WordPress version update

wp/wp-admin/about.php

@@ -63,6 +63,26 @@
 		<div class="about__section changelog has-subtle-background-color">
 			<div class="column">
 				<h2><?php _e( 'Maintenance and Security Releases' ); ?></h2>
+				<p>
+					<?php
+					printf(
+						/* translators: %s: WordPress version. */
+						__( '<strong>Version %s</strong> addressed some security issues.' ),
+						'7.0.3'
+					);
+					?>
+					<?php
+					printf(
+						/* translators: %s: HelpHub URL. */
+						__( 'For more information, see <a href="%s">the release notes</a>.' ),
+						sprintf(
+							/* translators: %s: WordPress version. */
+							esc_url( __( 'https://wordpress.org/documentation/wordpress-version/version-%s/' ) ),
+							sanitize_title( '7.0.3' )
+						)
+					);
+					?>
+				</p>
 				<p>
 					<?php
 					printf(

wp/wp-admin/includes/user.php

@@ -44,6 +44,8 @@ function edit_user( $user_id = 0 ) {
 		$user->user_login = sanitize_user( wp_unslash( $_POST['user_login'] ), true );
 	}
 
+	$errors = new WP_Error();
+
 	$pass1 = '';
 	$pass2 = '';
 	if ( isset( $_POST['pass1'] ) ) {
@@ -78,7 +80,12 @@ function edit_user( $user_id = 0 ) {
 	}
 
 	if ( isset( $_POST['email'] ) ) {
-		$user->user_email = sanitize_text_field( wp_unslash( $_POST['email'] ) );
+		$maybe_email = wp_unslash( $_POST['email'] );
+		if ( is_string( $maybe_email ) && is_email( $maybe_email ) ) {
+			$user->user_email = $maybe_email;
+		} else {
+			$errors->add( 'invalid_email', __( '<strong>Error:</strong> The email address is not correct.' ), array( 'form-field' => 'email' ) );
+		}
 	}
 	if ( isset( $_POST['url'] ) ) {
 		if ( empty( $_POST['url'] ) || 'http://' === $_POST['url'] ) {
@@ -145,8 +152,6 @@ function edit_user( $user_id = 0 ) {
 		$user->use_ssl = 1;
 	}
 
-	$errors = new WP_Error();
-
 	/* checking that username has been typed */
 	if ( '' === $user->user_login ) {
 		$errors->add( 'user_login', __( '<strong>Error:</strong> Please enter a username.' ) );

wp/wp-admin/js/inline-edit-post.js

@@ -359,7 +359,12 @@ window.wp = window.wp || {};
 		if ( !$(':input[name="post_author"] option[value="' + $('.post_author', rowData).text() + '"]', editRow).val() ) {
 
 			// The post author no longer has edit capabilities, so we need to add them to the list of authors.
-			$(':input[name="post_author"]', editRow).prepend('<option value="' + $('.post_author', rowData).text() + '">' + $('#post-' + id + ' .author').text() + '</option>');
+			$(':input[name="post_author"]', editRow).prepend(
+				new Option(
+					$('#post-' + id + ' .author').text(),
+					$('.post_author', rowData).text()
+				)
+			);
 		}
 		if ( $( ':input[name="post_author"] option', editRow ).length === 1 ) {
 			$('label.inline-edit-author', editRow).hide();

wp/wp-content/plugins/sqlite-database-integration/activate.php

@@ -14,47 +14,50 @@
  * @param string $plugin The plugin basename.
  */
 function sqlite_plugin_activation_redirect( $plugin ) {
-	if ( plugin_basename( SQLITE_MAIN_FILE ) === $plugin ) {
-		if ( wp_safe_redirect( admin_url( 'options-general.php?page=sqlite-integration' ) ) ) {
-			exit;
-		}
+	if (
+		plugin_basename( SQLITE_MAIN_FILE ) !== $plugin
+		|| ! current_user_can( sqlite_plugin_get_manage_capability() )
+	) {
+		return;
+	}
+
+	if ( wp_safe_redirect( sqlite_plugin_get_admin_page_url() ) ) {
+		exit;
 	}
 }
 add_action( 'activated_plugin', 'sqlite_plugin_activation_redirect' );
 
 /**
  * Check the URL to ensure we're on the plugin page,
  * the user has clicked the button to install SQLite,
- * and the nonce is valid.
+ * the user has permission to manage the database drop-in, and the nonce is valid.
  * If the above conditions are met, run the sqlite_plugin_copy_db_file() function,
  * and redirect to the install screen.
  *
  * @since 1.0.0
  */
 function sqlite_activation() {
-	global $current_screen;
-	if ( isset( $current_screen->base ) && 'settings_page_sqlite-integration' === $current_screen->base ) {
+	if (
+		! isset( $_GET['page'], $_GET['confirm-install'] )
+		|| 'sqlite-integration' !== $_GET['page']
+	) {
 		return;
 	}
-	if ( isset( $_GET['confirm-install'] ) && wp_verify_nonce( $_GET['_wpnonce'], 'sqlite-install' ) ) {
 
