New build

_inc/blocks/editor-beta.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'moment', 'react', 'wp-a11y', 'wp-annotations', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-date', 'wp-dom-ready', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-token-list', 'wp-url', 'wp-viewport'), 'version' => '295375463d722af4f07c96b236cc4478');
+<?php return array('dependencies' => array('lodash', 'moment', 'react', 'wp-a11y', 'wp-annotations', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-date', 'wp-dom-ready', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-token-list', 'wp-url', 'wp-viewport'), 'version' => '91152a25e6c0e871711245f6ed3459b5');

_inc/blocks/editor-experimental.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'moment', 'react', 'wp-a11y', 'wp-annotations', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-date', 'wp-dom-ready', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-token-list', 'wp-url', 'wp-viewport'), 'version' => '067080d9902c4569f231fb44f39ed07c');
+<?php return array('dependencies' => array('lodash', 'moment', 'react', 'wp-a11y', 'wp-annotations', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-date', 'wp-dom-ready', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-token-list', 'wp-url', 'wp-viewport'), 'version' => 'b6bc2036e862e456b7b68214a04aac67');

_inc/blocks/editor.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'moment', 'react', 'wp-a11y', 'wp-annotations', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-date', 'wp-dom-ready', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-token-list', 'wp-url', 'wp-viewport'), 'version' => '1fbd9512619d1c40bb35ff7c3c2bb240');
+<?php return array('dependencies' => array('lodash', 'moment', 'react', 'wp-a11y', 'wp-annotations', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-date', 'wp-dom-ready', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-escape-html', 'wp-hooks', 'wp-i18n', 'wp-keycodes', 'wp-notices', 'wp-plugins', 'wp-polyfill', 'wp-token-list', 'wp-url', 'wp-viewport'), 'version' => '0fe2b4ee78f0ce71bbe2631c0f7fbd9e');

_inc/build/admin.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-components', 'wp-element', 'wp-i18n', 'wp-polyfill'), 'version' => 'fdc6822ed485833013d1e25c57c8d2c4');
+<?php return array('dependencies' => array('lodash', 'moment', 'react', 'react-dom', 'wp-components', 'wp-element', 'wp-i18n', 'wp-polyfill'), 'version' => '12ede2807225d7390a647b6efd055f75');

_inc/lib/class-jetpack-tweetstorm-helper.php

@@ -9,6 +9,7 @@
 use Automattic\Jetpack\Connection\Client;
 use Automattic\Jetpack\Status;
 use Twitter\Text\Regex as Twitter_Regex;
+use Twitter\Text\Validator as Twitter_Validator;
 
 /**
  * Class Jetpack_Tweetstorm_Helper
@@ -612,9 +613,12 @@ private static function add_embed_to_tweets( $block ) {
 
 		$current_tweet = self::get_current_tweet();
 
+		$reserved_characters  = count( $current_tweet['media'] ) * self::$characters_per_media;
+		$reserved_characters += 1 + self::$characters_per_url;
+
 		// We can only attach an embed to the previous tweet if it doesn't already
-		// have any URLs in it.
-		if ( preg_match( '/url-placeholder-\d+-*/', $current_tweet['text'] ) ) {
+		// have any URLs in it. Also, we can't attach it if it'll make the tweet too long.
+		if ( preg_match( '/url-placeholder-\d+-*/', $current_tweet['text'] ) || ! self::is_valid_tweet( $current_tweet['text'], $reserved_characters ) ) {
 			$current_tweet         = self::start_new_tweet();
 			$current_tweet['text'] = self::generate_url_placeholder( $block['embed'] );
 		} else {
@@ -1314,6 +1318,8 @@ private static function extract_tag_content_from_html( $tags, $html ) {
 
 		$tokens = wp_html_split( $html );
 
+		$validator = new Twitter_Validator();
+
 		foreach ( $tags as $tag ) {
 			$values[ $tag ] = array();
 
