Merge branch 'trunk' into 62622-php-74

johnbillion · johnbillion · commit 696f180cae35 · 2025-07-06T16:41:51.000+01:00
diff --git a/src/wp-admin/includes/class-wp-screen.php b/src/wp-admin/includes/class-wp-screen.php
@@ -986,6 +986,8 @@ public function render_screen_meta() {
 	/**
 	 * @global array $wp_meta_boxes Global meta box state.
 	 *
+	 * @since 3.3.0
+	 *
 	 * @return bool
 	 */
 	public function show_screen_options() {
diff --git a/src/wp-admin/includes/comment.php b/src/wp-admin/includes/comment.php
@@ -210,6 +210,8 @@ function enqueue_comment_hotkeys_js() {
 /**
  * Displays error message at bottom of comments.
  *
+ * @since 2.5.0
+ *
  * @param string $msg Error Message. Assumed to contain HTML and be sanitized.
  */
 function comment_footer_die( $msg ) {
diff --git a/src/wp-admin/includes/misc.php b/src/wp-admin/includes/misc.php
@@ -1059,6 +1059,8 @@ function admin_color_scheme_picker( $user_id ) {
 /**
  *
  * @global array $_wp_admin_css_colors
+ *
+ * @since 3.8.0
  */
 function wp_color_scheme_settings() {
 	global $_wp_admin_css_colors;
diff --git a/src/wp-admin/includes/ms.php b/src/wp-admin/includes/ms.php
@@ -854,6 +854,8 @@ function _thickbox_path_admin_subfolder() {
 }
 
 /**
+ * @since 3.0.0
+ *
  * @param array $users
  * @return bool
  */
diff --git a/src/wp-admin/includes/template.php b/src/wp-admin/includes/template.php
@@ -2632,6 +2632,8 @@ function get_submit_button( $text = '', $type = 'primary large', $name = 'submit
  * Prints out the beginning of the admin HTML header.
  *
  * @global bool $is_IE
+ *
+ * @since 3.3.0
  */
 function _wp_admin_html_begin() {
 	global $is_IE;
diff --git a/src/wp-content/themes/twentytwenty/functions.php b/src/wp-content/themes/twentytwenty/functions.php
@@ -361,7 +361,11 @@ function twentytwenty_get_custom_logo( $html ) {
 	 * @since Twenty Twenty 1.0
 	 */
 	function wp_body_open() {
-		/** This action is documented in wp-includes/general-template.php */
+		/**
+		 * Triggered after the opening <body> tag.
+		 *
+		 * @since Twenty Twenty 1.0
+		 */
 		do_action( 'wp_body_open' );
 	}
 }
diff --git a/src/wp-includes/class-wp-customize-manager.php b/src/wp-includes/class-wp-customize-manager.php
@@ -3165,27 +3165,25 @@ public function handle_changeset_trash_request() {
 			return;
 		}
 
-		if ( $changeset_post_id ) {
-			if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->delete_post, $changeset_post_id ) ) {
-				wp_send_json_error(
-					array(
-						'code'    => 'changeset_trash_unauthorized',
-						'message' => __( 'Unable to trash changes.' ),
-					)
-				);
-			}
+		if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->delete_post, $changeset_post_id ) ) {
+			wp_send_json_error(
+				array(
+					'code'    => 'changeset_trash_unauthorized',
+					'message' => __( 'Unable to trash changes.' ),
+				)
+			);
+		}
 
-			$lock_user = (int) wp_check_post_lock( $changeset_post_id );
+		$lock_user = (int) wp_check_post_lock( $changeset_post_id );
 
-			if ( $lock_user && get_current_user_id() !== $lock_user ) {
-				wp_send_json_error(
-					array(
-						'code'     => 'changeset_locked',
-						'message'  => __( 'Changeset is being edited by other user.' ),
-						'lockUser' => $this->get_lock_user_data( $lock_user ),
-					)
-				);
-			}
+		if ( $lock_user && get_current_user_id() !== $lock_user ) {
+			wp_send_json_error(
+				array(
+					'code'     => 'changeset_locked',
+					'message'  => __( 'Changeset is being edited by other user.' ),
+					'lockUser' => $this->get_lock_user_data( $lock_user ),
+				)
+			);
 		}
 
