_ratings = number_format_i18n( $theme->num_ratings ); $theme->preview_url = set_url_scheme( $theme->preview_url ); // Handle themes that are already installed as installed themes. if ( in_array( $theme->slug, $installed_themes, true ) ) { $theme->type = 'installed'; } else { $theme->type = $theme_action; } // Set active based on customized theme. $theme->active = ( isset( $_POST['customized_theme'] ) && $_POST['customized_theme'] === $theme->slug ); // Map available theme properties to installed theme properties. $theme->id = $theme->slug; $theme->screenshot = array( $theme->screenshot_url ); $theme->authorAndUri = wp_kses( $theme->author['display_name'], $themes_allowedtags ); $theme->compatibleWP = is_wp_version_compatible( $theme->requires ); // phpcs:ignore WordPress.NamingConventions.ValidVariableName $theme->compatiblePHP = is_php_version_compatible( $theme->requires_php ); // phpcs:ignore WordPress.NamingConventions.ValidVariableName if ( isset( $theme->parent ) ) { $theme->parent = $theme->parent['slug']; } else { $theme->parent = false; } unset( $theme->slug ); unset( $theme->screenshot_url ); unset( $theme->author ); } // End foreach(). } // End if(). /** * Filters the theme data loaded in the customizer. * * This allows theme data to be loading from an external source, * or modification of data loaded from `wp_prepare_themes_for_js()` * or WordPress.org via `themes_api()`. * * @since 4.9.0 * * @see wp_prepare_themes_for_js() * @see themes_api() * @see WP_Customize_Manager::__construct() * * @param array|stdClass $themes Nested array or object of theme data. * @param array $args List of arguments, such as page, search term, and tags to query for. * @param WP_Customize_Manager $manager Instance of Customize manager. */ $themes = apply_filters( 'customize_load_themes', $themes, $args, $this ); wp_send_json_success( $themes ); } /** * Callback for validating the header_textcolor value. * * Accepts 'blank', and otherwise uses sanitize_hex_color_no_hash(). * Returns default text color if hex color is empty. * * @since 3.4.0 * * @param string $color * @return mixed */ public function _sanitize_header_textcolor( $color ) { if ( 'blank' === $color ) { return 'blank'; } $color = sanitize_hex_color_no_hash( $color ); if ( empty( $color ) ) { $color = get_theme_support( 'custom-header', 'default-text-color' ); } return $color; } /** * Callback for validating a background setting value. * * @since 4.7.0 * * @param string $value Repeat value. * @param WP_Customize_Setting $setting Setting. * @return string|WP_Error Background value or validation error. */ public function _sanitize_background_setting( $value, $setting ) { if ( 'background_repeat' === $setting->id ) { if ( ! in_array( $value, array( 'repeat-x', 'repeat-y', 'repeat', 'no-repeat' ), true ) ) { return new WP_Error( 'invalid_value', __( 'Invalid value for background repeat.' ) ); } } elseif ( 'background_attachment' === $setting->id ) { if ( ! in_array( $value, array( 'fixed', 'scroll' ), true ) ) { return new WP_Error( 'invalid_value', __( 'Invalid value for background attachment.' ) ); } } elseif ( 'background_position_x' === $setting->id ) { if ( ! in_array( $value, array( 'left', 'center', 'right' ), true ) ) { return new WP_Error( 'invalid_value', __( 'Invalid value for background position X.' ) ); } } elseif ( 'background_position_y' === $setting->id ) { if ( ! in_array( $value, array( 'top', 'center', 'bottom' ), true ) ) { return new WP_Error( 'invalid_value', __( 'Invalid value for background position Y.' ) ); } } elseif ( 'background_size' === $setting->id ) { if ( ! in_array( $value, array( 'auto', 'contain', 'cover' ), true ) ) { return new WP_Error( 'invalid_value', __( 'Invalid value for background size.' ) ); } } elseif ( 'background_preset' === $setting->id ) { if ( ! in_array( $value, array( 'default', 'fill', 'fit', 'repeat', 'custom' ), true ) ) { return new WP_Error( 'invalid_value', __( 'Invalid value for background size.' ) ); } } elseif ( 'background_image' === $setting->id || 'background_image_thumb' === $setting->id ) { $value = empty( $value ) ? '' : sanitize_url( $value ); } else { return new WP_Error( 'unrecognized_setting', __( 'Unrecognized background setting.' ) ); } return $value; } /** * Exports header video settings to facilitate selective refresh. * * @since 4.7.0 * * @param array $response Response. * @param WP_Customize_Selective_Refresh $selective_refresh Selective refresh component. * @param array $partials Array of partials. * @return array */ public function export_header_video_settings( $response, $selective_refresh, $partials ) { if ( isset( $partials['custom_header'] ) ) { $response['custom_header_settings'] = get_header_video_settings(); } return $response; } /** * Callback for validating the header_video value. * * Ensures that the selected video is less than 8MB and provides an error message. * * @since 4.7.0 * * @param WP_Error $validity * @param mixed $value * @return mixed */ public function _validate_header_video( $validity, $value ) { $video = get_attached_file( absint( $value ) ); if ( $video ) { $size = filesize( $video ); if ( $size > 8 * MB_IN_BYTES ) { $validity->add( 'size_too_large', __( 'This video file is too large to use as a header video. Try a shorter video or optimize the compression settings and re-upload a file that is less than 8MB. Or, upload your video to YouTube and link it with the option below.' ) ); } if ( ! str_ends_with( $video, '.mp4' ) && ! str_ends_with( $video, '.mov' ) ) { // Check for .mp4 or .mov format, which (assuming h.264 encoding) are the only cross-browser-supported formats. $validity->add( 'invalid_file_type', sprintf( /* translators: 1: .mp4, 2: .mov */ __( 'Only %1$s or %2$s files may be used for header video. Please convert your video file and try again, or, upload your video to YouTube and link it with the option below.' ), '<code>.mp4</code>', '<code>.mov</code>' ) ); } } return $validity; } /** * Callback for validating the external_header_video value. * * Ensures that the provided URL is supported. * * @since 4.7.0 * * @param WP_Error $validity * @param mixed $value * @return mixed */ public function _validate_external_header_video( $validity, $value ) { $video = sanitize_url( $value ); if ( $video ) { if ( ! preg_match( '#^https?://(?:www\.)?(?:youtube\.com/watch|youtu\.be/)#', $video ) ) { $validity->add( 'invalid_url', __( 'Please enter a valid YouTube URL.' ) ); } } return $validity; } /** * Callback for sanitizing the external_header_video value. * * @since 4.7.1 * * @param string $value URL. * @return string Sanitized URL. */ public function _sanitize_external_header_video( $value ) { return sanitize_url( trim( $value ) ); } /** * Callback for rendering the custom logo, used in the custom_logo partial. * * This method exists because the partial object and context data are passed * into a partial's render_callback so we cannot use get_custom_logo() as * the render_callback directly since it expects a blog ID as the first * argument. * * @see WP_Customize_Manager::register_controls() * * @since 4.5.0 * * @return string Custom logo. */ public function _render_custom_logo_partial() { return get_custom_logo(); } } https-detection-20260605203859.php 0000666 00000013341 15226557730 0012012 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } https-migration-20260606142821.php 0000666 00000011205 15226557730 0012012 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } https-migration-20260607060509.php 0000666 00000011205 15226557730 0012015 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } https-detection-20260606052425.php 0000666 00000013341 15226557730 0012002 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } https-detection-20260605143158.php 0000666 00000013341 15226557730 0012005 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } https-migration-20260605135853.php 0000666 00000011205 15226557730 0012020 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } https-migration-20260605225728.php 0000666 00000011205 15226557730 0012021 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } https-detection-20260605080452.php 0000666 00000013341 15226557730 0012002 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } https-migration-20260605192252.php 0000666 00000011205 15226557730 0012014 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } https-detection-20260605034026.php 0000666 00000013341 15226557730 0011776 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } https-detection-20260605104050.php 0000666 00000013341 15226557730 0011771 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } https-migration-20260605104451.php 0000666 00000011205 15226557730 0012006 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } https-migration-20260605080337.php 0000666 00000011205 15226557730 0012014 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } class-wp-block-parser.php 0000666 00000026374 15226557730 0011424 0 ustar 00 <?php /** * Block Serialization Parser * * @package WordPress */ /** * Class WP_Block_Parser * * Parses a document and constructs a list of parsed block objects * * @since 5.0.0 * @since 4.0.0 returns arrays not objects, all attributes are arrays */ class WP_Block_Parser { /** * Input document being parsed * * @example "Pre-text\n<!