Disable external entities in ID3.

Built from https://develop.svn.wordpress.org/trunk@29378


git-svn-id: http://core.svn.wordpress.org/trunk@29156 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Media modal/grid: get the proper .attachment width in arrow navigation. Props avryl, see #27423.
Built from https://develop.svn.wordpress.org/trunk@29379


git-svn-id: http://core.svn.wordpress.org/trunk@29157 1a063a9b-81f0-0310-95a4-ce76da25c4cd
TinyMCE: add support for `class` attribute on the caption shortcode. Part props knutsp, kadamwhite, fixes #28951.
Built from https://develop.svn.wordpress.org/trunk@29380


git-svn-id: http://core.svn.wordpress.org/trunk@29158 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Avoid PHP notices in wp-login.php if password reset cookie is not set.

props mdawaffe.
see #29060.
Built from https://develop.svn.wordpress.org/trunk@29381


git-svn-id: http://core.svn.wordpress.org/trunk@29159 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Constant time for wp_verify_nonce().

Built from https://develop.svn.wordpress.org/trunk@29382


git-svn-id: http://core.svn.wordpress.org/trunk@29160 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Media modal/grid: fix the position of attachment icons, restore the background, fix in ie8. See #27423.
Built from https://develop.svn.wordpress.org/trunk@29393


git-svn-id: http://core.svn.wordpress.org/trunk@29171 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Escape late in get_avatar().

Built from https://develop.svn.wordpress.org/trunk@29397


git-svn-id: http://core.svn.wordpress.org/trunk@29175 1a063a9b-81f0-0310-95a4-ce76da25c4cd