Merge branch 'trunk' into html-api/add-css-selector-parser

src/wp-admin/edit-tag-form.php

@@ -44,7 +44,7 @@
 	do_action_deprecated( 'edit_tag_form_pre', array( $tag ), '3.0.0', '{$taxonomy}_pre_edit_form' );
 }
 
-$wp_http_referer = ! empty( $_REQUEST['wp_http_referer'] ) ? sanitize_text_field( $_REQUEST['wp_http_referer'] ) : '';
+$wp_http_referer = ! empty( $_REQUEST['wp_http_referer'] ) ? sanitize_url( $_REQUEST['wp_http_referer'] ) : '';
 $wp_http_referer = remove_query_arg( array( 'action', 'message', 'tag_ID' ), $wp_http_referer );
 
 // Also used by Edit Tags.

src/wp-admin/includes/media.php

@@ -773,7 +773,7 @@ function media_upload_form_handler() {
 				$post['menu_order'] = $attachment['menu_order'];
 			}
 
-			if ( isset( $send_id ) && $attachment_id == $send_id ) {
+			if ( isset( $send_id ) && $attachment_id === $send_id ) {
 				if ( isset( $attachment['post_parent'] ) ) {
 					$post['post_parent'] = $attachment['post_parent'];
 				}

src/wp-admin/user-edit.php

@@ -14,7 +14,7 @@
 
 $action          = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
 $user_id         = ! empty( $_REQUEST['user_id'] ) ? absint( $_REQUEST['user_id'] ) : 0;
-$wp_http_referer = ! empty( $_REQUEST['wp_http_referer'] ) ? sanitize_text_field( $_REQUEST['wp_http_referer'] ) : '';
+$wp_http_referer = ! empty( $_REQUEST['wp_http_referer'] ) ? sanitize_url( $_REQUEST['wp_http_referer'] ) : '';
 
 $current_user = wp_get_current_user();
 

src/wp-includes/class-wp-query.php

@@ -442,6 +442,7 @@ class WP_Query {
 	 * via pre_get_posts hooks.
 	 *
 	 * @since 3.1.1
+	 * @var bool
 	 */
 	private $query_vars_changed = true;
 

src/wp-includes/class-wp-theme-json.php

@@ -1317,6 +1317,8 @@ public function get_settings() {
 	 *                          - `variables`: only the CSS Custom Properties for presets & custom ones.
 	 *                          - `styles`: only the styles section in theme.json.
 	 *                          - `presets`: only the classes for the presets.
+	 *                          - `base-layout-styles`: only the base layout styles.
+	 *                          - `custom-css`: only the custom CSS.
 	 * @param string[] $origins A list of origins to include. By default it includes VALID_ORIGINS.
 	 * @param array    $options {
 	 *     Optional. An array of options for now used for internal purposes only (may change without notice).

src/wp-includes/comment-template.php

@@ -961,7 +961,7 @@ function comments_number( $zero = false, $one = false, $more = false, $post = 0
  * @return string Language string for the number of comments a post has.
  */
 function get_comments_number_text( $zero = false, $one = false, $more = false, $post = 0 ) {
-	$comments_number = get_comments_number( $post );
+	$comments_number = (int) get_comments_number( $post );
 
 	if ( $comments_number > 1 ) {
 		if ( false === $more ) {
@@ -996,7 +996,7 @@ function get_comments_number_text( $zero = false, $one = false, $more = false, $
 
 			$comments_number_text = str_replace( '%', number_format_i18n( $comments_number ), $more );
 		}
-	} elseif ( 0 == $comments_number ) {
+	} elseif ( 0 === $comments_number ) {
 		$comments_number_text = ( false === $zero ) ? __( 'No Comments' ) : $zero;
 	} else { // Must be one.
 		$comments_number_text = ( false === $one ) ? __( '1 Comment' ) : $one;
@@ -1648,7 +1648,7 @@ function comments_template( $file = '/comments.php', $separate_comments = false
 function comments_popup_link( $zero = false, $one = false, $more = false, $css_class = '', $none = false ) {
 	$post_id         = get_the_ID();
 	$post_title      = get_the_title();
-	$comments_number = get_comments_number( $post_id );
+	$comments_number = (int) get_comments_number( $post_id );
 
 	if ( false === $zero ) {
 		/* translators: %s: Post title. */
@@ -1675,7 +1675,7 @@ function comments_popup_link( $zero = false, $one = false, $more = false, $css_c
 		$none = sprintf( __( 'Comments Off<span class="screen-reader-text"> on %s</span>' ), $post_title );
 	}
 