-- wp:paragraph -->This is inside a block!<!-- /wp:paragraph -->" * * @since 5.0.0 * @var string */ public $document; /** * Tracks parsing progress through document * * @since 5.0.0 * @var int */ public $offset; /** * List of parsed blocks * * @since 5.0.0 * @var array[] */ public $output; /** * Stack of partially-parsed structures in memory during parse * * @since 5.0.0 * @var WP_Block_Parser_Frame[] */ public $stack; /** * Parses a document and returns a list of block structures * * When encountering an invalid parse will return a best-effort * parse. In contrast to the specification parser this does not * return an error on invalid inputs. * * @since 5.0.0 * * @param string $document Input document being parsed. * @return array[] */ public function parse( $document ) { $this->document = $document; $this->offset = 0; $this->output = array(); $this->stack = array(); while ( $this->proceed() ) { continue; } return $this->output; } /** * Processes the next token from the input document * and returns whether to proceed eating more tokens * * This is the "next step" function that essentially * takes a token as its input and decides what to do * with that token before descending deeper into a * nested block tree or continuing along the document * or breaking out of a level of nesting. * * @internal * @since 5.0.0 * @return bool */ public function proceed() { $next_token = $this->next_token(); list( $token_type, $block_name, $attrs, $start_offset, $token_length ) = $next_token; $stack_depth = count( $this->stack ); // we may have some HTML soup before the next block. $leading_html_start = $start_offset > $this->offset ? $this->offset : null; switch ( $token_type ) { case 'no-more-tokens': // if not in a block then flush output. if ( 0 === $stack_depth ) { $this->add_freeform(); return false; } /* * Otherwise we have a problem * This is an error * * we have options * - treat it all as freeform text * - assume an implicit closer (easiest when not nesting) */ // for the easy case we'll assume an implicit closer. if ( 1 === $stack_depth ) { $this->add_block_from_stack(); return false; } /* * for the nested case where it's more difficult we'll * have to assume that multiple closers are missing * and so we'll collapse the whole stack piecewise */ while ( 0 < count( $this->stack ) ) { $this->add_block_from_stack(); } return false; case 'void-block': /* * easy case is if we stumbled upon a void block * in the top-level of the document */ if ( 0 === $stack_depth ) { if ( isset( $leading_html_start ) ) { $this->output[] = (array) $this->freeform( substr( $this->document, $leading_html_start, $start_offset - $leading_html_start ) ); } $this->output[] = (array) new WP_Block_Parser_Block( $block_name, $attrs, array(), '', array() ); $this->offset = $start_offset + $token_length; return true; } // otherwise we found an inner block. $this->add_inner_block( new WP_Block_Parser_Block( $block_name, $attrs, array(), '', array() ), $start_offset, $token_length ); $this->offset = $start_offset + $token_length; return true; case 'block-opener': // track all newly-opened blocks on the stack. array_push( $this->stack, new WP_Block_Parser_Frame( new WP_Block_Parser_Block( $block_name, $attrs, array(), '', array() ), $start_offset, $token_length, $start_offset + $token_length, $leading_html_start ) ); $this->offset = $start_offset + $token_length; return true; case 'block-closer': /* * if we're missing an opener we're in trouble * This is an error */ if ( 0 === $stack_depth ) { /* * we have options * - assume an implicit opener * - assume _this_ is the opener * - give up and close out the document */ $this->add_freeform(); return false; } // if we're not nesting then this is easy - close the block. if ( 1 === $stack_depth ) { $this->add_block_from_stack( $start_offset ); $this->offset = $start_offset + $token_length; return true; } /* * otherwise we're nested and we have to close out the current * block and add it as a new innerBlock to the parent */ $stack_top = array_pop( $this->stack ); $html = substr( $this->document, $stack_top->prev_offset, $start_offset - $stack_top->prev_offset ); $stack_top->block->innerHTML .= $html; $stack_top->block->innerContent[] = $html; $stack_top->prev_offset = $start_offset + $token_length; $this->add_inner_block( $stack_top->block, $stack_top->token_start, $stack_top->token_length, $start_offset + $token_length ); $this->offset = $start_offset + $token_length; return true; default: // This is an error. $this->add_freeform(); return false; } } /** * Scans the document from where we last left off * and finds the next valid token to parse if it exists * * Returns the type of the find: kind of find, block information, attributes * * @internal * @since 5.0.0 * @since 4.6.1 fixed a bug in attribute parsing which caused catastrophic backtracking on invalid block comments * @return array */ public function next_token() { $matches = null; /* * aye the magic * we're using a single RegExp to tokenize the block comment delimiters * we're also using a trick here because the only difference between a * block opener and a block closer is the leading `/` before `wp:` (and * a closer has no attributes). we can trap them both and process the * match back in PHP to see which one it was. */ $has_match = preg_match( '/<!--\s+(?P<closer>\/)?wp:(?P<namespace>[a-z][a-z0-9_-]*\/)?(?P<name>[a-z][a-z0-9_-]*)\s+(?P<attrs>{(?:(?:[^}]+|}+(?=})|(?!}\s+\/?-->).)*+)?}\s+)?(?P<void>\/)?-->/s', $this->document, $matches, PREG_OFFSET_CAPTURE, $this->offset ); // if we get here we probably have catastrophic backtracking or out-of-memory in the PCRE. if ( false === $has_match ) { return array( 'no-more-tokens', null, null, null, null ); } // we have no more tokens. if ( 0 === $has_match ) { return array( 'no-more-tokens', null, null, null, null ); } list( $match, $started_at ) = $matches[0]; $length = strlen( $match ); $is_closer = isset( $matches['closer'] ) && -1 !== $matches['closer'][1]; $is_void = isset( $matches['void'] ) && -1 !== $matches['void'][1]; $namespace = $matches['namespace']; $namespace = ( isset( $namespace ) && -1 !== $namespace[1] ) ? $namespace[0] : 'core/'; $name = $namespace . $matches['name'][0]; $has_attrs = isset( $matches['attrs'] ) && -1 !== $matches['attrs'][1]; /* * Fun fact! It's not trivial in PHP to create "an empty associative array" since all arrays * are associative arrays. If we use `array()` we get a JSON `[]` */ $attrs = $has_attrs ? json_decode( $matches['attrs'][0], /* as-associative */ true ) : array(); /* * This state isn't allowed * This is an error */ if ( $is_closer && ( $is_void || $has_attrs ) ) { // we can ignore them since they don't hurt anything. } if ( $is_void ) { return array( 'void-block', $name, $attrs, $started_at, $length ); } if ( $is_closer ) { return array( 'block-closer', $name, null, $started_at, $length ); } return array( 'block-opener', $name, $attrs, $started_at, $length ); } /** * Returns a new block object for freeform HTML * * @internal * @since 5.0.0 * * @param string $inner_html HTML content of block. * @return WP_Block_Parser_Block freeform block object. */ public function freeform( $inner_html ) { return new WP_Block_Parser_Block( null, array(), array(), $inner_html, array( $inner_html ) ); } /** * Pushes a length of text from the input document * to the output list as a freeform block. * * @internal * @since 5.0.0 * @param null $length how many bytes of document text to output. */ public function add_freeform( $length = null ) { $length = $length ? $length : strlen( $this->document ) - $this->offset; if ( 0 === $length ) { return; } $this->output[] = (array) $this->freeform( substr( $this->document, $this->offset, $length ) ); } /** * Given a block structure from memory pushes * a new block to the output list. * * @internal * @since 5.0.0 * @param WP_Block_Parser_Block $block The block to add to the output. * @param int $token_start Byte offset into the document where the first token for the block starts. * @param int $token_length Byte length of entire block from start of opening token to end of closing token. * @param int|null $last_offset Last byte offset into document if continuing form earlier output. */ public function add_inner_block( WP_Block_Parser_Block $block, $token_start, $token_length, $last_offset = null ) { $parent = $this->stack[ count( $this->stack ) - 1 ]; $parent->block->innerBlocks[] = (array) $block; $html = substr( $this->document, $parent->prev_offset, $token_start - $parent->prev_offset ); if ( ! empty( $html ) ) { $parent->block->innerHTML .= $html; $parent->block->innerContent[] = $html; } $parent->block->innerContent[] = null; $parent->prev_offset = $last_offset ? $last_offset : $token_start + $token_length; } /** * Pushes the top block from the parsing stack to the output list. * * @internal * @since 5.0.0 * @param int|null $end_offset byte offset into document for where we should stop sending text output as HTML. */ public function add_block_from_stack( $end_offset = null ) { $stack_top = array_pop( $this->stack ); $prev_offset = $stack_top->prev_offset; $html = isset( $end_offset ) ? substr( $this->document, $prev_offset, $end_offset - $prev_offset ) : substr( $this->document, $prev_offset ); if ( ! empty( $html ) ) { $stack_top->block->innerHTML .