-		// Handle upgrading from the performance-lab plugin.
-		if ( isset( $_GET['upgrade-from-pl'] ) ) {
-			global $wp_filesystem;
-			require_once ABSPATH . '/wp-admin/includes/file.php';
-			// Delete the previous db.php file.
-			$wp_filesystem->delete( WP_CONTENT_DIR . '/db.php' );
-			// Deactivate the performance-lab SQLite module.
-			$pl_option_name = defined( 'PERFLAB_MODULES_SETTING' ) ? PERFLAB_MODULES_SETTING : 'perflab_modules_settings';
-			$pl_option      = get_option( $pl_option_name, array() );
-			unset( $pl_option['database/sqlite'] );
-			update_option( $pl_option_name, $pl_option );
-		}
-		sqlite_plugin_copy_db_file();
-		// WordPress will automatically redirect to the install screen here.
-		wp_redirect( admin_url() );
-		exit;
+	if ( ! current_user_can( sqlite_plugin_get_manage_capability() ) ) {
+		wp_die(
+			esc_html__( 'Sorry, you are not allowed to install the SQLite database drop-in.', 'sqlite-database-integration' ),
+			403
+		);
 	}
+
+	check_admin_referer( 'sqlite-install' );
+
+	sqlite_plugin_copy_db_file();
+
+	// WordPress will automatically redirect to the install screen here.
+	wp_redirect( admin_url() );
+	exit;
 }
 add_action( 'admin_init', 'sqlite_activation' );
 

wp/wp-content/plugins/sqlite-database-integration/admin-notices.php

@@ -12,6 +12,9 @@
  * When the plugin gets merged in wp-core, this is not to be ported.
  */
 function sqlite_plugin_admin_notice() {
+	if ( ! current_user_can( sqlite_plugin_get_manage_capability() ) ) {
+		return;
+	}
 
 	// Don't print notices in the plugin's admin screen.
 	global $current_screen;
@@ -66,11 +69,8 @@ function sqlite_plugin_admin_notice() {
 			/* translators: 1: db.php drop-in path, 2: Admin URL to deactivate the module */
 			__( 'The SQLite Integration plugin is active, but the %1$s file is missing. Please <a href="%2$s">deactivate the plugin</a> and re-activate it to try again.', 'sqlite-database-integration' ),
 			'<code>' . esc_html( basename( WP_CONTENT_DIR ) ) . '/db.php</code>',
-			esc_url( admin_url( 'plugins.php' ) )
+			esc_url( self_admin_url( 'plugins.php' ) )
 		)
 	);
 }
-add_action( 'admin_notices', 'sqlite_plugin_admin_notice' ); // Add the admin notices.
-
-// Remove the PL-plugin admin notices for SQLite.
-remove_action( 'admin_notices', 'perflab_sqlite_plugin_admin_notice' );
+add_action( is_multisite() ? 'network_admin_notices' : 'admin_notices', 'sqlite_plugin_admin_notice' ); // Add the admin notices.

wp/wp-content/plugins/sqlite-database-integration/admin-page.php

@@ -12,20 +12,30 @@
  * @since 1.0.0
  */
 function sqlite_add_admin_menu() {
-	add_options_page(
+	$parent_slug = is_multisite() ? 'settings.php' : 'options-general.php';
+
+	add_submenu_page(
+		$parent_slug,
 		__( 'SQLite integration', 'sqlite-database-integration' ),
 		__( 'SQLite integration', 'sqlite-database-integration' ),
-		'manage_options',
+		sqlite_plugin_get_manage_capability(),
 		'sqlite-integration',
 		'sqlite_integration_admin_screen'
 	);
 }
-add_action( 'admin_menu', 'sqlite_add_admin_menu' );
+add_action( is_multisite() ? 'network_admin_menu' : 'admin_menu', 'sqlite_add_admin_menu' );
 
 /**
  * The admin page contents.
  */
 function sqlite_integration_admin_screen() {
+	if ( ! current_user_can( sqlite_plugin_get_manage_capability() ) ) {
+		wp_die(
+			esc_html__( 'Sorry, you are not allowed to access the SQLite integration settings.', 'sqlite-database-integration' ),
+			403
+		);
+	}
+
 	$db_dropin_path = WP_CONTENT_DIR . '/db.php';
 