 		if ( 'trash' === get_post_status( $changeset_post_id ) ) {
diff --git a/src/wp-includes/class-wp-theme-json.php b/src/wp-includes/class-wp-theme-json.php
@@ -2781,6 +2781,7 @@ private static function get_block_nodes( $theme_json, $selectors = array(), $opt
 			if ( isset( $theme_json['styles']['blocks'][ $name ]['elements'] ) ) {
 				foreach ( $theme_json['styles']['blocks'][ $name ]['elements'] as $element => $node ) {
 					$node_path = array( 'styles', 'blocks', $name, 'elements', $element );
+
 					if ( $include_node_paths_only ) {
 						$nodes[] = array(
 							'path' => $node_path,
@@ -2798,12 +2799,6 @@ private static function get_block_nodes( $theme_json, $selectors = array(), $opt
 						foreach ( static::VALID_ELEMENT_PSEUDO_SELECTORS[ $element ] as $pseudo_selector ) {
 							if ( isset( $theme_json['styles']['blocks'][ $name ]['elements'][ $element ][ $pseudo_selector ] ) ) {
 								$node_path = array( 'styles', 'blocks', $name, 'elements', $element );
-								if ( $include_node_paths_only ) {
-									$nodes[] = array(
-										'path' => $node_path,
-									);
-									continue;
-								}
 
 								$nodes[] = array(
 									'path'     => $node_path,
diff --git a/src/wp-includes/class-wp-user-meta-session-tokens.php b/src/wp-includes/class-wp-user-meta-session-tokens.php
@@ -37,6 +37,8 @@ protected function get_sessions() {
 	/**
 	 * Converts an expiration to an array of session information.
 	 *
+	 * @since 4.0.0
+	 *
 	 * @param mixed $session Session or expiration.
 	 * @return array Session.
 	 */
diff --git a/src/wp-includes/comment-template.php b/src/wp-includes/comment-template.php
@@ -834,12 +834,8 @@ function get_comment_link( $comment = null, $args = array() ) {
 
 	if ( $cpage && get_option( 'page_comments' ) ) {
 		if ( $wp_rewrite->using_permalinks() ) {
-			if ( $cpage ) {
-				$comment_link = trailingslashit( $comment_link ) . $wp_rewrite->comments_pagination_base . '-' . $cpage;
-			}
-
-			$comment_link = user_trailingslashit( $comment_link, 'comment' );
-		} elseif ( $cpage ) {
+			$comment_link = trailingslashit( $comment_link ) . $wp_rewrite->comments_pagination_base . '-' . $cpage;
+		} else {
 			$comment_link = add_query_arg( 'cpage', $cpage, $comment_link );
 		}
 	}
diff --git a/src/wp-includes/comment.php b/src/wp-includes/comment.php
@@ -3060,22 +3060,19 @@ function do_trackbacks( $post ) {
 	$post_title = apply_filters( 'the_title', $post->post_title, $post->ID );
 	$post_title = strip_tags( $post_title );
 