= $html; $stack_top->block->innerContent[] = $html; } if ( isset( $stack_top->leading_html_start ) ) { $this->output[] = (array) $this->freeform( substr( $this->document, $stack_top->leading_html_start, $stack_top->token_start - $stack_top->leading_html_start ) ); } $this->output[] = (array) $stack_top->block; } } /** * WP_Block_Parser_Block class. * * Required for backward compatibility in WordPress Core. */ require_once __DIR__ . '/class-wp-block-parser-block.php'; /** * WP_Block_Parser_Frame class. * * Required for backward compatibility in WordPress Core. */ require_once __DIR__ . '/class-wp-block-parser-frame.php'; https-migration-20260605113233.php 0000666 00000011205 15226557730 0012004 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } https-migration-20260605104649.php 0000666 00000011205 15226557730 0012017 0 ustar 00 <?php /** * HTTPS migration functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to * add frontend filters to replace insecure site URLs that may be present in older database content. The * {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior. * * @since 5.7.0 * * @return bool True if insecure URLs should replaced, false otherwise. */ function wp_should_replace_insecure_home_url() { $should_replace_insecure_home_url = wp_is_using_https() && get_option( 'https_migration_required' ) // For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using // the same domain. && wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST ); /** * Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart. * * If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can * be used to disable that behavior, e.g. after having replaced URLs manually in the database. * * @since 5.7.0 * * @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced. */ return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url ); } /** * Replaces insecure HTTP URLs to the site in the given content, if configured to do so. * * This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if * determined via {@see wp_should_replace_insecure_home_url()}. * * @since 5.7.0 * * @param string $content Content to replace URLs in. * @return string Filtered content. */ function wp_replace_insecure_home_url( $content ) { if ( ! wp_should_replace_insecure_home_url() ) { return $content; } $https_url = home_url( '', 'https' ); $http_url = str_replace( 'https://', 'http://', $https_url ); // Also replace potentially escaped URL. $escaped_https_url = str_replace( '/', '\/', $https_url ); $escaped_http_url = str_replace( '/', '\/', $http_url ); return str_replace( array( $http_url, $escaped_http_url, ), array( $https_url, $escaped_https_url, ), $content ); } /** * Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL. * * If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants * overriding the URLs used), the changes will be reverted. In such a case the function will return false. * * @since 5.7.0 * * @return bool True on success, false on failure. */ function wp_update_urls_to_https() { // Get current URL options. $orig_home = get_option( 'home' ); $orig_siteurl = get_option( 'siteurl' ); // Get current URL options, replacing HTTP with HTTPS. $home = str_replace( 'http://', 'https://', $orig_home ); $siteurl = str_replace( 'http://', 'https://', $orig_siteurl ); // Update the options. update_option( 'home', $home ); update_option( 'siteurl', $siteurl ); if ( ! wp_is_using_https() ) { /* * If this did not result in the site recognizing HTTPS as being used, * revert the change and return false. */ update_option( 'home', $orig_home ); update_option( 'siteurl', $orig_siteurl ); return false; } // Otherwise the URLs were successfully changed to use HTTPS. return true; } /** * Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS. * * If this is a fresh site, a migration will not be required, so the option will be set as `false`. * * This is hooked into the {@see 'update_option_home'} action. * * @since 5.7.0 * @access private * * @param mixed $old_url Previous value of the URL option. * @param mixed $new_url New value of the URL option. */ function wp_update_https_migration_required( $old_url, $new_url ) { // Do nothing if WordPress is being installed. if ( wp_installing() ) { return; } // Delete/reset the option if the new URL is not the HTTPS version of the old URL. if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) { delete_option( 'https_migration_required' ); return; } // If this is a fresh site, there is no content to migrate, so do not require migration. $https_migration_required = get_option( 'fresh_site' ) ? false : true; update_option( 'https_migration_required', $https_migration_required ); } class-oembed.php 0000666 00000000621 15226557730 0007632 0 ustar 00 <?php /** * API for fetching the HTML to embed remote content based on a provided URL. * * This file is deprecated, use 'wp-includes/class-wp-oembed.php' instead. * * @deprecated 5.3.0 * @package WordPress * @subpackage oEmbed */ _deprecated_file( basename( __FILE__ ), '5.3.0', WPINC . '/class-wp-oembed.php' ); /** WP_oEmbed class */ require_once ABSPATH . WPINC . '/class-wp-oembed.php'; https-detection-20260605111237.php 0000666 00000013341 15226557730 0011776 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } https-detection-20260605091706.php 0000666 00000013341 15226557730 0012006 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } class-wp-navigation-fallback.php 0000666 00000021751 15226557730 0012726 0 ustar 00 <?php /** * WP_Navigation_Fallback class * * Manages fallback behavior for Navigation menus. * * @package WordPress * @subpackage Navigation * @since 6.3.0 */ /** * Manages fallback behavior for Navigation menus. * * @since 6.3.0 */ class WP_Navigation_Fallback { /** * Updates the wp_navigation custom post type schema, in order to expose * additional fields in the embeddable links of WP_REST_Navigation_Fallback_Controller. * * The Navigation Fallback endpoint may embed the full Navigation Menu object * into the response as the `self` link. By default, the Posts Controller * will only expose a limited subset of fields but the editor requires * additional fields to be available in order to utilize the menu. * * Used with the `rest_wp_navigation_item_schema` hook. * * @since 6.4.0 * * @param array $schema The schema for the `wp_navigation` post. * @return array The modified schema. */ public static function update_wp_navigation_post_schema( $schema ) { // Expose top level fields. $schema['properties']['status']['context'] = array_merge( $schema['properties']['status']['context'], array( 'embed' ) ); $schema['properties']['content']['context'] = array_merge( $schema['properties']['content']['context'], array( 'embed' ) ); /* * Exposes sub properties of content field. * These sub properties aren't exposed by the posts controller by default, * for requests where context is `embed`. * * @see WP_REST_Posts_Controller::get_item_schema() */ $schema['properties']['content']['properties']['raw']['context'] = array_merge( $schema['properties']['content']['properties']['raw']['context'], array( 'embed' ) ); $schema['properties']['content']['properties']['rendered']['context'] = array_merge( $schema['properties']['content']['properties']['rendered']['context'], array( 'embed' ) ); $schema['properties']['content']['properties']['block_version']['context'] = array_merge( $schema['properties']['content']['properties']['block_version']['context'], array( 'embed' ) ); /* * Exposes sub properties of title field. * These sub properties aren't exposed by the posts controller by default, * for requests where context is `embed`. * * @see WP_REST_Posts_Controller::get_item_schema() */ $schema['properties']['title']['properties']['raw']['context'] = array_merge( $schema['properties']['title']['properties']['raw']['context'], array( 'embed' ) ); return $schema; } /** * Gets (and/or creates) an appropriate fallback Navigation Menu. * * @since 6.3.0 * * @return WP_Post|null the fallback Navigation Post or null. */ public static function get_fallback() { /** * Filters whether or not a fallback should be created. * * @since 6.3.0 * * @param bool $create Whether to create a fallback navigation menu. Default true. */ $should_create_fallback = apply_filters( 'wp_navigation_should_create_fallback', true ); $fallback = static::get_most_recently_published_navigation(); if ( $fallback || ! $should_create_fallback ) { return $fallback; } $fallback = static::create_classic_menu_fallback(); if ( $fallback && ! is_wp_error( $fallback ) ) { // Return the newly created fallback post object which will now be the most recently created navigation menu. return $fallback instanceof WP_Post ? $fallback : static::get_most_recently_published_navigation(); } $fallback = static::create_default_fallback(); if ( $fallback && ! is_wp_error( $fallback ) ) { // Return the newly created fallback post object which will now be the most recently created navigation menu. return $fallback instanceof WP_Post ? $fallback : static::get_most_recently_published_navigation(); } return null; } /** * Finds the most recently