Merge branch 'trunk' into fix/phpstan-callbacks

Author: westonruter

composer.json

@@ -58,6 +58,11 @@
 	},
 	"config": {
 		"audit": { "ignore": [ "GHSA-hmqg-cxww-wqhq", "PKSA-rdkp-vv9z-mjkg" ] },
+		"policy": {
+			"advisories": {
+				"ignore-id": [ "GHSA-hmqg-cxww-wqhq", "PKSA-rdkp-vv9z-mjkg" ]
+			}
+		},
 		"allow-plugins": {
 			"dealerdirect/phpcodesniffer-composer-installer": true
 		},

package.json

@@ -7,7 +7,7 @@
 		"url": "https://develop.svn.wordpress.org/trunk"
 	},
 	"gutenberg": {
-		"sha": "5715a61334c4d29f21b67cf34b46061dc1b62502",
+		"sha": "50ad79ef7ebc5f1d2a75def068887e33a15f2634",
 		"ghcrRepo": "WordPress/gutenberg/gutenberg-wp-develop-build"
 	},
 	"engines": {

src/js/_enqueues/admin/common.js

@@ -692,7 +692,7 @@ $('.contextual-help-tabs').on( 'click', 'a', function(e) {
 	$('.contextual-help-tabs .active').removeClass('active');
 	link.parent('li').addClass('active');
 
-	panel = $( link.attr('href') );
+	panel = $( document ).find( link.attr('href') );
 
 	// Panels.
 	$('.help-tab-content').not( panel ).removeClass('active').hide();

src/wp-admin/admin-header.php

@@ -95,6 +95,10 @@
 <title><?php echo esc_html( $admin_title ); ?></title>
 <?php
 
+/*
+ * The dependencies of `colors` and the `utils` script are prefetched from the login screen by
+ * wp_prefetch_admin_assets(), which needs updating if these change.
+ */
 wp_enqueue_style( 'colors' );
 wp_enqueue_script( 'utils' );
 wp_enqueue_script( 'svg-painter' );

src/wp-admin/admin.php

@@ -118,6 +118,10 @@
 $date_format = __( 'F j, Y' );
 $time_format = __( 'g:i a' );
 
+/*
+ * The `jquery` dependency of this script is prefetched from the login screen by
+ * wp_prefetch_admin_assets(), which needs updating if this changes.
+ */
 wp_enqueue_script( 'common' );
 
 /**

src/wp-admin/css/install.css

@@ -397,8 +397,8 @@ body.language-chooser {
 	margin-right: 15px;
 }
 
-.button.hide-if-no-js,
-.hide-if-no-js {
+.hide-if-no-js,
+.button.wp-hide-pw.user-new-password-toggle.hide-if-no-js {
 	display: none;
 }
 

src/wp-admin/edit-form-blocks.php

@@ -342,6 +342,7 @@ static function ( $classes ) {
 /**
  * Styles
  */
+// Prefetched for the block editor by wp_prefetch_admin_assets(), which needs updating if this changes.
 wp_enqueue_style( 'wp-edit-post' );
 
 /**

src/wp-admin/includes/admin-filters.php

@@ -48,6 +48,7 @@
 add_action( 'admin_head', 'wp_admin_canonical_url' );
 add_action( 'admin_head', 'wp_site_icon' );
 add_action( 'admin_head', 'wp_admin_viewport_meta' );
+add_action( 'admin_head', 'wp_prefetch_admin_assets' );
 add_action( 'customize_controls_head', 'wp_admin_viewport_meta' );
 add_filter( 'nav_menu_meta_box_object', '_wp_nav_menu_meta_box_object' );
 

src/wp-admin/includes/export.php

@@ -183,11 +183,15 @@ function export_wp( $args = array() ) {
 				)
 			);
 
+			// Cast thumbnail IDs to integers to prevent second-order SQL injection via user-controlled meta values.
+			$thumbnails_ids = array_filter( array_map( 'absint', $thumbnails_ids ) );
+
 			$additional_ids = array_merge( $additional_ids, $attachment_ids, $thumbnails_ids );
 		}
 
-		// Merge the additional IDs back with the original post IDs after processing all posts
-		$post_ids = array_unique( array_merge( $post_ids, $additional_ids ) );
+		// Merge the additional IDs back with the original post IDs after processing all posts.
+		// Cast to integers as defense-in-depth, since $additional_ids may include values sourced from postmeta.
+		$post_ids = array_unique( array_map( 'absint', array_merge( $post_ids, $additional_ids ) ) );
 	}
 
 	/*
@@ -597,8 +601,10 @@ function wxr_filter_postmeta( $return_me, $meta_key ) {
 
 		// Fetch 20 posts at a time rather than loading the entire table into memory.
 		while ( $next_posts = array_splice( $post_ids, 0, 20 ) ) {
-			$where = 'WHERE ID IN (' . implode( ',', $next_posts ) . ')';
-			$posts = $wpdb->get_results( "SELECT * FROM {$wpdb->posts} $where" );
+			// Re-sanitize immediately before use, as defense-in-depth against the IDs being interpolated directly into SQL below.
+			$next_posts = array_map( 'absint', $next_posts );
+			$where      = 'WHERE ID IN (' . implode( ',', $next_posts ) . ')';
+			$posts      = $wpdb->get_results( "SELECT * FROM {$wpdb->posts} $where" );
 
 			// Begin Loop.
 			foreach ( $posts as $post ) {

src/wp-admin/includes/meta-boxes.php

@@ -1257,6 +1257,8 @@ function link_target_meta_box( $link ) {
  *                                 if it matches the current link's relationship.
  *                                 Default empty string.
  * @param mixed  $deprecated       Deprecated. Not used.
+ *
+ * @phpstan-param '' $deprecated
  */
 function xfn_check( $xfn_relationship, $xfn_value = '', $deprecated = '' ) {
 	global $link;