*
* @since 1.0.0
*
- * @param string $string Content to filter through kses
- * @param array $allowed_html List of allowed HTML elements
- * @param array $allowed_protocols Optional. Allowed protocol in links.
+ * @param string $string Content to filter through kses
+ * @param array $allowed_html List of allowed HTML elements
+ * @param array $allowed_protocols Optional. Allowed protocol in links.
* @return string Filtered content with only allowed HTML elements
*/
function wp_kses( $string, $allowed_html, $allowed_protocols = array() ) {
if ( empty( $allowed_protocols ) )
$allowed_protocols = wp_allowed_protocols();
- $string = wp_kses_no_null($string);
+ $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
$string = wp_kses_js_entities($string);
$string = wp_kses_normalize_entities($string);
$string = wp_kses_hook($string, $allowed_html, $allowed_protocols); // WP changed the order of these funcs and added args to wp_kses_hook
$allowed_protocols = wp_allowed_protocols();
$string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
$string = wp_kses_js_entities( $string );
- $string = wp_kses_normalize_entities( $string );
-
+
// Preserve leading and trailing whitespace.
$matches = array();
preg_match('/^\s*/', $string, $matches);
$quote = '"';
}
- // Sanitize quotes and angle braces.
- $value = htmlspecialchars( $value, ENT_QUOTES, null, false );
+ // Sanitize quotes, angle braces, and entities.
+ $value = esc_attr( $value );
// Sanitize URI values.
if ( in_array( strtolower( $name ), $uris ) ) {
*
* @since 3.5.0
*
- * @param string $context The context for which to retrieve tags. Allowed values are
- * post | strip | data | entities or the name of a field filter such as pre_user_description.
+ * @global array $allowedposttags
+ * @global array $allowedtags
+ * @global array $allowedentitynames
+ *
+ * @param string $context The context for which to retrieve tags.
+ * Allowed values are post, strip, data,entities, or
+ * the name of a field filter such as pre_user_description.
* @return array List of allowed tags and their allowed attributes.
*/
function wp_kses_allowed_html( $context = '' ) {
*
* @since 1.0.0
*
- * @param string $string Content to filter through kses
- * @param array $allowed_html List of allowed HTML elements
- * @param array $allowed_protocols Allowed protocol in links
+ * @param string $string Content to filter through kses
+ * @param array $allowed_html List of allowed HTML elements
+ * @param array $allowed_protocols Allowed protocol in links
* @return string Filtered content through 'pre_kses' hook
*/
function wp_kses_hook( $string, $allowed_html, $allowed_protocols ) {
* @param array $allowed_html Allowed HTML elements.
* @param array $allowed_protocols Allowed protocol in links.
*/
- $string = apply_filters( 'pre_kses', $string, $allowed_html, $allowed_protocols );
- return $string;
+ return apply_filters( 'pre_kses', $string, $allowed_html, $allowed_protocols );
}
/**
*
* @since 1.0.0
*
- * @param string $string Content to filter
- * @param array $allowed_html Allowed HTML elements
- * @param array $allowed_protocols Allowed protocols to keep
+ * @global array $pass_allowed_html
+ * @global array $pass_allowed_protocols
+ *
+ * @param string $string Content to filter
+ * @param array $allowed_html Allowed HTML elements
+ * @param array $allowed_protocols Allowed protocols to keep
* @return string Content with fixed HTML tags
*/
function wp_kses_split( $string, $allowed_html, $allowed_protocols ) {
*
* @since 3.1.0
* @access private
+ *
+ * @global array $pass_allowed_html
+ * @global array $pass_allowed_protocols
+ *
+ * @return string
*/
function _wp_kses_split_callback( $match ) {
global $pass_allowed_html, $pass_allowed_protocols;
* @access private
* @since 1.0.0
*
- * @param string $string Content to filter
- * @param array $allowed_html Allowed HTML elements
- * @param array $allowed_protocols Allowed protocols to keep
+ * @param string $string Content to filter
+ * @param array $allowed_html Allowed HTML elements
+ * @param array $allowed_protocols Allowed protocols to keep
* @return string Fixed HTML element
*/
function wp_kses_split2($string, $allowed_html, $allowed_protocols) {
*
* @since 1.0.0
*
- * @param string $element HTML element/tag
- * @param string $attr HTML attributes from HTML element to closing HTML element tag
- * @param array $allowed_html Allowed HTML elements
- * @param array $allowed_protocols Allowed protocols to keep
+ * @param string $element HTML element/tag
+ * @param string $attr HTML attributes from HTML element to closing HTML element tag
+ * @param array $allowed_html Allowed HTML elements
+ * @param array $allowed_protocols Allowed protocols to keep
* @return string Sanitized HTML element
*/
function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) {
- // Is there a closing XHTML slash at the end of the attributes?
-
if ( ! is_array( $allowed_html ) )
$allowed_html = wp_kses_allowed_html( $allowed_html );
+ // Is there a closing XHTML slash at the end of the attributes?