-	if ( $to_ping ) {
-		foreach ( (array) $to_ping as $tb_ping ) {
-			$tb_ping = trim( $tb_ping );
-			if ( ! in_array( $tb_ping, $pinged, true ) ) {
-				trackback( $tb_ping, $post_title, $excerpt, $post->ID );
-				$pinged[] = $tb_ping;
-			} else {
-				$wpdb->query(
-					$wpdb->prepare(
-						"UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, %s,
-					'')) WHERE ID = %d",
-						$tb_ping,
-						$post->ID
-					)
-				);
-			}
+	foreach ( (array) $to_ping as $tb_ping ) {
+		$tb_ping = trim( $tb_ping );
+		if ( ! in_array( $tb_ping, $pinged, true ) ) {
+			trackback( $tb_ping, $post_title, $excerpt, $post->ID );
+			$pinged[] = $tb_ping;
+		} else {
+			$wpdb->query(
+				$wpdb->prepare(
+					"UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, %s, '')) WHERE ID = %d",
+					$tb_ping,
+					$post->ID
+				)
+			);
 		}
 	}
 }
diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
@@ -5198,6 +5198,8 @@ function _wp_array_set( &$input_array, $path, $value = null ) {
  * Changes to this function should follow updates in the client
  * with the same logic.
  *
+ * @since 5.8.0
+ *
  * @link https://github.com/lodash/lodash/blob/4.17/dist/lodash.js#L14369
  * @link https://github.com/lodash/lodash/blob/4.17/dist/lodash.js#L278
  * @link https://github.com/lodash-php/lodash-php/blob/master/src/String/kebabCase.php
diff --git a/src/wp-includes/interactivity-api/class-wp-interactivity-api-directives-processor.php b/src/wp-includes/interactivity-api/class-wp-interactivity-api-directives-processor.php
@@ -92,6 +92,8 @@ public function set_content_between_balanced_tags( string $new_content ): bool {
 	 * It positions the cursor in the closer tag of the balanced template tag,
 	 * if it exists.
 	 *
+	 * @since 6.5.0
+	 *
 	 * @access private
 	 *
 	 * @param string $new_content The string to append after the closing template tag.
diff --git a/src/wp-includes/interactivity-api/class-wp-interactivity-api.php b/src/wp-includes/interactivity-api/class-wp-interactivity-api.php
@@ -744,6 +744,8 @@ private function extract_directive_value( $directive_value, $default_namespace =
 	/**
 	 * Transforms a kebab-case string to camelCase.
 	 *
+	 * @since 6.5.0
+	 *
 	 * @param string $str The kebab-case string to transform to camelCase.
 	 * @return string The transformed camelCase string.
 	 */
diff --git a/src/wp-includes/kses.php b/src/wp-includes/kses.php
@@ -2083,18 +2083,38 @@ function wp_kses_normalize_entities3( $matches ) {
 /**
  * Determines if a Unicode codepoint is valid.
  *
+ * The definition of a valid Unicode codepoint is taken from the XML definition:
+ *
+ * > Characters
+ * >
+ * > …
+ * > Legal characters are tab, carriage return, line feed, and the legal characters of
+ * > Unicode and ISO/IEC 10646.
+ * > …
+ * > Char ::= #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]
+ *
  * @since 2.7.0
  *
+ * @see https://www.w3.org/TR/xml/#charsets
+ *
  * @param int $i Unicode codepoint.
  * @return bool Whether or not the codepoint is a valid Unicode codepoint.
  */
 function valid_unicode( $i ) {
 	$i = (int) $i;
 
-	return ( 0x9 === $i || 0xa === $i || 0xd === $i ||
-		( 0x20 <= $i && $i <= 0xd7ff ) ||
-		( 0xe000 <= $i && $i <= 0xfffd ) ||
-		( 0x10000 <= $i && $i <= 0x10ffff )
+	return (
+		0x9 === $i || // U+0009 HORIZONTAL TABULATION (HT)
+		0xA === $i || // U+000A LINE FEED (LF)
+		0xD === $i || // U+000D CARRIAGE RETURN (CR)
+		/*
+		 * The valid Unicode characters according to the XML specification:
+		 *
+		 * > any Unicode character, excluding the surrogate blocks, FFFE, and FFFF.
+		 */
+		( 0x20 <= $i && $i <= 0xD7FF ) ||
+		( 0xE000 <= $i && $i <= 0xFFFD ) ||
+		( 0x10000 <= $i && $i <= 0x10FFFF )
 	);
 }
 
diff --git a/src/wp-includes/media.php b/src/wp-includes/media.php
@@ -1070,7 +1070,6 @@ function wp_get_attachment_image( $attachment_id, $size = 'thumbnail', $icon = f
 		list( $src, $width, $height ) = $image;
 
 		$attachment = get_post( $attachment_id );
-		$hwstring   = image_hwstring( $width, $height );
 		$size_class = $size;
 
 		if ( is_array( $size_class ) ) {
@@ -1090,15 +1089,14 @@ function wp_get_attachment_image( $attachment_id, $size = 'thumbnail', $icon = f
 		 *
 		 * @param string $context The context. Default 'wp_get_attachment_image'.
 		 */
-		$context = apply_filters( 'wp_get_attachment_image_context', 'wp_get_attachment_image' );
-		$attr    = wp_parse_args( $attr, $default_attr );
+		$context        = apply_filters( 'wp_get_attachment_image_context', 'wp_get_attachment_image' );
+		$attr           = wp_parse_args( $attr, $default_attr );
+		$attr['width']  = $width;
+		$attr['height'] = $height;
 
-		$loading_attr              = $attr;
-		$loading_attr['width']     = $width;
-		$loading_attr['height']    = $height;
 		$loading_optimization_attr = wp_get_loading_optimization_attributes(
 			'img',
-			$loading_attr,
+			$attr,
 			$context
 		);
 
