X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/38ac4bc40322ecdc4052db4263466573e01fa51f..0459461f9ea42e0b090759ff6fe5f48360bef750:/wp-includes/kses.php diff --git a/wp-includes/kses.php b/wp-includes/kses.php index 8733f536..4827b0de 100644 --- a/wp-includes/kses.php +++ b/wp-includes/kses.php @@ -97,6 +97,9 @@ if ( ! CUSTOM_TAGS ) { 'src' => true, ), 'b' => array(), + 'bdo' => array( + 'dir' => true, + ), 'big' => array(), 'blockquote' => array( 'cite' => true, @@ -513,15 +516,15 @@ if ( ! CUSTOM_TAGS ) { * * @since 1.0.0 * - * @param string $string Content to filter through kses - * @param array $allowed_html List of allowed HTML elements - * @param array $allowed_protocols Optional. Allowed protocol in links. + * @param string $string Content to filter through kses + * @param array $allowed_html List of allowed HTML elements + * @param array $allowed_protocols Optional. Allowed protocol in links. * @return string Filtered content with only allowed HTML elements */ function wp_kses( $string, $allowed_html, $allowed_protocols = array() ) { if ( empty( $allowed_protocols ) ) $allowed_protocols = wp_allowed_protocols(); - $string = wp_kses_no_null($string); + $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) ); $string = wp_kses_js_entities($string); $string = wp_kses_normalize_entities($string); $string = wp_kses_hook($string, $allowed_html, $allowed_protocols); // WP changed the order of these funcs and added args to wp_kses_hook @@ -546,8 +549,7 @@ function wp_kses_one_attr( $string, $element ) { $allowed_protocols = wp_allowed_protocols(); $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) ); $string = wp_kses_js_entities( $string ); - $string = wp_kses_normalize_entities( $string ); - + // Preserve leading and trailing whitespace. $matches = array(); preg_match('/^\s*/', $string, $matches); @@ -582,8 +584,8 @@ function wp_kses_one_attr( $string, $element ) { $quote = '"'; } - // Sanitize quotes and angle braces. - $value = htmlspecialchars( $value, ENT_QUOTES, null, false ); + // Sanitize quotes, angle braces, and entities. + $value = esc_attr( $value ); // Sanitize URI values. if ( in_array( strtolower( $name ), $uris ) ) { @@ -609,8 +611,13 @@ function wp_kses_one_attr( $string, $element ) { * * @since 3.5.0 * - * @param string $context The context for which to retrieve tags. Allowed values are - * post | strip | data | entities or the name of a field filter such as pre_user_description. + * @global array $allowedposttags + * @global array $allowedtags + * @global array $allowedentitynames + * + * @param string $context The context for which to retrieve tags. + * Allowed values are post, strip, data,entities, or + * the name of a field filter such as pre_user_description. * @return array List of allowed tags and their allowed attributes. */ function wp_kses_allowed_html( $context = '' ) { @@ -664,9 +671,9 @@ function wp_kses_allowed_html( $context = '' ) { * * @since 1.0.0 * - * @param string $string Content to filter through kses - * @param array $allowed_html List of allowed HTML elements - * @param array $allowed_protocols Allowed protocol in links + * @param string $string Content to filter through kses + * @param array $allowed_html List of allowed HTML elements + * @param array $allowed_protocols Allowed protocol in links * @return string Filtered content through 'pre_kses' hook */ function wp_kses_hook( $string, $allowed_html, $allowed_protocols ) { @@ -679,8 +686,7 @@ function wp_kses_hook( $string, $allowed_html, $allowed_protocols ) { * @param array $allowed_html Allowed HTML elements. * @param array $allowed_protocols Allowed protocol in links. */ - $string = apply_filters( 'pre_kses', $string, $allowed_html, $allowed_protocols ); - return $string; + return apply_filters( 'pre_kses', $string, $allowed_html, $allowed_protocols ); } /** @@ -701,9 +707,12 @@ function wp_kses_version() { * * @since 1.0.0 * - * @param string $string Content to filter - * @param array $allowed_html Allowed HTML elements - * @param array $allowed_protocols Allowed protocols to keep + * @global array $pass_allowed_html + * @global array $pass_allowed_protocols + * + * @param string $string Content to filter + * @param array $allowed_html Allowed HTML elements + * @param array $allowed_protocols Allowed protocols to keep * @return string Content with fixed HTML tags */ function wp_kses_split( $string, $allowed_html, $allowed_protocols ) { @@ -718,6 +727,11 @@ function