WordPress 4.2.5

[autoinstalls/wordpress.git] / wp-includes / shortcodes.php

diff --git a/wp-includes/shortcodes.php b/wp-includes/shortcodes.php
index 2661201bcc9a787522172af1bcee4094d010d1cb..810db20076918d7fad44bc848ff0ff0a28ede7d4 100644 (file)
--- a/wp-includes/shortcodes.php
+++ b/wp-includes/shortcodes.php
@@ -328,29 +328,10 @@ function do_shortcodes_in_html_tags( $content, $ignore_html ) {
        $trans = array( '[' => '[', ']' => ']' );
        
        $pattern = get_shortcode_regex();
-
-       $comment_regex =
-                 '!'           // Start of comment, after the <.
-               . '(?:'         // Unroll the loop: Consume everything until --> is found.
-               .     '-(?!->)' // Dash not followed by end of comment.
-               .     '[^\-]*+' // Consume non-dashes.
-               . ')*+'         // Loop possessively.
-               . '(?:-->)?';   // End of comment. If not found, match all input.
-
-       $regex =
-                 '/('                   // Capture the entire match.
-               .     '<'                // Find start of element.
-               .     '(?(?=!--)'        // Is this a comment?
-               .         $comment_regex // Find end of comment.
-               .     '|'
-               .         '[^>]*>?'      // Find end of element. If not found, match all input.
-               .     ')'
-               . ')/s';
-
-       $textarr = preg_split( $regex, $content, -1, PREG_SPLIT_DELIM_CAPTURE | PREG_SPLIT_NO_EMPTY );
+       $textarr = wp_html_split( $content );
 
        foreach ( $textarr as &$element ) {
-               if ( '<' !== $element[0] ) {
+               if ( '' == $element || '<' !== $element[0] ) {
                        continue;
                }
 
@@ -365,7 +346,7 @@ function do_shortcodes_in_html_tags( $content, $ignore_html ) {
                        continue;
                }
 
-               if ( $ignore_html || '<!--' === substr( $element, 0, 4 ) ) {
+               if ( $ignore_html || '<!--' === substr( $element, 0, 4 ) || '<![CDATA[' === substr( $element, 0, 9 ) ) {
                        // Encode all [ and ] chars.
                        $element = strtr( $element, $trans );
                        continue;
@@ -373,6 +354,11 @@ function do_shortcodes_in_html_tags( $content, $ignore_html ) {
 
                $attributes = wp_kses_attr_parse( $element );
                if ( false === $attributes ) {
+                       // Some plugins are doing things like [name] <[email]>.
+                       if ( 1 === preg_match( '%^<\s*\[\[?[^\[\]]+\]%', $element ) ) {
+                               $element = preg_replace_callback( "/$pattern/s", 'do_shortcode_tag', $element );
+                       }
+
                        // Looks like we found some crazy unfiltered HTML.  Skipping it for sanity.
                        $element = strtr( $element, $trans );
                        continue;
@@ -471,6 +457,15 @@ function shortcode_parse_atts($text) {
                        elseif (isset($m[8]))
                                $atts[] = stripcslashes($m[8]);
                }
+
+               // Reject any unclosed HTML elements
+               foreach( $atts as &$value ) {
+                       if ( false !== strpos( $value, '<' ) ) {
+                               if ( 1 !== preg_match( '/^[^<]*+(?:<[^>]*+>[^<]*+)*+$/', $value ) ) {
+                                       $value = '';
+                               }
+                       }
+               }
        } else {
                $atts = ltrim($text);
        }