@@ -1356,7 +1362,7 @@ private static function extract_tag_content_from_html( $tags, $html ) {
 					// A link has opened, grab the URL for inserting later.
 					if ( 0 === strpos( $token, '<a ' ) ) {
 						$href_values = self::extract_attr_content_from_html( 'a', 'href', $token );
-						if ( ! empty( $href_values[0] ) ) {
+						if ( ! empty( $href_values[0] ) && $validator->isValidURL( $href_values[0] ) ) {
 							// Remember the URL.
 							$current_url = $href_values[0];
 						}
@@ -1413,8 +1419,19 @@ private static function extract_tag_content_from_html( $tags, $html ) {
 						$offset += self::$characters_per_url - strlen( $url );
 
 						// If we're in a link with a URL set, there's no need to keep two copies of the same link.
-						if ( $url === $current_url ) {
-							$current_url = '';
+						if ( ! empty( $current_url ) ) {
+							$lower_url         = strtolower( $url );
+							$lower_current_url = strtolower( $current_url );
+
+							if ( $lower_url === $lower_current_url ) {
+								$current_url = '';
+							}
+
+							// Check that the link text isn't just a shortened version of the href value.
+							$trimmed_current_url = preg_replace( '|^https?://|', '', $lower_current_url );
+							if ( $lower_url === $trimmed_current_url || trim( $trimmed_current_url, '/' ) === $lower_url ) {
+								$current_url = '';
+							}
 						}
 					}
 

_inc/lib/class.media-extractor.php

@@ -244,7 +244,12 @@ public static function extract_from_content( $content, $what_to_extract = self::
 					$url = wp_parse_url( $link_raw );
 
 					// Data URI links.
-					if ( isset( $url['scheme'] ) && 'data' === $url['scheme'] ) {
+					if ( ! isset( $url['scheme'] ) || 'data' === $url['scheme'] ) {
+						continue;
+					}
+
+					// Reject invalid URLs.
+					if ( ! isset( $url['host'] ) ) {
 						continue;
 					}
 

extensions/blocks/publicize/twitter/options.js

@@ -25,7 +25,7 @@ const PublicizeTwitterOptions = ( {
 	setTweetstorm,
 	prePublish,
 } ) => {
-	if ( ! connections.some( connection => 'twitter' === connection.service_name ) ) {
+	if ( ! connections?.some( connection => 'twitter' === connection.service_name ) ) {
 		return null;
 	}
 

functions.opengraph.php

@@ -18,6 +18,8 @@
  * Outputs Open Graph tags generated by Jetpack.
  */
 function jetpack_og_tags() {
+	global $post;
+	$data = $post; // so that we don't accidentally explode the global.
 	/**
 	 * Allow Jetpack to output Open Graph Meta Tags.
 	 *
@@ -114,10 +116,7 @@ function jetpack_og_tags() {
 				$tags['og:description'] = $archive->description;
 			}
 		}
-	} elseif ( is_singular() ) {
-		global $post;
-		$data = $post; // so that we don't accidentally explode the global.
-
+	} elseif ( is_singular() && is_a( $data, 'WP_Post' ) ) {
 		$tags['og:type'] = 'article';
 		if ( empty( $data->post_title ) ) {
 			$tags['og:title'] = ' ';

jetpack.php

@@ -4,7 +4,7 @@
  * Plugin URI: https://jetpack.com
  * Description: Bring the power of the WordPress.com cloud to your self-hosted WordPress. Jetpack enables you to connect your blog to a WordPress.com account to use the powerful features normally only available to WordPress.com users.
  * Author: Automattic
- * Version: 9.0.1
+ * Version: 9.0.2
  * Author URI: https://jetpack.com
  * License: GPL2+
  * Text Domain: jetpack
@@ -16,7 +16,7 @@
 
 define( 'JETPACK__MINIMUM_WP_VERSION', '5.4' );
 define( 'JETPACK__MINIMUM_PHP_VERSION', '5.6' );
-define( 'JETPACK__VERSION', '9.0.1' );
+define( 'JETPACK__VERSION', '9.0.2' );
 