wp_kses_split( $string, $allowed_html, $allowed_protocols ) { * * @since 3.1.0 * @access private + * + * @global array $pass_allowed_html + * @global array $pass_allowed_protocols + * + * @return string */ function _wp_kses_split_callback( $match ) { global $pass_allowed_html, $pass_allowed_protocols; @@ -739,9 +753,9 @@ function _wp_kses_split_callback( $match ) { * @access private * @since 1.0.0 * - * @param string $string Content to filter - * @param array $allowed_html Allowed HTML elements - * @param array $allowed_protocols Allowed protocols to keep + * @param string $string Content to filter + * @param array $allowed_html Allowed HTML elements + * @param array $allowed_protocols Allowed protocols to keep * @return string Fixed HTML element */ function wp_kses_split2($string, $allowed_html, $allowed_protocols) { @@ -798,18 +812,17 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) { * * @since 1.0.0 * - * @param string $element HTML element/tag - * @param string $attr HTML attributes from HTML element to closing HTML element tag - * @param array $allowed_html Allowed HTML elements - * @param array $allowed_protocols Allowed protocols to keep + * @param string $element HTML element/tag + * @param string $attr HTML attributes from HTML element to closing HTML element tag + * @param array $allowed_html Allowed HTML elements + * @param array $allowed_protocols Allowed protocols to keep * @return string Sanitized HTML element */ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) { - // Is there a closing XHTML slash at the end of the attributes? - if ( ! is_array( $allowed_html ) ) $allowed_html = wp_kses_allowed_html( $allowed_html ); + // Is there a closing XHTML slash at the end of the attributes? $xhtml_slash = ''; if (preg_match('%\s*/\s*$%', $attr)) $xhtml_slash = ' /'; @@ -896,8 +909,8 @@ function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowe * * @since 1.0.0 * - * @param string $attr Attribute list from HTML element to closing HTML element tag - * @param array $allowed_protocols Allowed protocols to keep + * @param string $attr Attribute list from HTML element to closing HTML element tag + * @param array $allowed_protocols Allowed protocols to keep * @return array List of attributes after parsing */ function wp_kses_hair($attr, $allowed_protocols) { @@ -1123,10 +1136,10 @@ function wp_kses_hair_parse( $attr ) { * * @since 1.0.0 * - * @param string $value Attribute value - * @param string $vless Whether the value is valueless. Use 'y' or 'n' - * @param string $checkname What $checkvalue is checking for. - * @param mixed $checkvalue What constraint the value should pass + * @param string $value Attribute value + * @param string $vless Whether the value is valueless. Use 'y' or 'n' + * @param string $checkname What $checkvalue is checking for. + * @param mixed $checkvalue What constraint the value should pass * @return bool Whether check passes */ function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) { @@ -1197,8 +1210,8 @@ function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) { * * @since 1.0.0 * - * @param string $string Content to filter bad protocols from - * @param array $allowed_protocols Allowed protocols to keep + * @param string $string Content to filter bad protocols from + * @param array $allowed_protocols Allowed protocols to keep * @return string Filtered content */ function wp_kses_bad_protocol($string, $allowed_protocols) { @@ -1224,11 +1237,18 @@ function wp_kses_bad_protocol($string, $allowed_protocols) { * @since 1.0.0 * * @param string $string + * @param array $options Set 'slash_zero' => 'keep' when '\0' is allowed. Default is 'remove'. * @return string */ -function wp_kses_no_null($string) { - $string = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F]/', '', $string); - $string = preg_replace('/(\\\\0)+/', '', $string); +function wp_kses_no_null( $string, $options = null ) { + if ( ! isset( $options['slash_zero'] ) ) { + $options = array( 'slash_zero' => 'remove' ); + } + + $string = preg_replace( '/[\x00-\x08\x0B\x0C\x0E-\x1F]/', '', $string ); + if ( 'remove' == $options['slash_zero'] ) { + $string = preg_replace( '/\\\\+0+/', '', $string ); + } return $string; } @@ -1308,7 +1328,7 @@ function wp_kses_html_error($string) { * * @since 1.0.0 * - * @param string $string Content to check for bad protocols + * @param string $string Content to check for bad protocols * @param string $allowed_protocols Allowed protocols * @return string Sanitized