$xhtml_slash = '';
if (preg_match('%\s*/\s*$%', $attr))
$xhtml_slash = ' /';
*
* @since 1.0.0
*
- * @param string $attr Attribute list from HTML element to closing HTML element tag
- * @param array $allowed_protocols Allowed protocols to keep
+ * @param string $attr Attribute list from HTML element to closing HTML element tag
+ * @param array $allowed_protocols Allowed protocols to keep
* @return array List of attributes after parsing
*/
function wp_kses_hair($attr, $allowed_protocols) {
*
* @since 1.0.0
*
- * @param string $value Attribute value
- * @param string $vless Whether the value is valueless. Use 'y' or 'n'
- * @param string $checkname What $checkvalue is checking for.
- * @param mixed $checkvalue What constraint the value should pass
+ * @param string $value Attribute value
+ * @param string $vless Whether the value is valueless. Use 'y' or 'n'
+ * @param string $checkname What $checkvalue is checking for.
+ * @param mixed $checkvalue What constraint the value should pass
* @return bool Whether check passes
*/
function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) {
*
* @since 1.0.0
*
- * @param string $string Content to filter bad protocols from
- * @param array $allowed_protocols Allowed protocols to keep
+ * @param string $string Content to filter bad protocols from
+ * @param array $allowed_protocols Allowed protocols to keep
* @return string Filtered content
*/
function wp_kses_bad_protocol($string, $allowed_protocols) {
* @since 1.0.0
*
* @param string $string
+ * @param array $options Set 'slash_zero' => 'keep' when '\0' is allowed. Default is 'remove'.
* @return string
*/
-function wp_kses_no_null($string) {
- $string = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F]/', '', $string);
- $string = preg_replace('/(\\\\0)+/', '', $string);
+function wp_kses_no_null( $string, $options = null ) {
+ if ( ! isset( $options['slash_zero'] ) ) {
+ $options = array( 'slash_zero' => 'remove' );
+ }
+
+ $string = preg_replace( '/[\x00-\x08\x0B\x0C\x0E-\x1F]/', '', $string );
+ if ( 'remove' == $options['slash_zero'] ) {
+ $string = preg_replace( '/\\\\+0+/', '', $string );
+ }
return $string;
}
*
* @since 1.0.0
*
- * @param string $string Content to check for bad protocols
+ * @param string $string Content to check for bad protocols
* @param string $allowed_protocols Allowed protocols
* @return string Sanitized content
*/
* @access private
* @since 1.0.0
*
- * @param string $string URI scheme to check against the whitelist
+ * @param string $string URI scheme to check against the whitelist
* @param string $allowed_protocols Allowed protocols
* @return string Sanitized content
*/
*/
function wp_kses_normalize_entities($string) {
// Disarm all entities by converting & to &
-
$string = str_replace('&', '&', $string);
// Change back the allowed entities in our entity whitelist
-
$string = preg_replace_callback('/&([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string);
$string = preg_replace_callback('/&#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $string);
$string = preg_replace_callback('/&#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $string);
*
* @since 3.0.0
*
+ * @global array $allowedentitynames
+ *
* @param array $matches preg_replace_callback() matches array
* @return string Correctly encoded entity
*/
return '';
$i = $matches[1];
- return ( ( ! in_array($i, $allowedentitynames) ) ? "&$i;" : "&$i;" );
+ return ( ! in_array( $i, $allowedentitynames ) ) ? "&$i;" : "&$i;";
}
/**
return '';
$hexchars = $matches[1];
- return ( ( ! valid_unicode(hexdec($hexchars)) ) ? "&#x$hexchars;" : '&#x'.ltrim($hexchars,'0').';' );
+ return ( ! valid_unicode( hexdec( $hexchars ) ) ) ? "&#x$hexchars;" : '&#x'.ltrim($hexchars,'0').';';
}
/**
* @return string Filtered content
*/
function wp_kses_data( $data ) {
- return wp_kses( $data , current_filter() );
+ return wp_kses( $data, current_filter() );
}
/**
* @param string $data Post content to filter, expected to be escaped with slashes
* @return string Filtered post content with allowed HTML tags and attributes intact.
*/
-function wp_filter_post_kses($data) {
- return addslashes ( wp_kses( stripslashes( $data ), 'post' ) );
+function wp_filter_post_kses( $data ) {
+ return addslashes( wp_kses( stripslashes( $data ), 'post' ) );
}
/**
* @param string $data Post content to filter
* @return string Filtered post content with allowed HTML tags and attributes intact.
*/
-function wp_kses_post($data) {
- return wp_kses( $data , 'post' );
+function wp_kses_post( $data ) {
+ return wp_kses( $data, 'post' );
}
/**
* @return string Filtered content without any HTML
*/
function wp_filter_nohtml_kses( $data ) {
- return addslashes ( wp_kses( stripslashes( $data ), 'strip' ) );
+ return addslashes( wp_kses( stripslashes( $data ), 'strip' ) );
}
/**
function kses_init() {
kses_remove_filters();
- if (current_user_can('unfiltered_html') == false)
+ if ( ! current_user_can( 'unfiltered_html' ) ) {
kses_init_filters();
+ }
}
/**
scripts.mit.edu / autoinstalls / wordpress.git / blobdiff