published `wp_navigation` post type. * * @since 6.3.0 * * @return WP_Post|null the first non-empty Navigation or null. */ private static function get_most_recently_published_navigation() { $parsed_args = array( 'post_type' => 'wp_navigation', 'no_found_rows' => true, 'update_post_meta_cache' => false, 'update_post_term_cache' => false, 'order' => 'DESC', 'orderby' => 'date', 'post_status' => 'publish', 'posts_per_page' => 1, ); $navigation_post = new WP_Query( $parsed_args ); if ( count( $navigation_post->posts ) > 0 ) { return $navigation_post->posts[0]; } return null; } /** * Creates a Navigation Menu post from a Classic Menu. * * @since 6.3.0 * * @return int|WP_Error The post ID of the default fallback menu or a WP_Error object. */ private static function create_classic_menu_fallback() { // See if we have a classic menu. $classic_nav_menu = static::get_fallback_classic_menu(); if ( ! $classic_nav_menu ) { return new WP_Error( 'no_classic_menus', __( 'No Classic Menus found.' ) ); } // If there is a classic menu then convert it to blocks. $classic_nav_menu_blocks = WP_Classic_To_Block_Menu_Converter::convert( $classic_nav_menu ); if ( is_wp_error( $classic_nav_menu_blocks ) ) { return $classic_nav_menu_blocks; } if ( empty( $classic_nav_menu_blocks ) ) { return new WP_Error( 'cannot_convert_classic_menu', __( 'Unable to convert Classic Menu to blocks.' ) ); } // Create a new navigation menu from the classic menu. $classic_menu_fallback = wp_insert_post( array( 'post_content' => $classic_nav_menu_blocks, 'post_title' => $classic_nav_menu->name, 'post_name' => $classic_nav_menu->slug, 'post_status' => 'publish', 'post_type' => 'wp_navigation', ), true // So that we can check whether the result is an error. ); return $classic_menu_fallback; } /** * Determines the most appropriate classic navigation menu to use as a fallback. * * @since 6.3.0 * * @return WP_Term|null The most appropriate classic navigation menu to use as a fallback. */ private static function get_fallback_classic_menu() { $classic_nav_menus = wp_get_nav_menus(); if ( ! $classic_nav_menus || is_wp_error( $classic_nav_menus ) ) { return null; } $nav_menu = static::get_nav_menu_at_primary_location(); if ( $nav_menu ) { return $nav_menu; } $nav_menu = static::get_nav_menu_with_primary_slug( $classic_nav_menus ); if ( $nav_menu ) { return $nav_menu; } return static::get_most_recently_created_nav_menu( $classic_nav_menus ); } /** * Sorts the classic menus and returns the most recently created one. * * @since 6.3.0 * * @param WP_Term[] $classic_nav_menus Array of classic nav menu term objects. * @return WP_Term The most recently created classic nav menu. */ private static function get_most_recently_created_nav_menu( $classic_nav_menus ) { usort( $classic_nav_menus, static function ( $a, $b ) { return $b->term_id - $a->term_id; } ); return $classic_nav_menus[0]; } /** * Returns the classic menu with the slug `primary` if it exists. * * @since 6.3.0 * * @param WP_Term[] $classic_nav_menus Array of classic nav menu term objects. * @return WP_Term|null The classic nav menu with the slug `primary` or null. */ private static function get_nav_menu_with_primary_slug( $classic_nav_menus ) { foreach ( $classic_nav_menus as $classic_nav_menu ) { if ( 'primary' === $classic_nav_menu->slug ) { return $classic_nav_menu; } } return null; } /** * Gets the classic menu assigned to the `primary` navigation menu location * if it exists. * * @since 6.3.0 * * @return WP_Term|null The classic nav menu assigned to the `primary` location or null. */ private static function get_nav_menu_at_primary_location() { $locations = get_nav_menu_locations(); if ( isset( $locations['primary'] ) ) { $primary_menu = wp_get_nav_menu_object( $locations['primary'] ); if ( $primary_menu ) { return $primary_menu; } } return null; } /** * Creates a default Navigation Block Menu fallback. * * @since 6.3.0 * * @return int|WP_Error The post ID of the default fallback menu or a WP_Error object. */ private static function create_default_fallback() { $default_blocks = static::get_default_fallback_blocks(); // Create a new navigation menu from the fallback blocks. $default_fallback = wp_insert_post( array( 'post_content' => $default_blocks, 'post_title' => _x( 'Navigation', 'Title of a Navigation menu' ), 'post_name' => 'navigation', 'post_status' => 'publish', 'post_type' => 'wp_navigation', ), true // So that we can check whether the result is an error. ); return $default_fallback; } /** * Gets the rendered markup for the default fallback blocks. * * @since 6.3.0 * * @return string default blocks markup to use a the fallback. */ private static function get_default_fallback_blocks() { $registry = WP_Block_Type_Registry::get_instance(); // If `core/page-list` is not registered then use empty blocks. return $registry->is_registered( 'core/page-list' ) ? '<!-- wp:page-list /-->' : ''; } } class-wp-http-cookie.php 0000666 00000016335 15226557730 0011262 0 ustar 00 <?php /** * HTTP API: WP_Http_Cookie class * * @package WordPress * @subpackage HTTP * @since 4.4.0 */ /** * Core class used to encapsulate a single cookie object for internal use. * * Returned cookies are represented using this class, and when cookies are set, if they are not * already a WP_Http_Cookie() object, then they are turned into one. * * @todo The WordPress convention is to use underscores instead of camelCase for function and method * names. Need to switch to use underscores instead for the methods. * * @since 2.8.0 */ #[AllowDynamicProperties] class WP_Http_Cookie { /** * Cookie name. * * @since 2.8.0 * * @var string */ public $name; /** * Cookie value. * * @since 2.8.0 * * @var string */ public $value; /** * When the cookie expires. Unix timestamp or formatted date. * * @since 2.8.0 * * @var string|int|null */ public $expires; /** * Cookie URL path. * * @since 2.8.0 * * @var string */ public $path; /** * Cookie Domain. * * @since 2.8.0 * * @var string */ public $domain; /** * Cookie port or comma-separated list of ports. * * @since 2.8.0 * * @var int|string */ public $port; /** * host-only flag. * * @since 5.2.0 * * @var bool */ public $host_only; /** * Sets up this cookie object. * * The parameter $data should be either an associative array containing the indices names below * or a header string detailing it. * * @since 2.8.0 * @since 5.2.0 Added `host_only` to the `$data` parameter. * * @param string|array $data { * Raw cookie data as header string or data array. * * @type string $name Cookie name. * @type mixed $value Value. Should NOT already be urlencoded. * @type string|int|null $expires Optional. Unix timestamp or formatted date. Default null. * @type string $path Optional. Path. Default '/'. * @type string $domain Optional. Domain. Default host of parsed $requested_url. * @type int|string $port Optional. Port or comma-separated list of ports. Default null. * @type bool $host_only Optional. host-only storage flag. Default true. * } * @param string $requested_url The URL which the cookie was set on, used for default $domain * and $port values. */ public function __construct( $data, $requested_url = '' ) { if ( $requested_url ) { $parsed_url = parse_url( $requested_url ); } if ( isset( $parsed_url['host'] ) ) { $this->domain = $parsed_url['host']; } $this->path = isset( $parsed_url['path'] ) ? $parsed_url['path'] : '/'; if ( ! str_ends_with( $this->path, '/' ) ) { $this->path = dirname( $this->path ) . '/'; } if ( is_string( $data ) ) { // Assume it's a header string direct from a previous request. $pairs = explode( ';', $data ); // Special handling for first pair; name=value. Also be careful of "=" in value. $name = trim( substr( $pairs[0], 0, strpos( $pairs[0], '=' ) ) ); $value = substr( $pairs[0], strpos( $pairs[0], '=' ) + 1 ); $this->name = $name; $this->value = urldecode( $value ); // Removes name=value from items. array_shift( $pairs ); // Set everything else as a property. foreach ( $pairs as $pair ) { $pair = rtrim( $pair ); // Handle the cookie ending in ; which results in an empty final pair. if ( empty( $pair ) ) { continue; } list( $key, $val ) = strpos( $pair, '=' ) ? explode( '=', $pair ) : array( $pair, '' ); $key = strtolower( trim( $key ) ); if ( 'expires' === $key ) { $val = strtotime( $val ); } $this->$key = $val; } } else { if ( ! isset( $data['name'] ) ) { return; } // Set properties based directly on parameters. foreach ( array( 'name', 'value', 'path', 'domain', 'port', 'host_only' ) as $field ) { if ( isset( $data[ $field ] ) ) { $this->$field = $data[ $field ]; } } if ( isset( $data['expires'] ) ) { $this->expires = is_int( $data['expires'] ) ? $data['expires'] : strtotime( $data['expires'] ); } else { $this->expires = null; } } } /** * Confirms that it's OK to send this cookie to the URL checked against. * * Decision is based on RFC 2109/2965, so look there for details on validity. * * @since 2.8.0 * * @param string $url URL you intend to send this cookie to * @return bool true if allowed, false otherwise. */ public function test( $url ) { if ( is_null( $this->name ) ) { return false; } // Expires - if expired then nothing else matters. if ( isset( $this->expires ) && time() > $this->expires ) { return false; } // Get details on the URL we're thinking about sending to. $url = parse_url( $url ); $url['port'] = isset( $url['port'] ) ? $url['port'] : ( 'https' === $url['scheme'] ? 