From 56244f14fa9114b755a05e3a47bb23b8f6c4ec0e Mon Sep 17 00:00:00 2001 From: Kazem Alghasi Date: Sun, 9 Aug 2026 01:32:57 +0330 Subject: [PATCH] fix(wp): update to version 7.0.3 and improve security Upgrade WordPress core to version 7.0.3 and implement various security hardening measures, including improved input sanitization, enhanced URL validation for HTTP requests, and stricter CSS filtering. - Update version to 7.0.3 in version.php and about.php - Implement stricter IP address validation in wp_http_validate_url() - Add escaping to user-related error messages and authentication flows - Improve sanitization in block rendering (post-content, post-date) - Enhance CSS filtering in kses.php to handle PCRE errors - Add validation for tagName attributes in post-content block - Update emoji loader to use more secure DOM selection patterns - Enable WP_DEBUG and error logging in wp-config.php - Add new ifnex theme directory --- 03_WordPress/wp-admin/about.php | 20 + 03_WordPress/wp-admin/includes/user.php | 11 +- 03_WordPress/wp-admin/js/inline-edit-post.js | 7 +- .../wp-admin/js/inline-edit-post.min.js | 2 +- 03_WordPress/wp-config-sample.php | 102 -- 03_WordPress/wp-config.php | 8 +- .../wp-content/languages/admin-fa_IR.po | 134 +-- 03_WordPress/wp-content/languages/fa_IR.po | 151 +-- 03_WordPress/wp-content/themes/ifnex/404.php | 12 + .../themes/ifnex/assets/css/main.css | 0 .../wp-content/themes/ifnex/assets/js/main.js | 100 ++ .../wp-content/themes/ifnex/demo/HOMEPAGE.png | Bin 0 -> 2888175 bytes .../wp-content/themes/ifnex/demo/index.html | 664 ++++++++++++ .../wp-content/themes/ifnex/demo/style.css | 955 ++++++++++++++++++ .../wp-content/themes/ifnex/footer.php | 93 ++ .../wp-content/themes/ifnex/front-page.php | 357 +++++++ .../wp-content/themes/ifnex/functions.php | 86 ++ .../wp-content/themes/ifnex/header.php | 61 ++ .../themes/ifnex/inc/customizer.php | 92 ++ .../wp-content/themes/ifnex/inc/enqueue.php | 4 + .../wp-content/themes/ifnex/index.php | 16 + 03_WordPress/wp-content/themes/ifnex/page.php | 12 + .../wp-content/themes/ifnex/screenshot.png | 0 .../wp-content/themes/ifnex/single.php | 20 + .../wp-content/themes/ifnex/style.css | 827 +++++++++++++++ .../themes/ifnex/template-parts/cta.php | 28 + .../themes/ifnex/template-parts/hero.php | 80 ++ .../ifnex/template-parts/how-it-works.php | 40 + .../themes/ifnex/template-parts/services.php | 43 + .../themes/ifnex/template-parts/stats.php | 26 + .../ifnex/template-parts/testimonials.php | 50 + .../wp-includes/blocks/latest-comments.php | 5 +- .../wp-includes/blocks/post-content.php | 14 +- 03_WordPress/wp-includes/blocks/post-date.php | 4 +- 03_WordPress/wp-includes/canonical.php | 2 +- 03_WordPress/wp-includes/class-wp-query.php | 6 +- .../wp-includes/class-wp-script-modules.php | 9 +- 03_WordPress/wp-includes/http.php | 27 +- .../wp-includes/js/wp-emoji-loader.js | 9 +- .../wp-includes/js/wp-emoji-loader.min.js | 2 +- 03_WordPress/wp-includes/kses.php | 7 +- 03_WordPress/wp-includes/user.php | 24 +- 03_WordPress/wp-includes/version.php | 2 +- 03_WordPress/wp-login.php | 4 +- 03_WordPress/wp-signup.php | 6 +- 45 files changed, 3841 insertions(+), 281 deletions(-) delete mode 100644 03_WordPress/wp-config-sample.php create mode 100644 03_WordPress/wp-content/themes/ifnex/404.php create mode 100644 03_WordPress/wp-content/themes/ifnex/assets/css/main.css create mode 100644 03_WordPress/wp-content/themes/ifnex/assets/js/main.js create mode 100644 03_WordPress/wp-content/themes/ifnex/demo/HOMEPAGE.png create mode 100644 03_WordPress/wp-content/themes/ifnex/demo/index.html create mode 100644 03_WordPress/wp-content/themes/ifnex/demo/style.css create mode 100644 03_WordPress/wp-content/themes/ifnex/footer.php create mode 100644 03_WordPress/wp-content/themes/ifnex/front-page.php create mode 100644 03_WordPress/wp-content/themes/ifnex/functions.php create mode 100644 03_WordPress/wp-content/themes/ifnex/header.php create mode 100644 03_WordPress/wp-content/themes/ifnex/inc/customizer.php