 /**
  * Constant used to fetch the connection owner token

json-endpoints/class.wpcom-json-api-upload-media-v1-1-endpoint.php

@@ -108,8 +108,10 @@ function callback( $path = '', $blog_id = 0 ) {
 
 		// Normal WPCOM upload processing
 		if ( count( $other_media_files ) > 0 || count( $media_urls ) > 0 ) {
-			add_filter( 'wp_handle_upload_prefilter', array( $this, 'check_upload_size' ), 9 ); // used for direct media uploads.
-			add_filter( 'wp_handle_sideload_prefilter', array( $this, 'check_upload_size' ), 9 ); // used for uploading media via url.
+			if ( is_multisite() ) { // Do not check for available space in non multisites.
+				add_filter( 'wp_handle_upload_prefilter', array( $this, 'check_upload_size' ), 9 ); // used for direct media uploads.
+				add_filter( 'wp_handle_sideload_prefilter', array( $this, 'check_upload_size' ), 9 ); // used for uploading media via url.
+			}
 
 			$create_media = $this->handle_media_creation_v1_1( $other_media_files, $media_urls, $media_attrs );
 			$media_ids = $create_media['media_ids'];

modules/shortcodes/instagram.php

@@ -102,9 +102,6 @@ function jetpack_instagram_embed_reversal( $content ) {
 function jetpack_instagram_handler( $matches, $atts, $url ) {
 	global $content_width;
 
-	// keep a copy of the passed-in URL since it's modified below.
-	$passed_url = $url;
-
 	$max_width = 698;
 	$min_width = 320;
 
@@ -144,17 +141,8 @@ function jetpack_instagram_handler( $matches, $atts, $url ) {
 		$atts['width'] = $min_width;
 	}
 
-	// remove the modal param from the URL.
-	$url = remove_query_arg( 'modal', $url );
-
-	// force .com instead of .am for https support.
-	$url = str_replace( 'instagr.am', 'instagram.com', $url );
-
-	// The oembed endpoint expects HTTP, but HTTP requests 301 to HTTPS.
-	$instagram_http_url = str_replace( 'https://', 'http://', $url );
-
 	$url_args = array(
-		'url'        => $instagram_http_url,
+		'url'        => $url,
 		'maxwidth'   => $atts['width'],
 		'omitscript' => 1,
 	);
@@ -163,7 +151,7 @@ function jetpack_instagram_handler( $matches, $atts, $url ) {
 		$url_args['hidecaption'] = 'true';
 	}
 
-	$use_cache     = jetpack_instagram_use_cache( $matches, $atts, $passed_url );
+	$use_cache     = jetpack_instagram_use_cache( $matches, $atts, $url );
 	$cache_key     = 'oembed_response_body_' . md5( add_query_arg( $url_args, 'https://api.instagram.com/oembed/' ) );
 	$response_body = $use_cache
 		? wp_cache_get( $cache_key, 'instagram_embeds' )
@@ -271,6 +259,13 @@ function jetpack_instagram_use_cache( $matches, $atts, $passed_url ) {
 function jetpack_instagram_fetch_embed( $args ) {
 	$access_token = jetpack_instagram_get_access_token();
 
+	// Attempt to clean query params from the URL since Facebook's new API for Instagram
+	// embeds does not like query parameters. See p7H4VZ-2DU-p2.
+	$parsed_url = wp_parse_url( $args['url'] );
+	if ( $parsed_url ) {
+		$args['url'] = 'https://www.instagram.com' . $parsed_url['path'];
+	}
+
 	// If an access token exists, which will be the case for WPCOM, then we will call the Facebook API directly.
 	// Otherwise, proxy the request through the WordPress.com API using the blog token to sign the request.
 	if ( ! empty( $access_token ) ) {
@@ -282,6 +277,21 @@ function jetpack_instagram_fetch_embed( $args ) {
 			)
 		);
 		$response             = wp_remote_get( $url, array( 'redirection' => 0 ) );
+
+		// Unset before calling the action below.
+		unset( $args['access_token'] );
+
+		/**
+		 * Fires after making a request for an Instagram embed.
+		 *
+		 * @module shortcodes
+		 *
+		 * @since  9.1.0
+		 *
+		 * @param array $response The response from the embed request.
+		 * @param array $url      The arguments sent with the request.
+		 */
+		do_action( 'jetpack_instagram_embed_request', $response, $args );
 	} else {
 		if ( ! Jetpack::is_active_and_not_offline_mode() ) {
 			return new WP_Error(