443 : 80 ); $url['path'] = isset( $url['path'] ) ? $url['path'] : '/'; // Values to use for comparison against the URL. $path = isset( $this->path ) ? $this->path : '/'; $port = isset( $this->port ) ? $this->port : null; $domain = isset( $this->domain ) ? strtolower( $this->domain ) : strtolower( $url['host'] ); if ( false === stripos( $domain, '.' ) ) { $domain .= '.local'; } // Host - very basic check that the request URL ends with the domain restriction (minus leading dot). $domain = ( str_starts_with( $domain, '.' ) ) ? substr( $domain, 1 ) : $domain; if ( ! str_ends_with( $url['host'], $domain ) ) { return false; } // Port - supports "port-lists" in the format: "80,8000,8080". if ( ! empty( $port ) && ! in_array( $url['port'], array_map( 'intval', explode( ',', $port ) ), true ) ) { return false; } // Path - request path must start with path restriction. if ( ! str_starts_with( $url['path'], $path ) ) { return false; } return true; } /** * Convert cookie name and value back to header string. * * @since 2.8.0 * * @return string Header encoded cookie name and value. */ public function getHeaderValue() { // phpcs:ignore WordPress.NamingConventions.ValidFunctionName.MethodNameInvalid if ( ! isset( $this->name ) || ! isset( $this->value ) ) { return ''; } /** * Filters the header-encoded cookie value. * * @since 3.4.0 * * @param string $value The cookie value. * @param string $name The cookie name. */ return $this->name . '=' . apply_filters( 'wp_http_cookie_value', $this->value, $this->name ); } /** * Retrieve cookie header for usage in the rest of the WordPress HTTP API. * * @since 2.8.0 * * @return string */ public function getFullHeader() { // phpcs:ignore WordPress.NamingConventions.ValidFunctionName.MethodNameInvalid return 'Cookie: ' . $this->getHeaderValue(); } /** * Retrieves cookie attributes. * * @since 4.6.0 * * @return array { * List of attributes. * * @type string|int|null $expires When the cookie expires. Unix timestamp or formatted date. * @type string $path Cookie URL path. * @type string $domain Cookie domain. * } */ public function get_attributes() { return array( 'expires' => $this->expires, 'path' => $this->path, 'domain' => $this->domain, ); } } https-detection-20260606132425.php 0000666 00000013341 15226557730 0012001 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } https-detection-20260606105656.php 0000666 00000013341 15226557730 0012007 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } https-detection-20260606155924.php 0000666 00000013341 15226557730 0012012 0 ustar 00 <?php /** * HTTPS detection functions. * * @package WordPress * @since 5.7.0 */ /** * Checks whether the website is using HTTPS. * * This is based on whether both the home and site URL are using HTTPS. * * @since 5.7.0 * @see wp_is_home_url_using_https() * @see wp_is_site_url_using_https() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_using_https() { if ( ! wp_is_home_url_using_https() ) { return false; } return wp_is_site_url_using_https(); } /** * Checks whether the current site URL is using HTTPS. * * @since 5.7.0 * @see home_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_home_url_using_https() { return 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ); } /** * Checks whether the current site's URL where WordPress is stored is using HTTPS. * * This checks the URL where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) * are accessible. * * @since 5.7.0 * @see site_url() * * @return bool True if using HTTPS, false otherwise. */ function wp_is_site_url_using_https() { /* * Use direct option access for 'siteurl' and manually run the 'site_url' * filter because `site_url()` will adjust the scheme based on what the * current request is using. */ /** This filter is documented in wp-includes/link-template.php */ $site_url = apply_filters( 'site_url', get_option( 'siteurl' ), '', null, null ); return 'https' === wp_parse_url( $site_url, PHP_URL_SCHEME ); } /** * Checks whether HTTPS is supported for the server and domain. * * This function makes an HTTP request through `wp_get_https_detection_errors()` * to check for HTTPS support. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments, * to avoid potential latency issues. * * @since 5.7.0 * * @return bool True if HTTPS is supported, false otherwise. */ function wp_is_https_supported() { $https_detection_errors = wp_get_https_detection_errors(); // If there are errors, HTTPS is not supported. return empty( $https_detection_errors ); } /** * Runs a remote HTTPS request to detect whether HTTPS supported, and stores potential errors. * * This function checks for HTTPS support by making an HTTP request. As this process can be resource-intensive, * it should be used cautiously, especially in performance-sensitive environments. * It is called when HTTPS support needs to be validated. * * @since 6.4.0 * @access private * * @return array An array containing potential detection errors related to HTTPS, or an empty array if no errors are found. */ function wp_get_https_detection_errors() { /** * Short-circuits the process of detecting errors related to HTTPS support. * * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead. * * @since 6.4.0 * * @param null|WP_Error $pre Error object to short-circuit detection, * or null to continue with the default behavior. */ $support_errors = apply_filters( 'pre_wp_get_https_detection_errors', null ); if ( is_wp_error( $support_errors ) ) { return $support_errors->errors; } $support_errors = new WP_Error(); $response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => true, ) ); if ( is_wp_error( $response ) ) { $unverified_response = wp_remote_request( home_url( '/', 'https' ), array( 'headers' => array( 'Cache-Control' => 'no-cache', ), 'sslverify' => false, ) ); if ( is_wp_error( $unverified_response ) ) { $support_errors->add( 'https_request_failed', __( 'HTTPS request failed.' ) ); } else { $support_errors->add( 'ssl_verification_failed', __( 'SSL verification failed.' ) ); } $response = $unverified_response; } if ( ! is_wp_error( $response ) ) { if ( 200 !== wp_remote_retrieve_response_code( $response ) ) { $support_errors->add( 'bad_response_code', wp_remote_retrieve_response_message( $response ) ); } elseif ( false === wp_is_local_html_output( wp_remote_retrieve_body( $response ) ) ) { $support_errors->add( 'bad_response_source', __( 'It looks like the response did not come from this site.' ) ); } } return $support_errors->errors; } /** * Checks whether a given HTML string is likely an output from this WordPress site. * * This function attempts to check for various common WordPress patterns whether they are included in the HTML string. * Since any of these actions may be disabled through third-party code, this function may also return null to indicate * that it was not possible to determine ownership. * * @since 5.7.0 * @access private * * @param string $html Full HTML output string, e.g. from a HTTP response. * @return bool|null True/false for whether HTML was generated by this site, null if unable to determine. */ function wp_is_local_html_output( $html ) { // 1. Check if HTML includes the site's Really Simple Discovery link. if ( has_action( 'wp_head', 'rsd_link' ) ) { $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( site_url( 'xmlrpc.php?rsd', 'rpc' ) ) ); // See rsd_link(). return str_contains( $html, $pattern ); } // 2. Check if HTML includes the site's REST API link. if ( has_action( 'wp_head', 'rest_output_link_wp_head' ) ) { // Try both HTTPS and HTTP since the URL depends on context. $pattern = preg_replace( '#^https?:(?=//)#', '', esc_url( get_rest_url() ) ); // See rest_output_link_wp_head(). return str_contains( $html, $pattern ); } // Otherwise the result cannot be determined. return null; } string.php 0000666 00000020233 15226557730 0006603 0 ustar 00 <?php /** * Parses unified or context diffs output from eg. the diff utility. * * Example: * <code> * $patch = file_get_contents('example.patch'); * $diff = new Text_Diff('string', array($patch)); * $renderer = new Text_Diff_Renderer_inline(); * echo $renderer->render($diff); * </code> * * Copyright 2005 Örjan Persson <o@42mm.org> * Copyright 2005-2010 The Horde Project (http://www.horde.org/) * * See the enclosed file COPYING for license information (LGPL). If you did * not receive this file, see https://opensource.org/license/lgpl-2-1/. * * @author Örjan Persson <o@42mm.org> * @package Text_Diff * @since 0.2.0 */ class Text_Diff_Engine_string { /** * Parses a unified or context diff. * * First param contains the whole diff and the second can be used to force * a specific diff type. If the second parameter is 'autodetect', the * diff will be examined to find out which type of diff this is. * * @param string $diff The diff content. * @param string $mode The diff mode of the content in $diff. One of * 'context', 'unified', or 'autodetect'. * * @return array List of all diff operations. */ function diff($diff, $mode = 'autodetect') { // Detect line breaks. $lnbr = "\n"; if (strpos($diff, "\r\n") !== false) { $lnbr = "\r\n"; } elseif (strpos($diff, "\r") !