content */ @@ -1339,7 +1359,7 @@ function wp_kses_bad_protocol_once($string, $allowed_protocols, $count = 1 ) { * @access private * @since 1.0.0 * - * @param string $string URI scheme to check against the whitelist + * @param string $string URI scheme to check against the whitelist * @param string $allowed_protocols Allowed protocols * @return string Sanitized content */ @@ -1375,11 +1395,9 @@ function wp_kses_bad_protocol_once2( $string, $allowed_protocols ) { */ function wp_kses_normalize_entities($string) { // Disarm all entities by converting & to & - $string = str_replace('&', '&', $string); // Change back the allowed entities in our entity whitelist - $string = preg_replace_callback('/&([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string); $string = preg_replace_callback('/&#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $string); $string = preg_replace_callback('/&#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $string); @@ -1395,6 +1413,8 @@ function wp_kses_normalize_entities($string) { * * @since 3.0.0 * + * @global array $allowedentitynames + * * @param array $matches preg_replace_callback() matches array * @return string Correctly encoded entity */ @@ -1405,7 +1425,7 @@ function wp_kses_named_entities($matches) { return ''; $i = $matches[1]; - return ( ( ! in_array($i, $allowedentitynames) ) ? "&$i;" : "&$i;" ); + return ( ! in_array( $i, $allowedentitynames ) ) ? "&$i;" : "&$i;"; } /** @@ -1451,7 +1471,7 @@ function wp_kses_normalize_entities3($matches) { return ''; $hexchars = $matches[1]; - return ( ( ! valid_unicode(hexdec($hexchars)) ) ? "&#x$hexchars;" : '&#x'.ltrim($hexchars,'0').';' ); + return ( ! valid_unicode( hexdec( $hexchars ) ) ) ? "&#x$hexchars;" : '&#x'.ltrim($hexchars,'0').';'; } /** @@ -1527,7 +1547,7 @@ function wp_filter_kses( $data ) { * @return string Filtered content */ function wp_kses_data( $data ) { - return wp_kses( $data , current_filter() ); + return wp_kses( $data, current_filter() ); } /** @@ -1541,8 +1561,8 @@ function wp_kses_data( $data ) { * @param string $data Post content to filter, expected to be escaped with slashes * @return string Filtered post content with allowed HTML tags and attributes intact. */ -function wp_filter_post_kses($data) { - return addslashes ( wp_kses( stripslashes( $data ), 'post' ) ); +function wp_filter_post_kses( $data ) { + return addslashes( wp_kses( stripslashes( $data ), 'post' ) ); } /** @@ -1556,8 +1576,21 @@ function wp_filter_post_kses($data) { * @param string $data Post content to filter * @return string Filtered post content with allowed HTML tags and attributes intact. */ -function wp_kses_post($data) { - return wp_kses( $data , 'post' ); +function wp_kses_post( $data ) { + return wp_kses( $data, 'post' ); +} + +/** + * Navigates through an array, object, or scalar, and sanitizes content for + * allowed HTML tags for post content. + * + * @since 4.4.2 + * + * @param mixed $value The array or string to filter. + * @return mixed $value The filtered content. + */ +function wp_kses_post_deep( $data ) { + return map_deep( $data, 'wp_kses_post' ); } /** @@ -1569,7 +1602,7 @@ function wp_kses_post($data) { * @return string Filtered content without any HTML */ function wp_filter_nohtml_kses( $data ) { - return addslashes ( wp_kses( stripslashes( $data ), 'strip' ) ); + return addslashes( wp_kses( stripslashes( $data ), 'strip' ) ); } /** @@ -1641,8 +1674,9 @@ function kses_remove_filters() { function kses_init() { kses_remove_filters(); - if (current_user_can('unfiltered_html') == false) + if ( ! current_user_can( 'unfiltered_html' ) ) { kses_init_filters(); + } } /** @@ -1676,10 +1710,10 @@ function safecss_filter_attr( $css, $deprecated = '' ) { 'border-right-style', 'border-right-width', 'border-spacing', 'border-style', 'border-top', 'border-top-color', 'border-top-style', 'border-top-width', 'border-width', 'caption-side', 'clear', 'cursor', 'direction', 'font', 'font-family', 'font-size', 'font-style', - 'font-variant', 'font-weight', 'height', 'letter-spacing', 'line-height', 'margin-bottom', + 'font-variant', 'font-weight', 'height', 'min-height','max-height' , 'letter-spacing', 'line-height', 'margin-bottom', 'margin-left', 'margin-right', 'margin-top', 'overflow', 'padding', 'padding-bottom', 'padding-left', 'padding-right', 'padding-top', 'text-decoration', 'text-indent', 'vertical-align', - 'width' ) ); + 'width', 'min-width', 'max-width' ) ); if ( empty($allowed_attr) ) return $css;