readme.txt

@@ -1,7 +1,7 @@
 === Jetpack - WP Security, Backup, Speed, & Growth ===
 Contributors: automattic, adamkheckler, aduth, akirk, allendav, alternatekev, andy, annezazu, apeatling, azaozz, batmoo, barry, beaulebens, biskobe, blobaugh, brbrr, cainm, cena, cfinke, chaselivingston, chellycat, clickysteve, csonnek, danielbachhuber, davoraltman, daniloercoli, delawski, designsimply, dllh, drawmyface, dsmart, dzver, ebinnion, egregor, eliorivero, enej, eoigal, erania-pinnera, ethitter, fgiannar, gcorne, georgestephanis, gibrown, goldsounds, hew, hugobaeta, hypertextranch, iammattthomas, iandunn, jblz, jasmussen, jeffgolenski, jeherve, jenhooks, jenia, jessefriedman, jgs, jkudish, jmdodd, joanrho, johnjamesjacoby, jshreve, kbrownkd, keoshi, koke, kraftbj, lancewillett, leogermani, lschuyler, macmanx, martinremy, matt, matveb, mattwiebe, maverick3x6, mcsf, mdawaffe, mdbitz, MichaelArestad, migueluy, mikeyarce, mkaz, nancythanki, nickmomrik, obenland, oskosk, pento, professor44, rachelsquirrel, rdcoll, ryancowles, richardmuscat, richardmtl, robertbpugh, roccotripaldi, samhotchkiss, scarstocea, scottsweb, sdquirk, sermitr, simison, stephdau, tmoorewp, tyxla, Viper007Bond, westi, yoavf, zinigor
 Tags: WP, backup, social, AMP, WooCommerce, malware, scan, spam, CDN, social
-Stable tag: 9.0.1
+Stable tag: 9.0.2
 Requires at least: 5.4
 Requires PHP: 5.6
 Tested up to: 5.5
@@ -32,7 +32,7 @@ Get blazing fast site speed with Jetpack, the premier WP plugin built to leverag
 
 * Jetpack has partnered with Google AMP to create the best, highest performance all-in-one toolkit for WordPress. By using Jetpack and AMP together, you get all the features you need to build a beautiful, fast, modern website with no coding required.
 * Image CDN for images and static files, like CSS and JavaScript, served from our servers, not yours, which saves you money and bandwidth.
-* Lazy load images for a super fast experience, even on mobile. Jetpack’s lazy loading automatically delays the loading of media on your posts and pages until your visitors scroll down to where they appear on the page. 
+* Lazy load images for a super fast experience, even on mobile. Jetpack’s lazy loading automatically delays the loading of media on your posts and pages until your visitors scroll down to where they appear on the page.
 * Unlimited, high speed, ad free video hosting keeps the focus on your content, not on ads or recommendations that lead people off site.
 * Custom site search is incredibly powerful and customizable. Helps your visitors instantly find the right content so they read and buy more. Works great with WooCommerce / eCommerce sites to help filter products so customers get what they want on your site faster.
 * Recommended to use with WP Super Cache for ultimate WordPress site speed.
@@ -119,7 +119,7 @@ Once you’ve installed Jetpack, your stats will be available on your Jetpack da
 
 There are opportunities for developers at all levels to contribute. [Learn more about contributing to Jetpack](https://jetpack.com/contribute) or consider [joining our beta program](https://jetpack.com/beta).
 
-= Is Jetpack CRM included in the Jetpack plugin? = 
+= Is Jetpack CRM included in the Jetpack plugin? =
 
 No, please download the separate Jetpack CRM plugin to use Jetpack CRM.
 
@@ -204,7 +204,7 @@ Blocks are the individual sections that make up a page. There are many block typ
 * Tiled Gallery Block - With Tiled Galleries you can display your image galleries in four styles: tiled mosaic, circular grid, square tiles, and tiled columns.
 * Video Block - The Video block enhances the existing WordPress Video block and allows you to upload videos from your computer to be hosted on WordPress.com, rather than on your host’s servers.
 * WhatsApp Button Block - The WhatsAPP Button block will allow your customers to send them a message to enquire about their product or services, or ask for support. Clicking on the button will open WhatsApp and pre-fill the phone number and initial message.
- 
+
 Jetpack has also created extensions for some WordPress core blocks:
 