-	if ( 0 == $comments_number && ! comments_open() && ! pings_open() ) {
+	if ( 0 === $comments_number && ! comments_open() && ! pings_open() ) {
 		printf(
 			'<span%1$s>%2$s</span>',
 			! empty( $css_class ) ? ' class="' . esc_attr( $css_class ) . '"' : '',
@@ -1689,7 +1689,7 @@ function comments_popup_link( $zero = false, $one = false, $more = false, $css_c
 		return;
 	}
 
-	if ( 0 == $comments_number ) {
+	if ( 0 === $comments_number ) {
 		$respond_link = get_permalink() . '#respond';
 		/**
 		 * Filters the respond link when a post has no comments.
@@ -1773,7 +1773,10 @@ function get_comment_reply_link( $args = array(), $comment = null, $post = null
 
 	$args = wp_parse_args( $args, $defaults );
 
-	if ( 0 == $args['depth'] || $args['max_depth'] <= $args['depth'] ) {
+	$args['max_depth'] = (int) $args['max_depth'];
+	$args['depth']     = (int) $args['depth'];
+
+	if ( 0 === $args['depth'] || $args['max_depth'] <= $args['depth'] ) {
 		return;
 	}
 

src/wp-includes/deprecated.php

@@ -6316,7 +6316,7 @@ function wp_interactivity_process_directives_of_interactive_blocks( array $parse
  * Gets the global styles custom CSS from theme.json.
  *
  * @since 6.2.0
- * @deprecated 6.7.0 Use {@see 'wp_get_global_stylesheet'} instead.
+ * @deprecated 6.7.0 Use {@see 'wp_get_global_stylesheet'} instead for top-level custom CSS, or {@see 'WP_Theme_JSON::get_styles_for_block'} for block-level custom CSS.
  *
  * @return string The global styles custom CSS.
  */

src/wp-includes/global-styles-and-settings.php

@@ -142,7 +142,7 @@ function wp_get_global_styles( $path = array(), $context = array() ) {
  * @since 6.6.0 Resolves relative paths in theme.json styles to theme absolute paths.
  *
  * @param array $types Optional. Types of styles to load.
- *                     It accepts as values 'variables', 'presets', 'styles', 'base-layout-styles'.
+ *                     See {@see 'WP_Theme_JSON::get_stylesheet'} for all valid types.
  *                     If empty, it'll load the following:
  *                     - for themes without theme.json: 'variables', 'presets', 'base-layout-styles'.
  *                     - for themes with theme.json: 'variables', 'presets', 'styles'.

src/wp-includes/html-api/class-wp-html-processor.php

@@ -2387,7 +2387,14 @@ private function step_in_body(): bool {
 				 */
 
 				$this->state->insertion_mode = WP_HTML_Processor_State::INSERTION_MODE_AFTER_BODY;
-				return true;
+				/*
+				 * The BODY element is not removed from the stack of open elements.
+				 * Only internal state has changed, this does not qualify as a "step"
+				 * in terms of advancing through the document to another token.
+				 * Nothing has been pushed or popped.
+				 * Proceed to parse the next item.
+				 */
+				return $this->step();
 
 			/*
 			 * > An end tag whose tag name is "html"
@@ -4460,7 +4467,14 @@ private function step_after_body(): bool {
 				}
 
 				$this->state->insertion_mode = WP_HTML_Processor_State::INSERTION_MODE_AFTER_AFTER_BODY;
-				return true;
+				/*
+				 * The HTML element is not removed from the stack of open elements.
+				 * Only internal state has changed, this does not qualify as a "step"
+				 * in terms of advancing through the document to another token.
+				 * Nothing has been pushed or popped.
+				 * Proceed to parse the next item.
+				 */
+				return $this->step();
 		}
 
 		/*
@@ -4655,7 +4669,14 @@ private function step_after_frameset(): bool {
 			 */
 			case '-HTML':
 				$this->state->insertion_mode = WP_HTML_Processor_State::INSERTION_MODE_AFTER_AFTER_FRAMESET;
-				return true;
+				/*
+				 * The HTML element is not removed from the stack of open elements.
+				 * Only internal state has changed, this does not qualify as a "step"
+				 * in terms of advancing through the document to another token.
+				 * Nothing has been pushed or popped.
+				 * Proceed to parse the next item.
+				 */
+				return $this->step();
 
 			/*
 			 * > A start tag whose tag name is "noframes"