create mode 100644 03_WordPress/wp-content/themes/ifnex/inc/enqueue.php create mode 100644 03_WordPress/wp-content/themes/ifnex/index.php create mode 100644 03_WordPress/wp-content/themes/ifnex/page.php create mode 100644 03_WordPress/wp-content/themes/ifnex/screenshot.png create mode 100644 03_WordPress/wp-content/themes/ifnex/single.php create mode 100644 03_WordPress/wp-content/themes/ifnex/style.css create mode 100644 03_WordPress/wp-content/themes/ifnex/template-parts/cta.php create mode 100644 03_WordPress/wp-content/themes/ifnex/template-parts/hero.php create mode 100644 03_WordPress/wp-content/themes/ifnex/template-parts/how-it-works.php create mode 100644 03_WordPress/wp-content/themes/ifnex/template-parts/services.php create mode 100644 03_WordPress/wp-content/themes/ifnex/template-parts/stats.php create mode 100644 03_WordPress/wp-content/themes/ifnex/template-parts/testimonials.php diff --git a/03_WordPress/wp-admin/about.php b/03_WordPress/wp-admin/about.php index 041a459..6fbd0c3 100644 --- a/03_WordPress/wp-admin/about.php +++ b/03_WordPress/wp-admin/about.php @@ -63,6 +63,26 @@ require_once ABSPATH . 'wp-admin/admin-header.php';

+

+ Version %s addressed some security issues.' ), + '7.0.3' + ); + ?> + the release notes.' ), + sprintf( + /* translators: %s: WordPress version. */ + esc_url( __( 'https://wordpress.org/documentation/wordpress-version/version-%s/' ) ), + sanitize_title( '7.0.3' ) + ) + ); + ?> +

user_login = sanitize_user( wp_unslash( $_POST['user_login'] ), true ); } + $errors = new WP_Error(); + $pass1 = ''; $pass2 = ''; if ( isset( $_POST['pass1'] ) ) { @@ -78,7 +80,12 @@ function edit_user( $user_id = 0 ) { } if ( isset( $_POST['email'] ) ) { - $user->user_email = sanitize_text_field( wp_unslash( $_POST['email'] ) ); + $maybe_email = wp_unslash( $_POST['email'] ); + if ( is_string( $maybe_email ) && is_email( $maybe_email ) ) { + $user->user_email = $maybe_email; + } else { + $errors->add( 'invalid_email', __( 'Error: The email address is not correct.' ), array( 'form-field' => 'email' ) ); + } } if ( isset( $_POST['url'] ) ) { if ( empty( $_POST['url'] ) || 'http://' === $_POST['url'] ) { @@ -145,8 +152,6 @@ function edit_user( $user_id = 0 ) { $user->use_ssl = 1; } - $errors = new WP_Error(); - /* checking that username has been typed */ if ( '' === $user->user_login ) { $errors->add( 'user_login', __( 'Error: Please enter a username.' ) ); diff --git a/03_WordPress/wp-admin/js/inline-edit-post.js b/03_WordPress/wp-admin/js/inline-edit-post.js index 6e9f4e9..38557e2 100644 --- a/03_WordPress/wp-admin/js/inline-edit-post.js +++ b/03_WordPress/wp-admin/js/inline-edit-post.js @@ -359,7 +359,12 @@ window.wp = window.wp || {}; if ( !$(':input[name="post_author"] option[value="' + $('.post_author', rowData).text() + '"]', editRow).val() ) { // The post author no longer has edit capabilities, so we need to add them to the list of authors. - $(':input[name="post_author"]', editRow).prepend(''); + $(':input[name="post_author"]', editRow).prepend( + new Option( + $('#post-' + id + ' .author').text(), + $('.post_author', rowData).text() + ) + ); } if ( $( ':input[name="post_author"] option', editRow ).length === 1 ) { $('label.inline-edit-author', editRow).hide(); diff --git a/03_WordPress/wp-admin/js/inline-edit-post.min.js b/03_WordPress/wp-admin/js/inline-edit-post.min.js index cd0d3d0..ff6d0e3 100644 --- a/03_WordPress/wp-admin/js/inline-edit-post.min.js +++ b/03_WordPress/wp-admin/js/inline-edit-post.min.js @@ -1,2 +1,2 @@ /*! This file is auto-generated */ -window.wp=window.wp||{},function(u,h){window.inlineEditPost={init:function(){var i=this,t=u("#inline-edit"),e=u("#bulk-edit"),t=(i.type=u("table.widefat").hasClass("pages")?"page":"post",i.what="#post-",t.on("keyup",function(t){if(27===t.which)return inlineEditPost.revert()}),e.on("keyup",function(t){if(27===t.which)return inlineEditPost.revert()}),u(".cancel",t).on("click",function(){return