== false) { $lnbr = "\r"; } // Make sure we have a line break at the EOF. if (substr($diff, -strlen($lnbr)) != $lnbr) { $diff .= $lnbr; } if ($mode != 'autodetect' && $mode != 'context' && $mode != 'unified') { return PEAR::raiseError('Type of diff is unsupported'); } if ($mode == 'autodetect') { $context = strpos($diff, '***'); $unified = strpos($diff, '---'); if ($context === $unified) { return PEAR::raiseError('Type of diff could not be detected'); } elseif ($context === false || $unified === false) { $mode = $context !== false ? 'context' : 'unified'; } else { $mode = $context < $unified ? 'context' : 'unified'; } } // Split by new line and remove the diff header, if there is one. $diff = explode($lnbr, $diff); if (($mode == 'context' && strpos($diff[0], '***') === 0) || ($mode == 'unified' && strpos($diff[0], '---') === 0)) { array_shift($diff); array_shift($diff); } if ($mode == 'context') { return $this->parseContextDiff($diff); } else { return $this->parseUnifiedDiff($diff); } } /** * Parses an array containing the unified diff. * * @param array $diff Array of lines. * * @return array List of all diff operations. */ function parseUnifiedDiff($diff) { $edits = array(); $end = count($diff) - 1; for ($i = 0; $i < $end;) { $diff1 = array(); switch (substr($diff[$i], 0, 1)) { case ' ': do { $diff1[] = substr($diff[$i], 1); } while (++$i < $end && substr($diff[$i], 0, 1) == ' '); $edits[] = new Text_Diff_Op_copy($diff1); break; case '+': // get all new lines do { $diff1[] = substr($diff[$i], 1); } while (++$i < $end && substr($diff[$i], 0, 1) == '+'); $edits[] = new Text_Diff_Op_add($diff1); break; case '-': // get changed or removed lines $diff2 = array(); do { $diff1[] = substr($diff[$i], 1); } while (++$i < $end && substr($diff[$i], 0, 1) == '-'); while ($i < $end && substr($diff[$i], 0, 1) == '+') { $diff2[] = substr($diff[$i++], 1); } if (count($diff2) == 0) { $edits[] = new Text_Diff_Op_delete($diff1); } else { $edits[] = new Text_Diff_Op_change($diff1, $diff2); } break; default: $i++; break; } } return $edits; } /** * Parses an array containing the context diff. * * @param array $diff Array of lines. * * @return array List of all diff operations. */ function parseContextDiff(&$diff) { $edits = array(); $i = $max_i = $j = $max_j = 0; $end = count($diff) - 1; while ($i < $end && $j < $end) { while ($i >= $max_i && $j >= $max_j) { // Find the boundaries of the diff output of the two files for ($i = $j; $i < $end && substr($diff[$i], 0, 3) == '***'; $i++); for ($max_i = $i; $max_i < $end && substr($diff[$max_i], 0, 3) != '---'; $max_i++); for ($j = $max_i; $j < $end && substr($diff[$j], 0, 3) == '---'; $j++); for ($max_j = $j; $max_j < $end && substr($diff[$max_j], 0, 3) != '***'; $max_j++); } // find what hasn't been changed $array = array(); while ($i < $max_i && $j < $max_j && strcmp($diff[$i], $diff[$j]) == 0) { $array[] = substr($diff[$i], 2); $i++; $j++; } while ($i < $max_i && ($max_j-$j) <= 1) { if ($diff[$i] != '' && substr($diff[$i], 0, 1) != ' ') { break; } $array[] = substr($diff[$i++], 2); } while ($j < $max_j && ($max_i-$i) <= 1) { if ($diff[$j] != '' && substr($diff[$j], 0, 1) != ' ') { break; } $array[] = substr($diff[$j++], 2); } if (count($array) > 0) { $edits[] = new Text_Diff_Op_copy($array); } if ($i < $max_i) { $diff1 = array(); switch (substr($diff[$i], 0, 1)) { case '!': $diff2 = array(); do { $diff1[] = substr($diff[$i], 2); if ($j < $max_j && substr($diff[$j], 0, 1) == '!') { $diff2[] = substr($diff[$j++], 2); } } while (++$i < $max_i && substr($diff[$i], 0, 1) == '!'); $edits[] = new Text_Diff_Op_change($diff1, $diff2); break; case '+': do { $diff1[] = substr($diff[$i], 2); } while (++$i < $max_i && substr($diff[$i], 0, 1) == '+'); $edits[] = new Text_Diff_Op_add($diff1); break; case '-': do { $diff1[] = substr($diff[$i], 2); } while (++$i < $max_i && substr($diff[$i], 0, 1) == '-'); $edits[] = new Text_Diff_Op_delete($diff1); break; } } if ($j < $max_j) { $diff2 = array(); switch (substr($diff[$j], 0, 1)) { case '+': do { $diff2[] = substr($diff[$j++], 2); } while ($j < $max_j && substr($diff[$j], 0, 1) == '+'); $edits[] = new Text_Diff_Op_add($diff2); break; case '-': do { $diff2[] = substr($diff[$j++], 2); } while ($j < $max_j && substr($diff[$j], 0, 1) == '-'); $edits[] = new Text_Diff_Op_delete($diff2); break; } } } return $edits; } } class-wp-block-parser-block.php 0000666 00000004773 15226557730 0012513 0 ustar 00 <?php /** * Block Serialization Parser * * @package WordPress */ /** * Class WP_Block_Parser_Block * * Holds the block structure in memory * * @since 5.0.0 */ class WP_Block_Parser_Block { /** * Name of block * * @example "core/paragraph" * * @since 5.0.0 * @var string */ public $blockName; // phpcs:ignore WordPress.NamingConventions.ValidVariableName /** * Optional set of attributes from block comment delimiters * * @example null * @example array( 'columns' => 3 ) * * @since 5.0.0 * @var array|null */ public $attrs; /** * List of inner blocks (of this same class) * * @since 5.0.0 * @var WP_Block_Parser_Block[] */ public $innerBlocks; // phpcs:ignore WordPress.NamingConventions.ValidVariableName /** * Resultant HTML from inside block comment delimiters * after removing inner blocks * * @example "...Just <!-- wp:test /--> testing..." -> "Just testing..." * * @since 5.0.0 * @var string */ public $innerHTML; // phpcs:ignore WordPress.NamingConventions.ValidVariableName /** * List of string fragments and null markers where inner blocks were found * * @example array( * 'innerHTML' => 'BeforeInnerAfter', * 'innerBlocks' => array( block, block ), * 'innerContent' => array( 'Before', null, 'Inner', null, 'After' ), * ) * * @since 5.0.0 * @var array */ public $innerContent; // phpcs:ignore WordPress.NamingConventions.ValidVariableName /** * Constructor. * * Will populate object properties from the provided arguments. * * @since 5.0.0 * * @param string $name Name of block. * @param array $attrs Optional set of attributes from block comment delimiters. * @param array $inner_blocks List of inner blocks (of this same class). * @param string $inner_html Resultant HTML from inside block comment delimiters after removing inner blocks. * @param array $inner_content List of string fragments and null markers where inner blocks were found. */ public function __construct( $name, $attrs, $inner_blocks, $inner_html, $inner_content ) { $this->blockName = $name; // phpcs:ignore WordPress.NamingConventions.ValidVariableName $this->attrs = $attrs; $this->innerBlocks = $inner_blocks; // phpcs:ignore WordPress.NamingConventions.ValidVariableName $this->innerHTML = $inner_html; // phpcs:ignore WordPress.NamingConventions.ValidVariableName $this->innerContent = $inner_content; // phpcs:ignore WordPress.NamingConventions.ValidVariableName } } class-wp-user.php 0000666 00000055004 15226557730 0010006 0 ustar 00 <?php /** * User API: WP_User class * * @package WordPress * @subpackage Users * @since 4.4.0 */ /** * Core class used to implement the WP_User object. * * @since 2.0.0 * @since 6.8.0 The `user_pass` property is now hashed using bcrypt by default instead of phpass. * Existing passwords may still be hashed using phpass. * * @property string $nickname * @property string $description * @property string $user_description * @property string $first_name * @property string $user_firstname * @property string $last_name * @property string $user_lastname * @property string $user_login * @property string $user_pass * @property string $user_nicename * @property string $user_email * @property string $user_url * @property string $user_registered * @property string $user_activation_key * @property string $user_status * @property int $user_level * @property string $display_name * @property string $spam * @property string $deleted * @property string $locale * @property string $rich_editing * @property string $syntax_highlighting * @property string $use_ssl */ #[AllowDynamicProperties] class WP_User { /** * User data container. * * @since 2.0.0 * @var stdClass */ public $data; /** * The user's ID. * * @since 2.1.0 * @var int */ public $ID = 0; /** * Capabilities that the individual user has been granted outside of those inherited from their role. * * @since 2.0.0 * @var bool[] Array of key/value pairs where keys represent a capability name * and boolean values represent whether the user has that capability. */ public $caps = array(); /** * User metadata option name. * * @since 2.0.0 * @var string */ public $cap_key; /** * The roles the user is part of. * * @since 2.0.0 * @var string[] */ public $roles = array(); /** * All capabilities the user has, including individual and role based. * * @since 2.0.0 * @var bool[] Array of key/value pairs where keys represent a capability name * and boolean values represent whether the user has that capability. */ public $allcaps = array(); /** * The filter context applied to user data fields. * * @since 2.9.0 * @var string */ public $filter = null; /** * The site ID the capabilities of this user are initialized for. * * @since 4.9.0 * @var int */ private $site_id = 0; /** * @since 3.3.0 * @var array */ private static $back_compat_keys; /** * Constructor. * * Retrieves the userdata and passes it to WP_User::init(). * * @since 2.0.0 * * @global wpdb $wpdb WordPress database abstraction object. * * @param int|string|stdClass|WP_User $id User's ID, a WP_User object, or a user object from the DB. * @param string $name Optional. User's username * @param int $site_id Optional Site ID, defaults to current site. */ public function __construct( $id = 0, $name = '', $site_id = 0 ) { global $wpdb; if ( ! isset( self::$back_compat_keys ) ) { $prefix = $wpdb->prefix; self::$back_compat_keys = array( 'user_firstname' => 'first_name', 'user_lastname' => 'last_name', 'user_description' => 'description', 'user_level' => $prefix . 