X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/38ac4bc40322ecdc4052db4263466573e01fa51f..refs/tags/wordpress-4.3:/wp-includes/kses.php?ds=inline diff --git a/wp-includes/kses.php b/wp-includes/kses.php index 8733f536..578c5ba4 100644 --- a/wp-includes/kses.php +++ b/wp-includes/kses.php @@ -513,15 +513,15 @@ if ( ! CUSTOM_TAGS ) { * * @since 1.0.0 * - * @param string $string Content to filter through kses - * @param array $allowed_html List of allowed HTML elements - * @param array $allowed_protocols Optional. Allowed protocol in links. + * @param string $string Content to filter through kses + * @param array $allowed_html List of allowed HTML elements + * @param array $allowed_protocols Optional. Allowed protocol in links. * @return string Filtered content with only allowed HTML elements */ function wp_kses( $string, $allowed_html, $allowed_protocols = array() ) { if ( empty( $allowed_protocols ) ) $allowed_protocols = wp_allowed_protocols(); - $string = wp_kses_no_null($string); + $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) ); $string = wp_kses_js_entities($string); $string = wp_kses_normalize_entities($string); $string = wp_kses_hook($string, $allowed_html, $allowed_protocols); // WP changed the order of these funcs and added args to wp_kses_hook @@ -546,8 +546,7 @@ function wp_kses_one_attr( $string, $element ) { $allowed_protocols = wp_allowed_protocols(); $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) ); $string = wp_kses_js_entities( $string ); - $string = wp_kses_normalize_entities( $string ); - + // Preserve leading and trailing whitespace. $matches = array(); preg_match('/^\s*/', $string, $matches); @@ -582,8 +581,8 @@ function wp_kses_one_attr( $string, $element ) { $quote = '"'; } - // Sanitize quotes and angle braces. - $value = htmlspecialchars( $value, ENT_QUOTES, null, false ); + // Sanitize quotes, angle braces, and entities. + $value = esc_attr( $value ); // Sanitize URI values. if ( in_array( strtolower( $name ), $uris ) ) { @@ -609,8 +608,13 @@ function wp_kses_one_attr( $string, $element ) { * * @since 3.5.0 * - * @param string $context The context for which to retrieve tags. Allowed values are - * post | strip | data | entities or the name of a field filter such as pre_user_description. + * @global array $allowedposttags + * @global array $allowedtags + * @global array $allowedentitynames + * + * @param string $context The context for which to retrieve tags. + * Allowed values are post, strip, data,entities, or + * the name of a field filter such as pre_user_description. * @return array List of allowed tags and their allowed attributes. */ function wp_kses_allowed_html( $context = '' ) { @@ -664,9 +668,9 @@ function wp_kses_allowed_html( $context = '' ) { * * @since 1.0.0 * - * @param string $string Content to filter through kses - * @param array $allowed_html List of allowed HTML elements - * @param array $allowed_protocols Allowed protocol in links + * @param string $string Content to filter through kses + * @param array $allowed_html List of allowed HTML elements + * @param array $allowed_protocols Allowed protocol in links * @return string Filtered content through 'pre_kses' hook */ function wp_kses_hook( $string, $allowed_html, $allowed_protocols ) { @@ -679,8 +683,7 @@ function wp_kses_hook( $string, $allowed_html, $allowed_protocols ) { * @param array $allowed_html Allowed HTML elements. * @param array $allowed_protocols Allowed protocol in links. */ - $string = apply_filters( 'pre_kses', $string, $allowed_html, $allowed_protocols ); - return $string; + return apply_filters( 'pre_kses', $string, $allowed_html, $allowed_protocols ); } /** @@ -701,9 +704,12 @@ function wp_kses_version() { * * @since 1.0.0 * - * @param string $string Content to filter - * @param array $allowed_html Allowed HTML elements - * @param array $allowed_protocols Allowed protocols to keep + * @global array $pass_allowed_html + * @global array $pass_allowed_protocols + * + * @param string $string Content to filter + * @param array $allowed_html Allowed HTML elements + * @param array $allowed_protocols Allowed protocols to keep * @return string Content with fixed HTML tags */ function wp_kses_split( $string, $allowed_html, $allowed_protocols ) { @@ -718,6 +724,11 @@ function wp_kses_split( $string, $allowed_html, $allowed_protocols ) { * * @since 3.1.0 * @access private + * + * @global array $pass_allowed_html + * @global array $pass_allowed_protocols + * + * @return string */ function _wp_kses_split_callback( $match ) { global $pass_allowed_html, $pass_allowed_protocols; @@ -739,9 +750,9 @@ function _wp_kses_split_callback( $match ) { * @access private * @since 1.0.0 * - * @param string $string Content to filter - * @param array $allowed_html Allowed HTML elements - * @param array $allowed_protocols Allowed protocols to keep + * @param string $string Content to filter + * @param array $allowed_html Allowed HTML elements + * @param array $allowed_protocols Allowed protocols to keep * @return string Fixed HTML element */ function wp_kses_split2($string, $allowed_html, $allowed_protocols) { @@ -798,18 +809,17 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) { * * @since 1.0.0 * - * @param string $element HTML element/tag - * @param string $attr HTML attributes from HTML element to closing HTML element tag - * @param array $allowed_html Allowed HTML elements - * @param array $allowed_protocols Allowed protocols to keep + * @param string $element HTML element/tag + * @param string $attr HTML attributes from HTML element to