Skip to content

Commit 50b9adb

Browse files
adamsilversteinadamsilverstein
committed
General: Bump the pinned hash for Gutenberg to dd294ab.
This updates the pinned commit hash of the Gutenberg repository from `943e0d825bb66ba582e9a10d32743cbb136de460` to `dd294ab86ceaf9f3d7d42a09b78f399238ce8826` and merges cherry-picked changes to the `wp/7.1` branch into the 7.1.1 release. Only the `editor` and `upload-media` package hashes changed in the regenerated manifest. A full list of changes included in this commit can be found on GitHub: WordPress/gutenberg@943e0d8...dd294ab The following commits are included: - useViewConfig: don't request the view config twice (WordPress/gutenberg#82183) - Framework: Update Node.js to v24 LTS and npm to v11 (WordPress/gutenberg#82635) - Block Editor: Add translator context to pseudo-state labels (WordPress/gutenberg#81770) - Fix: Post Editor: 403 on /wp/v2/settings at boot for users without manage_options cap (WordPress/gutenberg#81813) - Media: Refuse a multi-file drop on a placeholder that takes one file (WordPress/gutenberg#82046) - List: outdent an empty middle item without adding an item (WordPress/gutenberg#82011) - Accordion Panel: Reset padding-block when panel is hidden (WordPress/gutenberg#81782) - List View: Don't focus the last Table cell on keyboard activation (WordPress/gutenberg#81964) - Media: Stop claiming "Upload complete" when upload failed (WordPress/gutenberg#81397) - Media: keep indexed PNG sub-sizes indexed (WordPress/gutenberg#81884) - Image block cropping: Sync image size and link destination settings (WordPress/gutenberg#82316) - Gallery block: Fix 'Crop images to fit' broken in editor (WordPress/gutenberg#82318) - Pages: require authentication and a capability to render generated standalone pages (WordPress/gutenberg#82254) - Media Utils: Preserve arrays in multipart form data (WordPress/gutenberg#82353) - wp-env: Fix Docker build errors with Debian Bullseye repositories (WordPress/gutenberg#82478) - Query Loop: Fall back to `post` when the query has no `postType` (WordPress/gutenberg#82465) - Block Supports: Bail early in state styles when a block has no style attribute (WordPress/gutenberg#81908) - Fix: Restore layout styles for block style variations (WordPress/gutenberg#82335) - CI: Unify the automation comments into a single PR comment (WordPress/gutenberg#82249) - Editor: Store the finalize response as the attachment record (WordPress/gutenberg#81947) - Media: Only blame the browser's codecs when HEIC really cannot be decoded (WordPress/gutenberg#82265) The PHP changes carried by three of those pull requests do not travel through the package build and are already on the branch. Follow-up to [63319], [63489], [63547], [63572]. Reviewed by jorbin. Props andraganescu, wildworks. Fixes #66037. git-svn-id: https://develop.svn.wordpress.org/branches/7.1@63587 602fd350-edb4-49c9-b593-d223f7449a82
1 parent f2232f1 commit 50b9adb

5 files changed

Lines changed: 41 additions & 9 deletions

File tree

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"url": "https://develop.svn.wordpress.org/trunk"
88
},
99
"gutenberg": {
10-
"sha": "943e0d825bb66ba582e9a10d32743cbb136de460",
10+
"sha": "dd294ab86ceaf9f3d7d42a09b78f399238ce8826",
1111
"ghcrRepo": "WordPress/gutenberg/gutenberg-wp-develop-build"
1212
},
1313
"engines": {