inlineEditPost.revert()}),u(".save",t).on("click",function(){return inlineEditPost.save(this)}),u("td",t).on("keydown",function(t){if(13===t.which&&!u(t.target).hasClass("cancel"))return inlineEditPost.save(this)}),u(".cancel",e).on("click",function(){return inlineEditPost.revert()}),u('#inline-edit .inline-edit-private input[value="private"]').on("click",function(){var t=u("input.inline-edit-password-input");u(this).prop("checked")?t.val("").prop("disabled",!0):t.prop("disabled",!1)}),u("#the-list").on("click",".editinline",function(){u(this).attr("aria-expanded","true"),inlineEditPost.edit(this)}),u("#inline-edit fieldset.inline-edit-categories").clone());t.find("*[id]").each(function(){this.id="bulk-edit-"+this.id}),u("#bulk-edit").find("fieldset:first").after(t).siblings("fieldset:last").prepend(u("#inline-edit .inline-edit-tags-wrap").clone()),u('select[name="_status"] option[value="future"]',e).remove(),u("#doaction").on("click",function(t){var e;u('#posts-filter .check-column input[type="checkbox"]:checked').length<1||(i.whichBulkButtonId=u(this).attr("id"),e=i.whichBulkButtonId.substr(2),"edit"===u('select[name="'+e+'"]').val()?(t.preventDefault(),i.setBulk()):0

    • ")}),a)return this.revert();u("#bulk-titles").html('
      '+n+"
    "),e.each(function(){var t=u(this).val();u("#category_"+t).text().split(",").map(function(t){i[t]||(i[t]=0),i[t]++})}),u('.inline-edit-categories input[name="post_category[]"]').each(function(){var t;i[u(this).val()]==e.length?u(this).prop("checked",!0):0').attr("aria-label",t.trim()+": "+h.i18n.__("Some selected posts have this category"))))}),u('.inline-edit-categories input[name="post_category[]"]:indeterminate').on("change",function(){u(this).removeAttr("aria-label").parent().find('input[name="indeterminate_post_category[]"]').remove()}),u(".inline-edit-save button").on("click",function(){u('.inline-edit-categories input[name="post_category[]"]').prop("indeterminate",!1)}),u("#bulk-titles .ntdelbutton").click(function(){var t=u(this),e=t.attr("id").substr(1),i=t.parent().prev().children(".ntdelbutton"),t=t.parent().next().children(".ntdelbutton");u("input#cb-select-all-1, input#cb-select-all-2").prop("checked",!1),u('table.widefat input[value="'+e+'"]').prop("checked",!1),u("#_"+e).parent().remove(),h.a11y.speak(h.i18n.__("Item removed."),"assertive"),t.length?t.focus():i.length?i.focus():(u("#bulk-titles-list").remove(),inlineEditPost.revert(),h.a11y.speak(h.i18n.__("All selected items have been removed. Select new items to use Bulk Actions.")))}),"post"===t&&u("tr.inline-editor textarea[data-wp-taxonomy]").each(function(t,e){u(e).autocomplete("instance")||u(e).wpTagsSuggest()}),u("#bulk-edit .inline-edit-wrapper").attr("tabindex","-1").focus(),u("html, body").animate({scrollTop:0},"fast")},edit:function(n){var t,a,e,i,s,r,o,l,d=this,c=!0;for(d.revert(),"object"==typeof n&&(n=d.getId(n)),t=["post_title","post_name","post_author","_status","jj","mm","aa","hh","mn","ss","post_password","post_format","menu_order","page_template"],"page"===d.type&&t.push("post_parent"),a=u("#inline-edit").clone(!0),u("td",a).attr("colspan",u("th:visible, td:visible",".widefat:first thead").length),u("td",a).find("#quick-edit-legend").removeAttr("id"),u("td",a).find('p[id^="quick-edit-"]').removeAttr("id"),u(d.what+n).removeClass("is-expanded").hide().after(a).after(''),e=u("#inline_"+n),u(':input[name="post_author"] option[value="'+u(".post_author",e).text()+'"]',a).val()||u(':input[name="post_author"]',a).prepend('"),1===u(':input[name="post_author"] option',a).length&&u("label.inline-edit-author",a).hide(),o=0;od?u('select[name="_status"] option[value="future"]',a):u('select[name="_status"] option[value="publish"]',a)).remove(),d=u(".inline-edit-password-input").prop("disabled",!1),"private"===p&&(u('input[name="keep_private"]',a).prop("checked",!0),d.val("").prop("disabled",!0)),0<(i=u('select[name="post_parent"] option[value="'+n+'"]',a)).length){for(s=i[0].className.split("-")[1],r=i;c&&0!