Merge branch 'trunk' into 66254-sync-gutenberg-24.1

Author: peterwilsoncc

src/js/_enqueues/admin/common.js

@@ -692,7 +692,7 @@ $('.contextual-help-tabs').on( 'click', 'a', function(e) {
 	$('.contextual-help-tabs .active').removeClass('active');
 	link.parent('li').addClass('active');
 
-	panel = $( link.attr('href') );
+	panel = $( document ).find( link.attr('href') );
 
 	// Panels.
 	$('.help-tab-content').not( panel ).removeClass('active').hide();

src/wp-admin/includes/export.php

@@ -183,11 +183,15 @@ function export_wp( $args = array() ) {
 				)
 			);
 
+			// Cast thumbnail IDs to integers to prevent second-order SQL injection via user-controlled meta values.
+			$thumbnails_ids = array_filter( array_map( 'absint', $thumbnails_ids ) );
+
 			$additional_ids = array_merge( $additional_ids, $attachment_ids, $thumbnails_ids );
 		}
 
-		// Merge the additional IDs back with the original post IDs after processing all posts
-		$post_ids = array_unique( array_merge( $post_ids, $additional_ids ) );
+		// Merge the additional IDs back with the original post IDs after processing all posts.
+		// Cast to integers as defense-in-depth, since $additional_ids may include values sourced from postmeta.
+		$post_ids = array_unique( array_map( 'absint', array_merge( $post_ids, $additional_ids ) ) );
 	}
 
 	/*
@@ -597,8 +601,10 @@ function wxr_filter_postmeta( $return_me, $meta_key ) {
 
 		// Fetch 20 posts at a time rather than loading the entire table into memory.
 		while ( $next_posts = array_splice( $post_ids, 0, 20 ) ) {
-			$where = 'WHERE ID IN (' . implode( ',', $next_posts ) . ')';
-			$posts = $wpdb->get_results( "SELECT * FROM {$wpdb->posts} $where" );
+			// Re-sanitize immediately before use, as defense-in-depth against the IDs being interpolated directly into SQL below.
+			$next_posts = array_map( 'absint', $next_posts );
+			$where      = 'WHERE ID IN (' . implode( ',', $next_posts ) . ')';
+			$posts      = $wpdb->get_results( "SELECT * FROM {$wpdb->posts} $where" );
 
 			// Begin Loop.
 			foreach ( $posts as $post ) {

src/wp-admin/includes/meta-boxes.php

@@ -1257,6 +1257,8 @@ function link_target_meta_box( $link ) {
  *                                 if it matches the current link's relationship.
  *                                 Default empty string.
  * @param mixed  $deprecated       Deprecated. Not used.
+ *
+ * @phpstan-param '' $deprecated
  */
 function xfn_check( $xfn_relationship, $xfn_value = '', $deprecated = '' ) {
 	global $link;

src/wp-admin/includes/plugin-install.php

@@ -309,6 +309,8 @@ function install_dashboard() {
  * @since 4.6.0 The `$type_selector` parameter was deprecated.
  *
  * @param bool $deprecated Not used.
+ *
+ * @phpstan-param true $deprecated
  */
 function install_search_form( $deprecated = true ) {
 	$type = isset( $_REQUEST['type'] ) ? wp_unslash( $_REQUEST['type'] ) : 'term';

src/wp-admin/includes/plugin.php

@@ -907,6 +907,7 @@ function activate_plugins( $plugins, $redirect = '', $network_wide = false, $sil
  * @return bool|null|WP_Error True on success, false if `$plugins` is empty, `WP_Error` on failure.
  *                            `null` if filesystem credentials are required to proceed.
  *
+ * @phpstan-param '' $deprecated
  * @phpstan-return ( $plugins is empty ? false : true|null|WP_Error )
  */
 function delete_plugins( $plugins, $deprecated = '' ) {

src/wp-admin/includes/template.php

@@ -2143,6 +2143,8 @@ function _admin_search_query() {
  *
  * @param string $title      Optional. Title of the Iframe page. Default empty.
  * @param bool   $deprecated Not used.
+ *
+ * @phpstan-param false $deprecated
  */
 function iframe_header( $title = '', $deprecated = false ) {
 	global $hook_suffix, $admin_body_class, $body_id, $wp_locale;

src/wp-admin/includes/upgrade.php

@@ -43,6 +43,8 @@
 	 *     @type string $password         The password of the site owner, if their user account didn't already exist.
 	 *     @type string $password_message The explanatory message regarding the password.
 	 * }
+	 *
+	 * @phpstan-param '' $deprecated
 	 */
 	function wp_install(
 		$blog_title,

src/wp-includes/author-template.php

@@ -20,6 +20,8 @@
  *
  * @param string $deprecated Deprecated.
  * @return string The author's display name, empty string if unknown.
+ *
+ * @phpstan-param '' $deprecated
  */
 function get_the_author( $deprecated = '' ) {
 	global $authordata;
@@ -57,6 +59,9 @@ function get_the_author( $deprecated = '' ) {
  * @param string $deprecated      Deprecated.
  * @param bool   $deprecated_echo Deprecated. Use get_the_author(). Echo the string or return it.
  * @return string The author's display name, from get_the_author().
+ *
+ * @phpstan-param '' $deprecated
+ * @phpstan-param true $deprecated_echo
  */
 function the_author( $deprecated = '', $deprecated_echo = true ) {
 	if ( ! empty( $deprecated ) ) {
@@ -362,6 +367,8 @@ function get_the_author_posts_link() {
  * @since 4.4.0 Converted into a wrapper for get_the_author_posts_link()
  *
  * @param string $deprecated Unused.
+ *
+ * @phpstan-param '' $deprecated
  */
 function the_author_posts_link( $deprecated = '' ) {
 	if ( ! empty( $deprecated ) ) {

src/wp-includes/block-patterns.php

@@ -277,6 +277,8 @@ function wp_normalize_remote_block_pattern( $pattern ) {
  * @since 6.3.0 Add 'pattern-directory/core' to the pattern's 'source'.
  *
  * @param WP_Screen $deprecated Unused. Formerly the screen that the current request was triggered from.
+ *
+ * @phpstan-param null $deprecated
  */
 function _load_remote_block_patterns( $deprecated = null ) {
 	if ( ! empty( $deprecated ) ) {

src/wp-includes/block-supports/typography.php

@@ -573,9 +573,11 @@ function wp_get_computed_fluid_typography_value( $args = array() ) {
  *     @type string           $slug Kebab-case, unique identifier for the font size preset.
  *     @type string|int|float $size CSS font-size value, including units if applicable.
  * }
- * @param bool|array $settings Optional Theme JSON settings array that overrides any global theme settings.
- *                             Default is false.
+ * @param bool|array $settings Optional. Theme JSON settings array that overrides any global theme settings.
+ *                             Passing a boolean is deprecated. Default empty array.
  * @return string|null Font-size value or null if a size is not passed in $preset.
+ *
+ * @phpstan-param array $settings
  */
 function wp_get_typography_font_size_value( $preset, $settings = array() ) {
 	if ( ! isset( $preset['size'] ) ) {