'user_level', $prefix . 'usersettings' => $prefix . 'user-settings', $prefix . 'usersettingstime' => $prefix . 'user-settings-time', ); } if ( $id instanceof WP_User ) { $this->init( $id->data, $site_id ); return; } elseif ( is_object( $id ) ) { $this->init( $id, $site_id ); return; } if ( ! empty( $id ) && ! is_numeric( $id ) ) { $name = $id; $id = 0; } if ( $id ) { $data = self::get_data_by( 'id', $id ); } else { $data = self::get_data_by( 'login', $name ); } if ( $data ) { $this->init( $data, $site_id ); } else { $this->data = new stdClass(); } } /** * Sets up object properties, including capabilities. * * @since 3.3.0 * * @param object $data User DB row object. * @param int $site_id Optional. The site ID to initialize for. */ public function init( $data, $site_id = 0 ) { if ( ! isset( $data->ID ) ) { $data->ID = 0; } $this->data = $data; $this->ID = (int) $data->ID; $this->for_site( $site_id ); } /** * Returns only the main user fields. * * @since 3.3.0 * @since 4.4.0 Added 'ID' as an alias of 'id' for the `$field` parameter. * * @global wpdb $wpdb WordPress database abstraction object. * * @param string $field The field to query against: Accepts 'id', 'ID', 'slug', 'email' or 'login'. * @param string|int $value The field value. * @return object|false Raw user object. */ public static function get_data_by( $field, $value ) { global $wpdb; // 'ID' is an alias of 'id'. if ( 'ID' === $field ) { $field = 'id'; } if ( 'id' === $field ) { // Make sure the value is numeric to avoid casting objects, for example, to int 1. if ( ! is_numeric( $value ) ) { return false; } $value = (int) $value; if ( $value < 1 ) { return false; } } else { $value = trim( $value ); } if ( ! $value ) { return false; } switch ( $field ) { case 'id': $user_id = $value; $db_field = 'ID'; break; case 'slug': $user_id = wp_cache_get( $value, 'userslugs' ); $db_field = 'user_nicename'; break; case 'email': $user_id = wp_cache_get( $value, 'useremail' ); $db_field = 'user_email'; break; case 'login': $value = sanitize_user( $value ); $user_id = wp_cache_get( $value, 'userlogins' ); $db_field = 'user_login'; break; default: return false; } if ( false !== $user_id ) { $user = wp_cache_get( $user_id, 'users' ); if ( $user ) { return $user; } } $user = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->users WHERE $db_field = %s LIMIT 1", $value ) ); if ( ! $user ) { return false; } update_user_caches( $user ); return $user; } /** * Magic method for checking the existence of a certain custom field. * * @since 3.3.0 * * @param string $key User meta key to check if set. * @return bool Whether the given user meta key is set. */ public function __isset( $key ) { if ( 'id' === $key ) { _deprecated_argument( 'WP_User->id', '2.1.0', sprintf( /* translators: %s: WP_User->ID */ __( 'Use %s instead.' ), '<code>WP_User->ID</code>' ) ); $key = 'ID'; } if ( isset( $this->data->$key ) ) { return true; } if ( isset( self::$back_compat_keys[ $key ] ) ) { $key = self::$back_compat_keys[ $key ]; } return metadata_exists( 'user', $this->ID, $key ); } /** * Magic method for accessing custom fields. * * @since 3.3.0 * * @param string $key User meta key to retrieve. * @return mixed Value of the given user meta key (if set). If `$key` is 'id', the user ID. */ public function __get( $key ) { if ( 'id' === $key ) { _deprecated_argument( 'WP_User->id', '2.1.0', sprintf( /* translators: %s: WP_User->ID */ __( 'Use %s instead.' ), '<code>WP_User->ID</code>' ) ); return $this->ID; } if ( isset( $this->data->$key ) ) { $value = $this->data->$key; } else { if ( isset( self::$back_compat_keys[ $key ] ) ) { $key = self::$back_compat_keys[ $key ]; } $value = get_user_meta( $this->ID, $key, true ); } if ( $this->filter ) { $value = sanitize_user_field( $key, $value, $this->ID, $this->filter ); } return $value; } /** * Magic method for setting custom user fields. * * This method does not update custom fields in the database. It only stores * the value on the WP_User instance. * * @since 3.3.0 * * @param string $key User meta key. * @param mixed $value User meta value. */ public function __set( $key, $value ) { if ( 'id' === $key ) { _deprecated_argument( 'WP_User->id', '2.1.0', sprintf( /* translators: %s: WP_User->ID */ __( 'Use %s instead.' ), '<code>WP_User->ID</code>' ) ); $this->ID = $value; return; } $this->data->$key = $value; } /** * Magic method for unsetting a certain custom field. * * @since 4.4.0 * * @param string $key User meta key to unset. */ public function __unset( $key ) { if ( 'id' === $key ) { _deprecated_argument( 'WP_User->id', '2.1.0', sprintf( /* translators: %s: WP_User->ID */ __( 'Use %s instead.' ), '<code>WP_User->ID</code>' ) ); } if ( isset( $this->data->$key ) ) { unset( $this->data->$key ); } if ( isset( self::$back_compat_keys[ $key ] ) ) { unset( self::$back_compat_keys[ $key ] ); } } /** * Determines whether the user exists in the database. * * @since 3.4.0 * * @return bool True if user exists in the database, false if not. */ public function exists() { return ! empty( $this->ID ); } /** * Retrieves the value of a property or meta key. * * Retrieves from the users and usermeta table. * * @since 3.3.0 * * @param string $key Property * @return mixed */ public function get( $key ) { return $this->__get( $key ); } /** * Determines whether a property or meta key is set. * * Consults the users and usermeta tables. * * @since 3.3.0 * * @param string $key Property. * @return bool */ public function has_prop( $key ) { return $this->__isset( $key ); } /** * Returns an array representation. * * @since 3.5.0 * * @return array Array representation. */ public function to_array() { return get_object_vars( $this->data ); } /** * Makes private/protected methods readable for backward compatibility. * * @since 4.3.0 * * @param string $name Method to call. * @param array $arguments Arguments to pass when calling. * @return mixed|false Return value of the callback, false otherwise. */ public function __call( $name, $arguments ) { if ( '_init_caps' === $name ) { return $this->_init_caps( ...$arguments ); } return false; } /** * Sets up capability object properties. * * Will set the value for the 'cap_key' property to current database table * prefix, followed by 'capabilities'. Will then check to see if the * property matching the 'cap_key' exists and is an array. If so, it will be * used. * * @since 2.1.0 * @deprecated 4.9.0 Use WP_User::for_site() * * @global wpdb $wpdb WordPress database abstraction object. * * @param string $cap_key Optional capability key */ protected function _init_caps( $cap_key = '' ) { global $wpdb; _deprecated_function( __METHOD__, '4.9.0', 'WP_User::for_site()' ); if ( empty( $cap_key ) ) { $this->cap_key = $wpdb->get_blog_prefix( $this->site_id ) . 'capabilities'; } else { $this->cap_key = $cap_key; } $this->caps = $this->get_caps_data(); $this->get_role_caps(); } /** * Retrieves all of the capabilities of the user's roles, and merges them with * individual user capabilities. * * All of the capabilities of the user's roles are merged with the user's individual * capabilities. This means that the user can be denied specific capabilities that * their role might have, but the user is specifically denied. * * @since 2.0.0 * * @return bool[] Array of key/value pairs where keys represent a capability name * and boolean values represent whether the user has that capability. */ public function get_role_caps() { $switch_site = false; if ( is_multisite() && get_current_blog_id() !