 	/*
@@ -56,7 +66,7 @@ function sqlite_integration_admin_screen() {
 					printf(
 						/* translators: 1: Admin URL to deactivate the module, 2: db.php drop-in path, */
 						__( 'The SQLite drop-in is enabled. To disable it and get back to your previous, MySQL database, you can <a href="%1$s">deactivate the plugin</a>. Alternatively, you can manually delete the %2$s file from your server.', 'sqlite-database-integration' ),
-						esc_url( admin_url( 'plugins.php' ) ),
+						esc_url( self_admin_url( 'plugins.php' ) ),
 						'<code>' . esc_html( basename( WP_CONTENT_DIR ) ) . '/db.php</code>'
 					);
 				?>
@@ -66,40 +76,17 @@ function sqlite_integration_admin_screen() {
 				<p><?php esc_html_e( 'We detected that the PDO SQLite driver is missing from your server (the pdo_sqlite extension is not loaded). Please make sure that SQLite is enabled in your PHP installation before proceeding.', 'sqlite-database-integration' ); ?></p>
 			</div>
 		<?php elseif ( file_exists( $db_dropin_path ) && ! defined( 'SQLITE_DB_DROPIN_VERSION' ) && ! $override_db_dropin ) : ?>
-			<?php if ( defined( 'PERFLAB_SQLITE_DB_DROPIN_VERSION' ) ) : ?>
-				<div class="notice notice-warning">
-					<p>
-						<?php
-						printf(
-							/* translators: %s: db.php drop-in path */
-							esc_html__( 'An older %s file was detected. Please click the button below to update the file.', 'sqlite-database-integration' ),
-							'<code>' . esc_html( basename( WP_CONTENT_DIR ) ) . '/db.php</code>'
-						);
-						?>
-					</p>
-				</div>
-				<a class="button button-primary" href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin.php?page=sqlite-integration&confirm-install&upgrade-from-pl' ), 'sqlite-install' ) ); ?>">
+			<div class="notice notice-error">
+				<p>
 					<?php
 					printf(
 						/* translators: %s: db.php drop-in path */
-						esc_html__( 'Update %s file', 'sqlite-database-integration' ),
+						esc_html__( 'The SQLite plugin cannot be activated because a different %s drop-in already exists.', 'sqlite-database-integration' ),
 						'<code>' . esc_html( basename( WP_CONTENT_DIR ) ) . '/db.php</code>'
 					);
 					?>
-				</a>
-			<?php else : ?>
-				<div class="notice notice-error">
-					<p>
-						<?php
-						printf(
-							/* translators: %s: db.php drop-in path */
-							esc_html__( 'The SQLite plugin cannot be activated because a different %s drop-in already exists.', 'sqlite-database-integration' ),
-							'<code>' . esc_html( basename( WP_CONTENT_DIR ) ) . '/db.php</code>'
-						);
-						?>
-					</p>
-				</div>
-			<?php endif; ?>
+				</p>
+			</div>
 		<?php elseif ( ! is_writable( WP_CONTENT_DIR ) ) : ?>
 			<div class="notice notice-error">
 				<p>
@@ -136,7 +123,7 @@ function sqlite_integration_admin_screen() {
 
 			<p><?php esc_html_e( 'By clicking the button below, you will be redirected to the WordPress installation screen to setup your new database', 'sqlite-database-integration' ); ?></p>
 
-			<a class="button button-primary" href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin.php?page=sqlite-integration&confirm-install' ), 'sqlite-install' ) ); ?>"><?php esc_html_e( 'Install SQLite database', 'sqlite-database-integration' ); ?></a>
+			<a class="button button-primary" href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'confirm-install', '1', sqlite_plugin_get_admin_page_url() ), 'sqlite-install' ) ); ?>"><?php esc_html_e( 'Install SQLite database', 'sqlite-database-integration' ); ?></a>
 		<?php endif; ?>
 	</div>
 	<?php
@@ -152,6 +139,10 @@ function sqlite_integration_admin_screen() {
  * @param WP_Admin_Bar $admin_bar The admin bar object.
  */
 function sqlite_plugin_adminbar_item( $admin_bar ) {
+	if ( ! current_user_can( sqlite_plugin_get_manage_capability() ) ) {
+		return;
+	}
+
 	global $wpdb;
 