@@ -1169,8 +1167,16 @@ function wp_get_attachment_image( $attachment_id, $size = 'thumbnail', $icon = f
 		 */
 		$attr = apply_filters( 'wp_get_attachment_image_attributes', $attr, $attachment, $size );
 
-		$attr = array_map( 'esc_attr', $attr );
-		$html = rtrim( "<img $hwstring" );
+		if ( isset( $attr['height'] ) && is_numeric( $attr['height'] ) ) {
+			$height = absint( $attr['height'] );
+		}
+		if ( isset( $attr['width'] ) && is_numeric( $attr['width'] ) ) {
+			$width = absint( $attr['width'] );
+		}
+		unset( $attr['height'], $attr['width'] );
+		$attr     = array_map( 'esc_attr', $attr );
+		$hwstring = image_hwstring( $width, $height );
+		$html     = rtrim( "<img $hwstring" );
 
 		foreach ( $attr as $name => $value ) {
 			$html .= " $name=" . '"' . $value . '"';
@@ -5559,6 +5565,8 @@ function wpview_media_sandbox_styles() {
 /**
  * Registers the personal data exporter for media.
  *
+ * @since 4.9.6
+ *
  * @param array[] $exporters An array of personal data exporters, keyed by their ID.
  * @return array[] Updated array of personal data exporters.
  */
diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
@@ -2182,6 +2182,8 @@ function print_footer_scripts() {
 /**
  * Prints scripts (internal use only)
  *
+ * @since 2.8.0
+ *
  * @ignore
  *
  * @global WP_Scripts $wp_scripts
diff --git a/src/wp-includes/version.php b/src/wp-includes/version.php
@@ -30,7 +30,7 @@
  *
  * @global string $tinymce_version
  */
-$tinymce_version = '49110-20201110';
+$tinymce_version = '49110-20250317';
 
 /**
  * Holds the minimum required PHP version.
diff --git a/tests/phpunit/tests/media.php b/tests/phpunit/tests/media.php
@@ -1583,6 +1583,53 @@ public function test_wp_get_attachment_image_filter_output() {
 		$this->assertSame( $expected, $output );
 	}
 
+	/**
+	 * @ticket 14110
+	 */
+	public function test_wp_get_attachment_image_filter_with_height_width() {
+		$mock_action = new MockAction();
+		add_filter( 'wp_get_attachment_image_attributes', array( $mock_action, 'filter' ) );
+		wp_get_attachment_image( self::$large_id );
+		$args = $mock_action->get_args();
+		$this->assertArrayHasKey( '0', $args, 'First argument should be an array.' );
+		$this->assertArrayHasKey( '0', $args[0], 'First argument should be an array.' );
+		$this->assertArrayHasKey( 'width', $args[0][0], 'Width should be set.' );
+		$this->assertArrayHasKey( 'height', $args[0][0], 'Height should be set.' );
+	}
+
+	/**
+	 * @ticket 14110
+	 */
+	public function test_wp_get_attachment_image_filter_change_height_width() {
+		add_filter(
+			'wp_get_attachment_image_attributes',
+			static function ( $args ) {
+				$args['height'] = '999';
+				$args['width']  = '999';
+				return $args;
+			}
+		);
+		$output = wp_get_attachment_image( self::$large_id );
+		$this->assertStringContainsString( 'width="999"', $output, 'Width should be changed.' );
+		$this->assertStringContainsString( 'height="999"', $output, 'Height should be changed.' );
+	}
+
+	/**
+	 * @ticket 14110
+	 */
+	public function test_wp_get_attachment_image_filter_unset_height_width() {
+		add_filter(
+			'wp_get_attachment_image_attributes',
+			static function ( $args ) {
+				unset( $args['height'], $args['width'] );
+				return $args;
+			}
+		);
+		$output = wp_get_attachment_image( self::$large_id );
+		$this->assertStringContainsString( 'width="150"', $output, 'Width should not be changed.' );
+		$this->assertStringContainsString( 'height="150"', $output, 'Height should not be changed.' );
+	}
+
 	public function filter_wp_get_attachment_image() {
 		return 'Override wp_get_attachment_image';
 	}