== $this->site_id ) { $switch_site = true; switch_to_blog( $this->site_id ); } $wp_roles = wp_roles(); // Select caps that are role names and assign to $this->roles. if ( is_array( $this->caps ) ) { $this->roles = array(); foreach ( $this->caps as $key => $value ) { if ( $wp_roles->is_role( $key ) ) { $this->roles[] = $key; } } } // Build $allcaps from role caps, overlay user's $caps. $this->allcaps = array(); foreach ( (array) $this->roles as $role ) { $the_role = $wp_roles->get_role( $role ); $this->allcaps = array_merge( (array) $this->allcaps, (array) $the_role->capabilities ); } $this->allcaps = array_merge( (array) $this->allcaps, (array) $this->caps ); if ( $switch_site ) { restore_current_blog(); } return $this->allcaps; } /** * Adds role to user. * * Updates the user's meta data option with capabilities and roles. * * @since 2.0.0 * * @param string $role Role name. */ public function add_role( $role ) { if ( empty( $role ) ) { return; } if ( in_array( $role, $this->roles, true ) ) { return; } $this->caps[ $role ] = true; update_user_meta( $this->ID, $this->cap_key, $this->caps ); $this->get_role_caps(); $this->update_user_level_from_caps(); /** * Fires immediately after the user has been given a new role. * * @since 4.3.0 * * @param int $user_id The user ID. * @param string $role The new role. */ do_action( 'add_user_role', $this->ID, $role ); } /** * Removes role from user. * * @since 2.0.0 * * @param string $role Role name. */ public function remove_role( $role ) { if ( ! in_array( $role, $this->roles, true ) ) { return; } unset( $this->caps[ $role ] ); update_user_meta( $this->ID, $this->cap_key, $this->caps ); $this->get_role_caps(); $this->update_user_level_from_caps(); /** * Fires immediately after a role as been removed from a user. * * @since 4.3.0 * * @param int $user_id The user ID. * @param string $role The removed role. */ do_action( 'remove_user_role', $this->ID, $role ); } /** * Sets the role of the user. * * This will remove the previous roles of the user and assign the user the * new one. You can set the role to an empty string and it will remove all * of the roles from the user. * * @since 2.0.0 * * @param string $role Role name. */ public function set_role( $role ) { if ( 1 === count( $this->roles ) && current( $this->roles ) === $role ) { return; } foreach ( (array) $this->roles as $oldrole ) { unset( $this->caps[ $oldrole ] ); } $old_roles = $this->roles; if ( ! empty( $role ) ) { $this->caps[ $role ] = true; $this->roles = array( $role => true ); } else { $this->roles = array(); } update_user_meta( $this->ID, $this->cap_key, $this->caps ); $this->get_role_caps(); $this->update_user_level_from_caps(); foreach ( $old_roles as $old_role ) { if ( ! $old_role || $old_role === $role ) { continue; } /** This action is documented in wp-includes/class-wp-user.php */ do_action( 'remove_user_role', $this->ID, $old_role ); } if ( $role && ! in_array( $role, $old_roles, true ) ) { /** This action is documented in wp-includes/class-wp-user.php */ do_action( 'add_user_role', $this->ID, $role ); } /** * Fires after the user's role has changed. * * @since 2.9.0 * @since 3.6.0 Added $old_roles to include an array of the user's previous roles. * * @param int $user_id The user ID. * @param string $role The new role. * @param string[] $old_roles An array of the user's previous roles. */ do_action( 'set_user_role', $this->ID, $role, $old_roles ); } /** * Chooses the maximum level the user has. * * Will compare the level from the $item parameter against the $max * parameter. If the item is incorrect, then just the $max parameter value * will be returned. * * Used to get the max level based on the capabilities the user has. This * is also based on roles, so if the user is assigned the Administrator role * then the capability 'level_10' will exist and the user will get that * value. * * @since 2.0.0 * * @param int $max Max level of user. * @param string $item Level capability name. * @return int Max Level. */ public function level_reduction( $max, $item ) { if ( preg_match( '/^level_(10|[0-9])$/i', $item, $matches ) ) { $level = (int) $matches[1]; return max( $max, $level ); } else { return $max; } } /** * Updates the maximum user level for the user. * * Updates the 'user_level' user metadata (includes prefix that is the * database table prefix) with the maximum user level. Gets the value from * the all of the capabilities that the user has. * * @since 2.0.0 * * @global wpdb $wpdb WordPress database abstraction object. */ public function update_user_level_from_caps() { global $wpdb; $this->user_level = array_reduce( array_keys( $this->allcaps ), array( $this, 'level_reduction' ), 0 ); update_user_meta( $this->ID, $wpdb->get_blog_prefix() . 'user_level', $this->user_level ); } /** * Adds capability and grant or deny access to capability. * * @since 2.0.0 * * @param string $cap Capability name. * @param bool $grant Whether to grant capability to user. */ public function add_cap( $cap, $grant = true ) { $this->caps[ $cap ] = $grant; update_user_meta( $this->ID, $this->cap_key, $this->caps ); $this->get_role_caps(); $this->update_user_level_from_caps(); } /** * Removes capability from user. * * @since 2.0.0 * * @param string $cap Capability name. */ public function remove_cap( $cap ) { if ( ! isset( $this->caps[ $cap ] ) ) { return; } unset( $this->caps[ $cap ] ); update_user_meta( $this->ID, $this->cap_key, $this->caps ); $this->get_role_caps(); $this->update_user_level_from_caps(); } /** * Removes all of the capabilities of the user. * * @since 2.1.0 * * @global wpdb $wpdb WordPress database abstraction object. */ public function remove_all_caps() { global $wpdb; $this->caps = array(); delete_user_meta( $this->ID, $this->cap_key ); delete_user_meta( $this->ID, $wpdb->get_blog_prefix() . 'user_level' ); $this->get_role_caps(); } /** * Returns whether the user has the specified capability. * * This function also accepts an ID of an object to check against if the capability is a meta capability. Meta * capabilities such as `edit_post` and `edit_user` are capabilities used by the `map_meta_cap()` function to * map to primitive capabilities that a user or role has, such as `edit_posts` and `edit_others_posts`. * * Example usage: * * $user->has_cap( 'edit_posts' ); * $user->has_cap( 'edit_post', $post->ID ); * $user->has_cap( 'edit_post_meta', $post->ID, $meta_key ); * * While checking against a role in place of a capability is supported in part, this practice is discouraged as it * may produce unreliable results. * * @since 2.0.0 * @since 5.3.0 Formalized the existing and already documented `...$args` parameter * by adding it to the function signature. * * @see map_meta_cap() * * @param string $cap Capability name. * @param mixed ...$args Optional further parameters, typically starting with an object ID. * @return bool Whether the user has the given capability, or, if an object ID is passed, whether the user has * the given capability for that object. */ public function has_cap( $cap, ...$args ) { if ( is_numeric( $cap ) ) { _deprecated_argument( __FUNCTION__, '2.0.0', __( 'Usage of user levels is deprecated. Use capabilities instead.' ) ); $cap = $this->translate_level_to_cap( $cap ); } $caps = map_meta_cap( $cap, $this->ID, ...$args ); // Multisite super admin has all caps by definition, Unless specifically denied. if ( is_multisite() && is_super_admin( $this->ID ) ) { if ( in_array( 'do_not_allow', $caps, true ) ) { return false; } return true; } // Maintain BC for the argument passed to the "user_has_cap" filter. $args = array_merge( array( $cap, $this->ID ), $args ); /** * Dynamically filter a user's capabilities. * * @since 2.0.0 * @since 3.7.0 Added the `$user` parameter. * * @param bool[] $allcaps Array of key/value pairs where keys represent a capability name * and boolean values represent whether the user has that capability. * @param string[] $caps Required primitive capabilities for the requested capability. * @param array $args { * Arguments that accompany the requested capability check. * * @type string $0 Requested capability. * @type int $1 Concerned user ID. * @type mixed ...$2 Optional second and further parameters, typically object ID. * } * @param WP_User $user The user object. */ $capabilities = apply_filters( 'user_has_cap', $this->allcaps, $caps, $args, $this ); // Everyone is allowed to exist. $capabilities['exist'] = true; // Nobody is allowed to do things they are not allowed to do. unset( $capabilities['do_not_allow'] ); // Must have ALL requested caps. foreach ( (array) $caps as $cap ) { if ( empty( $capabilities[ $cap ] ) ) { return false; } } return true; } /** * Converts numeric level to level capability name. * * Prepends 'level_' to level number. * * @since 2.0.0 * * @param int $level Level number, 1 to 10. * @return string */ public function translate_level_to_cap( $level ) { return 'level_' . $level; } /** * Sets the site to operate on. Defaults to the current site. * * @since 3.0.0 * @deprecated 4.9.0 Use WP_User::for_site() * * @param int $blog_id Optional. Site ID, defaults to current site. */ public function for_blog( $blog_id = 0 ) { _deprecated_function( __METHOD__, '4.9.0', 'WP_User::for_site()' ); $this->for_site( $blog_id ); } /** * Sets the site to operate on. Defaults to the current site. * * @since 4.9.0 * * @global wpdb $wpdb WordPress database abstraction object. * * @param int $site_id Site ID to initialize user capabilities for. Default is the current site. */ public function for_site( $site_id = 0 ) { global $wpdb; if ( ! empty( $site_id ) ) { $this->site_id = absint( $site_id ); } else { $this->site_id = get_current_blog_id(); } $this->cap_key = $wpdb->get_blog_prefix( $this->site_id ) . 'capabilities'; $this->caps = $this->get_caps_data(); $this->get_role_caps(); } /** * Gets the ID of the site for which the user's capabilities are currently initialized. * * @since 4.9.0 * * @return int Site ID. */ public function get_site_id() { return $this->site_id; } /** * Gets the available user capabilities data. * * @since 4.9.0 * * @return bool[] List of capabilities keyed by the capability name, * e.g. `array( 'edit_posts' => true, 'delete_posts' => false )`. */ private function get_caps_data() { $caps = get_user_meta( $this->ID, $this->cap_key, true ); if ( ! is_array( $caps ) ) { return array(); } return $caps; } }
./Ninja\.