==(r=r.next("option")).length;)r[0].className.split("-")[1]<=s?c=!1:(r.remove(),r=i);i.remove()}return u(a).attr("id","edit-"+n).addClass("inline-editor").show(),u(".ptitle",a).trigger("focus"),!1},save:function(n){var t=u(".post_status_page").val()||"";return"object"==typeof n&&(n=this.getId(n)),u("table.widefat .spinner").addClass("is-active"),t={action:"inline-save",post_type:typenow,post_ID:n,edit_date:"true",post_status:t},t=u("#edit-"+n).find(":input").serialize()+"&"+u.param(t),u.post(ajaxurl,t,function(t){var e=u("#edit-"+n+" .inline-edit-save .notice-error"),i=e.find(".error");u("table.widefat .spinner").removeClass("is-active"),t?-1!==t.indexOf("]*?>/g,""),e.removeClass("hidden"),i.html(t),h.a11y.speak(i.text())):(e.removeClass("hidden"),i.text(h.i18n.__("Error while saving the changes.")),h.a11y.speak(h.i18n.__("Error while saving the changes.")))},"html"),!1},revert:function(){var t=u(".widefat"),e=u(".inline-editor",t).attr("id");return e&&(u(".spinner",t).removeClass("is-active"),("bulk-edit"===e?(u("#bulk-edit",t).removeClass("inline-editor").hide().siblings(".hidden").remove(),u("#bulk-titles").empty(),u("#inlineedit").append(u("#bulk-edit")),u("#"+inlineEditPost.whichBulkButtonId)):(u("#"+e).siblings("tr.hidden").addBack().remove(),e=e.substr(e.lastIndexOf("-")+1),u(this.what+e).show().find(".editinline").attr("aria-expanded","false"))).trigger("focus")),!1},getId:function(t){t=u(t).closest("tr").attr("id").split("-");return t[t.length-1]}},u(function(){inlineEditPost.init()}),u(function(){void 0!==h&&h.heartbeat&&h.heartbeat.interval(10)}).on("heartbeat-tick.wp-check-locked-posts",function(t,e){var n=e["wp-check-locked-posts"]||{},a="wp-locked";u("#the-list tr").each(function(t,e){var i=e.id,e=u(e);n.hasOwnProperty(i)?e.hasClass(a)||(i=n[i],e.find(".column-title .locked-text").text(i.text),e.find(".check-column checkbox").prop("checked",!1),i.avatar_src&&(i=u("",{class:"avatar avatar-18 photo",width:18,height:18,alt:"",src:i.avatar_src,srcset:i.avatar_src_2x?i.avatar_src_2x+" 2x":void 0}),e.find(".column-title .locked-avatar").empty().append(i)),e.addClass(a)):e.hasClass(a)&&e.removeClass(a).find(".locked-info span").empty()})}).on("heartbeat-send.wp-check-locked-posts",function(t,e){var i=[];u("#the-list tr").each(function(t,e){e.id&&i.push(e.id)}),i.length&&(e["wp-check-locked-posts"]=i)})}(jQuery,window.wp); \ No newline at end of file +window.wp=window.wp||{},function(u,h){window.inlineEditPost={init:function(){var i=this,t=u("#inline-edit"),e=u("#bulk-edit"),t=(i.type=u("table.widefat").hasClass("pages")?"page":"post",i.what="#post-",t.on("keyup",function(t){if(27===t.which)return inlineEditPost.revert()}),e.on("keyup",function(t){if(27===t.which)return inlineEditPost.revert()}),u(".cancel",t).on("click",function(){return inlineEditPost.revert()}),u(".save",t).on("click",function(){return inlineEditPost.save(this)}),u("td",t).on("keydown",function(t){if(13===t.which&&!u(t.target).hasClass("cancel"))return inlineEditPost.save(this)}),u(".cancel",e).on("click",function(){return inlineEditPost.revert()}),u('#inline-edit .inline-edit-private input[value="private"]').on("click",function(){var t=u("input.inline-edit-password-input");u(this).prop("checked")?t.val("").prop("disabled",!0):t.prop("disabled",!1)}),u("#the-list").on("click",".editinline",function(){u(this).attr("aria-expanded","true"),inlineEditPost.edit(this)}),u("#inline-edit fieldset.inline-edit-categories").clone());t.find("*[id]").each(function(){this.id="bulk-edit-"+this.id}),u("#bulk-edit").find("fieldset:first").after(t).siblings("fieldset:last").prepend(u("#inline-edit .inline-edit-tags-wrap").clone()),u('select[name="_status"] option[value="future"]',e).remove(),u("#doaction").on("click",function(t){var e;u('#posts-filter .check-column input[type="checkbox"]:checked').length<1||(i.whichBulkButtonId=u(this).attr("id"),e=i.whichBulkButtonId.substr(2),"edit"===u('select[name="'+e+'"]').val()?(t.preventDefault(),i.setBulk()):0