 	if ( defined( 'SQLITE_DB_DROPIN_VERSION' ) && defined( 'DB_ENGINE' ) && 'sqlite' === DB_ENGINE ) {
@@ -166,9 +157,23 @@ function sqlite_plugin_adminbar_item( $admin_bar ) {
 		'id'     => 'sqlite-db-integration',
 		'parent' => 'top-secondary',
 		'title'  => $title,
-		'href'   => esc_url( admin_url( 'options-general.php?page=sqlite-integration' ) ),
+		'href'   => esc_url( sqlite_plugin_get_admin_page_url() ),
 		'meta'   => false,
 	);
 	$admin_bar->add_node( $args );
 }
 add_action( 'admin_bar_menu', 'sqlite_plugin_adminbar_item', 999 );
+
+/**
+ * Get the SQLite integration admin page URL.
+ *
+ * @access private
+ *
+ * @return string Admin page URL.
+ */
+function sqlite_plugin_get_admin_page_url() {
+	if ( is_multisite() ) {
+		return network_admin_url( 'settings.php?page=sqlite-integration' );
+	}
+	return admin_url( 'options-general.php?page=sqlite-integration' );
+}

wp/wp-content/plugins/sqlite-database-integration/capabilities.php

@@ -0,0 +1,80 @@
+<?php
+
+/**
+ * Require SQLite management permission to deactivate an active integration.
+ *
+ * WordPress checks this capability when one plugin is deactivated, including
+ * each plugin in a site-level batch. It skips this per-plugin check for a
+ * Network Admin batch, so that case is handled separately below.
+ *
+ * @access private
+ *
+ * @param string[] $caps    Primitive capabilities required of the user.
+ * @param string   $cap     Capability being checked.
+ * @param int      $user_id User ID.
+ * @param mixed[]  $args    Additional capability arguments.
+ * @return string[] Required primitive capabilities.
+ */
+function sqlite_plugin_map_deactivation_capability( $caps, $cap, $user_id, $args ) {
+	if (
+		'deactivate_plugin' === $cap
+		&& isset( $args[0] )
+		&& plugin_basename( SQLITE_MAIN_FILE ) === $args[0]
+		&& sqlite_plugin_has_active_dropin()
+	) {
+		$caps[] = sqlite_plugin_get_manage_capability();
+	}
+	return $caps;
+}
+add_filter( 'map_meta_cap', 'sqlite_plugin_map_deactivation_capability', 10, 4 );
+
+/**
+ * WordPress does not check each plugin's permission when deactivating a Network
+ * Admin batch. Remove SQLite from the batch when the user cannot manage the
+ * network-wide drop-in, while allowing the other selected plugins to continue.
+ *
+ * @access private
+ */
+function sqlite_plugin_filter_network_bulk_deactivation() {
+	$is_network_bulk_deactivation = is_network_admin()
+		&& isset( $_REQUEST['action'] )
+		&& is_string( $_REQUEST['action'] )
+		&& 'deactivate-selected' === wp_unslash( $_REQUEST['action'] );
+
+	if (
+		$is_network_bulk_deactivation
+		&& sqlite_plugin_has_active_dropin()
+		&& ! current_user_can( sqlite_plugin_get_manage_capability() )
+	) {
+		/*
+		 * Remove only SQLite from the submitted list. WordPress will still check
+		 * whether the user may run bulk deactivation and whether the request is
+		 * valid before it deactivates the plugins left in the list.
+		 */
+		$plugins          = isset( $_POST['checked'] ) ? (array) $_POST['checked'] : array();
+		$_POST['checked'] = array_values( array_diff( $plugins, array( plugin_basename( SQLITE_MAIN_FILE ) ) ) );
+	}
+}
+add_action( 'load-plugins.php', 'sqlite_plugin_filter_network_bulk_deactivation' );
+
+/**
+ * Check whether the SQLite database drop-in is active.
+ *
+ * @access private
+ *
+ * @return bool Whether the SQLite database drop-in is active.
+ */
+function sqlite_plugin_has_active_dropin() {
+	return defined( 'SQLITE_DB_DROPIN_VERSION' ) && file_exists( WP_CONTENT_DIR . '/db.php' );
+}
+
+/**
+ * Get the capability required to manage the SQLite integration.
+ *
+ * @access private
+ *
+ * @return string Required capability.
+ */
+function sqlite_plugin_get_manage_capability() {
+	return is_multisite() ? 'manage_network_options' : 'manage_options';
+}

wp/wp-content/plugins/sqlite-database-integration/constants.php

@@ -10,9 +10,6 @@
 if ( ! defined( 'DB_ENGINE' ) ) {
 	if ( defined( 'SQLITE_DB_DROPIN_VERSION' ) ) {
 		define( 'DB_ENGINE', 'sqlite' );
-	} elseif ( defined( 'DATABASE_ENGINE' ) ) {
-		// backwards compatibility with previous versions of the plugin.
-		define( 'DB_ENGINE', DATABASE_ENGINE );
 	} else {
 		define( 'DB_ENGINE', 'mysql' );
 	}