‎src/wp-includes/assets/script-loader-packages.php‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@
104104
'wp-url',
105105
'wp-warning'
106106
),
107-
'version' => 'd3cbb2c45b145b27a5cf'
107+
'version' => '37e58da384b2558bd479'
108108
),
109109
'block-library.js' => array(
110110
'dependencies' => array(
@@ -150,7 +150,7 @@
150150
'import' => 'dynamic'
151151
)
152152
),
153-
'version' => '2e80403676c10cc0a473'
153+
'version' => '00e6e2a44788af201f35'
154154
),
155155
'block-serialization-default-parser.js' => array(
156156
'dependencies' => array(
@@ -402,7 +402,7 @@
402402
'import' => 'static'
403403
)
404404
),
405-
'version' => 'a7750dea8d5c880ddf33'
405+
'version' => 'a6cb1641d13f718c01bd'
406406
),
407407
'edit-site.js' => array(
408408
'dependencies' => array(
@@ -452,7 +452,7 @@
452452
'import' => 'static'
453453
)
454454
),
455-
'version' => '638e98d0061f4b9f1efb'
455+
'version' => '008f89f2cb2ad17a5947'
456456
),
457457
'edit-widgets.js' => array(
458458
'dependencies' => array(
@@ -543,7 +543,7 @@
543543
'import' => 'static'
544544
)
545545
),
546-
'version' => '2cd3b932f41a420d5904'
546+
'version' => 'af070cfff88093363220'
547547
),
548548
'element.js' => array(
549549
'dependencies' => array(
@@ -663,7 +663,7 @@
663663
'wp-url',
664664
'wp-warning'
665665
),
666-
'version' => 'b8bf604c1cc119e63ee6'
666+
'version' => '07c1c94f9b21baa97a96'
667667
),
668668
'notices.js' => array(
669669
'dependencies' => array(
@@ -881,7 +881,7 @@
881881
'import' => 'dynamic'
882882
)
883883
),
884-
'version' => 'f7174b0617bcd68e57c3'
884+
'version' => 'a2c026d433c295fd5145'
885885
),
886886
'url.js' => array(
887887
'dependencies' => array(

‎src/wp-includes/assets/script-modules-packages.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,7 @@
360360
'dependencies' => array(
361361

362362
),
363-
'version' => '685442d334b2d3e70832'
363+
'version' => '7e33cd8c4128731126e8'
364364
),
365365
'workflow/index.js' => array(
366366
'dependencies' => array(

‎src/wp-includes/build/pages/font-library/page.php‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -310,6 +310,22 @@ function ( $handle ) {
310310
function wp_font_library_intercept_render() {
311311
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
312312
if ( isset( $_GET['page'] ) && 'font-library' === $_GET['page'] ) {
313+
// The page renders outside the menu page callback flow, so it must
314+
// enforce authentication and capability checks itself. Without this,
315+
// any admin entry point firing `admin_init` (such as admin-post.php,
316+
// which serves logged-out requests) would render the page for
317+
// unauthenticated visitors.
318+
if ( ! is_user_logged_in() ) {
319+
auth_redirect();
320+
}
321+
322+
if ( ! current_user_can( 'edit_theme_options' ) ) {
323+
wp_die(
324+
__( 'Sorry, you are not allowed to access this page.' ),
325+
403
326+
);
327+
}
328+
313329
wp_font_library_render_page();
314330
exit;
315331
}

‎src/wp-includes/build/pages/options-connectors/page.php‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -310,6 +310,22 @@ function ( $handle ) {
310310
function wp_options_connectors_intercept_render() {
311311
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
312312
if ( isset( $_GET['page'] ) && 'options-connectors' === $_GET['page'] ) {
313+
// The page renders outside the menu page callback flow, so it must
314+
// enforce authentication and capability checks itself. Without this,
315+
// any admin entry point firing `admin_init` (such as admin-post.php,
316+
// which serves logged-out requests) would render the page for
317+
// unauthenticated visitors.
318+
if ( ! is_user_logged_in() ) {
319+
auth_redirect();
320+
}
321+
322+
if ( ! current_user_can( 'manage_options' ) ) {
323+
wp_die(
324+
__( 'Sorry, you are not allowed to access this page.' ),
325+
403
326+
);
327+
}
328+
313329
wp_options_connectors_render_page();
314330
exit;
315331
}

0 commit comments

Comments
 (0)