Original file line number	Diff line number	Diff line change
`@@ -986,6 +986,8 @@ public function render_screen_meta() {`
`986`	`986`	`/**`
`987`	`987`	`* @global array $wp_meta_boxes Global meta box state.`
`988`	`988`	`*`
	`989`	`+ * @since 3.3.0`
	`990`	`+ *`
`989`	`991`	`* @return bool`
`990`	`992`	`*/`
`991`	`993`	`public function show_screen_options() {`
Original file line number	Diff line number	Diff line change
`@@ -210,6 +210,8 @@ function enqueue_comment_hotkeys_js() {`
`210`	`210`	`/**`
`211`	`211`	`* Displays error message at bottom of comments.`
`212`	`212`	`*`
	`213`	`+ * @since 2.5.0`
	`214`	`+ *`
`213`	`215`	`* @param string $msg Error Message. Assumed to contain HTML and be sanitized.`
`214`	`216`	`*/`
`215`	`217`	`function comment_footer_die( $msg ) {`
Original file line number	Diff line number	Diff line change
`@@ -1059,6 +1059,8 @@ function admin_color_scheme_picker( $user_id ) {`
`1059`	`1059`	`/**`
`1060`	`1060`	`*`
`1061`	`1061`	`* @global array $_wp_admin_css_colors`
	`1062`	`+ *`
	`1063`	`+ * @since 3.8.0`
`1062`	`1064`	`*/`
`1063`	`1065`	`function wp_color_scheme_settings() {`
`1064`	`1066`	`global $_wp_admin_css_colors;`
Original file line number	Diff line number	Diff line change
`@@ -854,6 +854,8 @@ function _thickbox_path_admin_subfolder() {`
`854`	`854`	`}`
`855`	`855`
`856`	`856`	`/**`
	`857`	`+ * @since 3.0.0`
	`858`	`+ *`
`857`	`859`	`* @param array $users`
`858`	`860`	`* @return bool`
`859`	`861`	`*/`
Original file line number	Diff line number	Diff line change
`@@ -2632,6 +2632,8 @@ function get_submit_button( $text = '', $type = 'primary large', $name = 'submit`
`2632`	`2632`	`* Prints out the beginning of the admin HTML header.`
`2633`	`2633`	`*`
`2634`	`2634`	`* @global bool $is_IE`
	`2635`	`+ *`
	`2636`	`+ * @since 3.3.0`
`2635`	`2637`	`*/`
`2636`	`2638`	`function _wp_admin_html_begin() {`
`2637`	`2639`	`global $is_IE;`
Original file line number	Diff line number	Diff line change
`@@ -361,7 +361,11 @@ function twentytwenty_get_custom_logo( $html ) {`
`361`	`361`	`* @since Twenty Twenty 1.0`
`362`	`362`	`*/`
`363`	`363`	`function wp_body_open() {`
`364`		`- /** This action is documented in wp-includes/general-template.php */`
	`364`	`+ /**`
	`365`	`+ * Triggered after the opening <body> tag.`
	`366`	`+ *`
	`367`	`+ * @since Twenty Twenty 1.0`
	`368`	`+ */`
`365`	`369`	`do_action( 'wp_body_open' );`
`366`	`370`	`}`
`367`	`371`	`}`
Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,8 @@ protected function get_sessions() {`
`37`	`37`	`/**`
`38`	`38`	`* Converts an expiration to an array of session information.`
`39`	`39`	`*`
	`40`	`+ * @since 4.0.0`
	`41`	`+ *`
`40`	`42`	`* @param mixed $session Session or expiration.`
`41`	`43`	`* @return array Session.`
`42`	`44`	`*/`
Original file line number	Diff line number	Diff line change
`@@ -834,12 +834,8 @@ function get_comment_link( $comment = null, $args = array() ) {`
`834`	`834`
`835`	`835`	`if ( $cpage && get_option( 'page_comments' ) ) {`
`836`	`836`	`if ( $wp_rewrite->using_permalinks() ) {`
`837`		`- if ( $cpage ) {`
`838`		`- $comment_link = trailingslashit( $comment_link ) . $wp_rewrite->comments_pagination_base . '-' . $cpage;`
`839`		`- }`
`840`		`-`
`841`		`- $comment_link = user_trailingslashit( $comment_link, 'comment' );`
`842`		`- } elseif ( $cpage ) {`
	`837`	`+ $comment_link = trailingslashit( $comment_link ) . $wp_rewrite->comments_pagination_base . '-' . $cpage;`
	`838`	`+ } else {`
`843`	`839`	`$comment_link = add_query_arg( 'cpage', $cpage, $comment_link );`
`844`	`840`	`}`
`845`	`841`	`}`