 * Unrolling Tweet Threads – This extension to the Twitter block allows you to import an entire Tweet thread into the editor as native blocks.
@@ -213,21 +213,21 @@ Jetpack has also created extensions for some WordPress core blocks:
 = Do I need an SSL certificate? =
 
 You don’t need an SSL Certificate to run Jetpack on your WordPress website. However, it’s recommended to integrate them both into your overall security strategy. An SSL certificate (Secure Sockets Layer certificate) creates a secure connection between your website and your site visitors’ browsers. It encrypts any data shared on your site — like addresses, emails, phone numbers, and credit card information — and protects that data from hackers.
- 
+
 If you don’t have an SSL certificate, your site will show a “not secure” warning on users’ browsers, which can reduce your legitimacy in their eyes. SSL certificates also have a positive impact on search engine rankings.
- 
+
 The process of setting up an SSL certificate will depend on your hosting provider. Some hosts include free certificates, while others charge annually.
 
 = How does Jetpack work with WP Super Cache? =
 
-WP Super Cache works by caching your WordPress pages as static HTML pages so that page requests, for an already cached page, do not need to be processed by the WordPress PHP scripts. Typically, most visitors of your site will view cached versions of the WordPress pages, so your server will have more processing power to serve an increased number of users. 
- 
+WP Super Cache works by caching your WordPress pages as static HTML pages so that page requests, for an already cached page, do not need to be processed by the WordPress PHP scripts. Typically, most visitors of your site will view cached versions of the WordPress pages, so your server will have more processing power to serve an increased number of users.
+
 Jetpack has an image CDN that works by caching and serving your WordPress images globally from its own servers. These plugins are both maintained by Automattic and work together to give you ultimate site speed.
 
 = What version of PHP do I need? =
 
 Sites must be built on PHP 5.6 or greater, but Jetpack always supports the latest version of PHP.
- 
+
 = Can Jetpack help my site comply with GDPR? =
 
 Our Cookie and Consent Banner can help you comply with GDPR. The European Union’s ePrivacy Directive (often referred to as the ‘cookie law’) and General Data Protection Regulation (GDPR) place requirements on website owners and operators to provide information about, and gain consent for their use of cookies.
@@ -243,6 +243,23 @@ Our Cookie and Consent Banner can help you comply with GDPR. The European Union
 
 == Changelog ==
 
+= 9.0.2 =
+
+* Release date: October 9, 2020
+
+**Enhancements**
+
+* Publicize: improve handling of URLs when generating Twitter threads.
+
+**Bug fixes**
+
+* Instagram Embeds: ensure that Instagram URLs with additional URL parameters can be embedded as well.
+* Media Extractor: prevent PHP notice for some URLs.
+* Publicize: avoid block editor errors when no Publicize connections are available.
+* Synchronization flow: avoid potential fatal errors when updating the plugin from the Dashboard > Updates screen.
+* Sharing: avoid PHP notices when a post object is invalid.
+* WordPress.com REST API: avoid errors when uploading images from a URL.
+
 = 9.0.1 =
 
 * Release date: October 6, 2020

vendor/autoload.php

@@ -4,4 +4,4 @@
 
 require_once __DIR__ . '/composer/autoload_real.php';
 
-return ComposerAutoloaderInitacc00ebcd28ded2c94b94c169e27e56b::getLoader();
+return ComposerAutoloaderInit2a838b7cba72c3204275bbd8904422c4::getLoader();

vendor/autoload_packages.php

@@ -5,7 +5,7 @@
  * @package automattic/jetpack-autoloader
  */
 
-namespace Automattic\Jetpack\Autoloader\jp89a260721a4ce26bb1d7b8b19b6d4c6c;
+namespace Automattic\Jetpack\Autoloader\jp95016e8b7af5cfd6a3cbf90d4433a769;
 
  // phpcs:ignore
 

vendor/automattic/jetpack-connection/src/class-client.php

@@ -23,7 +23,12 @@ class Client {
 	 * @return array|WP_Error WP HTTP response on success
 	 */
 	public static function remote_request( $args, $body = null ) {
-		Utils::init_default_constants();
+		add_filter(
+			'jetpack_constant_default_value',
+			__NAMESPACE__ . '\Utils::jetpack_api_constant_filter',
+			10,
+			2
+		);
 
 		$defaults = array(
 			'url'           => '',