closing HTML element tag + * @param array $allowed_html Allowed HTML elements + * @param array $allowed_protocols Allowed protocols to keep * @return string Sanitized HTML element */ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) { - // Is there a closing XHTML slash at the end of the attributes? - if ( ! is_array( $allowed_html ) ) $allowed_html = wp_kses_allowed_html( $allowed_html ); + // Is there a closing XHTML slash at the end of the attributes? $xhtml_slash = ''; if (preg_match('%\s*/\s*$%', $attr)) $xhtml_slash = ' /'; @@ -896,8 +906,8 @@ function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowe * * @since 1.0.0 * - * @param string $attr Attribute list from HTML element to closing HTML element tag - * @param array $allowed_protocols Allowed protocols to keep + * @param string $attr Attribute list from HTML element to closing HTML element tag + * @param array $allowed_protocols Allowed protocols to keep * @return array List of attributes after parsing */ function wp_kses_hair($attr, $allowed_protocols) { @@ -1123,10 +1133,10 @@ function wp_kses_hair_parse( $attr ) { * * @since 1.0.0 * - * @param string $value Attribute value - * @param string $vless Whether the value is valueless. Use 'y' or 'n' - * @param string $checkname What $checkvalue is checking for. - * @param mixed $checkvalue What constraint the value should pass + * @param string $value Attribute value + * @param string $vless Whether the value is valueless. Use 'y' or 'n' + * @param string $checkname What $checkvalue is checking for. + * @param mixed $checkvalue What constraint the value should pass * @return bool Whether check passes */ function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) { @@ -1197,8 +1207,8 @@ function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) { * * @since 1.0.0 * - * @param string $string Content to filter bad protocols from - * @param array $allowed_protocols Allowed protocols to keep + * @param string $string Content to filter bad protocols from + * @param array $allowed_protocols Allowed protocols to keep * @return string Filtered content */ function wp_kses_bad_protocol($string, $allowed_protocols) { @@ -1224,11 +1234,18 @@ function wp_kses_bad_protocol($string, $allowed_protocols) { * @since 1.0.0 * * @param string $string + * @param array $options Set 'slash_zero' => 'keep' when '\0' is allowed. Default is 'remove'. * @return string */ -function wp_kses_no_null($string) { - $string = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F]/', '', $string); - $string = preg_replace('/(\\\\0)+/', '', $string); +function wp_kses_no_null( $string, $options = null ) { + if ( ! isset( $options['slash_zero'] ) ) { + $options = array( 'slash_zero' => 'remove' ); + } + + $string = preg_replace( '/[\x00-\x08\x0B\x0C\x0E-\x1F]/', '', $string ); + if ( 'remove' == $options['slash_zero'] ) { + $string = preg_replace( '/\\\\+0+/', '', $string ); + } return $string; } @@ -1308,7 +1325,7 @@ function wp_kses_html_error($string) { * * @since 1.0.0 * - * @param string $string Content to check for bad protocols + * @param string $string Content to check for bad protocols * @param string $allowed_protocols Allowed protocols * @return string Sanitized content */ @@ -1339,7 +1356,7 @@ function wp_kses_bad_protocol_once($string, $allowed_protocols, $count = 1 ) { * @access private * @since 1.0.0 * - * @param string $string URI scheme to check against the whitelist + * @param string $string URI scheme to check against the whitelist * @param string $allowed_protocols Allowed protocols * @return string Sanitized content */ @@ -1375,11 +1392,9 @@ function wp_kses_bad_protocol_once2( $string, $allowed_protocols ) { */ function wp_kses_normalize_entities($string) { // Disarm all entities by converting & to & - $string = str_replace('&', '&', $string); // Change back the allowed entities in our entity whitelist - $string = preg_replace_callback('/&([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string); $string = preg_replace_callback('/&#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $string); $string = preg_replace_callback('/&#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $string); @@ -1395,6 +1410,8 @@ function wp_kses_normalize_entities($string) { * * @since 3.0.0 * + * @global array $allowedentitynames + * * @param array $matches preg_replace_callback() matches array * @return string Correctly encoded entity */ @@ -1405,7 +1422,7 @@ function wp_kses_named_entities($matches) { return ''; $i = $matches[1]; - return ( ( ! in_array($i, $allowedentitynames) ) ? "&$i;" : "&$i;" ); + return ( ! in_array( $i, $allowedentitynames ) ) ? "&$i;" : "&$i;"; } /** @@ -1451,7 +1468,7 @@ function wp_kses_normalize_entities3($matches) { return ''; $hexchars = $matches[1]; - return ( ( ! valid_unicode(hexdec($hexchars)) ) ? "&#x$hexchars;" : '&#x'.ltrim($hexchars,'0').';' ); + return ( ! valid_unicode( hexdec( $hexchars ) ) ) ? "&#x$hexchars;" : '&#x'.ltrim($hexchars,'0').';'; } /** @@ -1527,7 +1544,7 @@ function wp_filter_kses( $data ) { * @return string Filtered content */ function wp_kses_data( $data ) { - return wp_kses( $data , current_filter() ); + return wp_kses( $data, current_filter() ); } /** @@ -1541,8 +1558,8 @@ function wp_kses_data( $data ) { * @param string $data Post content to filter, expected to be escaped with slashes * @return string Filtered post content with allowed HTML tags and attributes intact. */ -function wp_filter_post_kses($data) { - return addslashes ( wp_kses( stripslashes( $data ), 'post' ) ); +function wp_filter_post_kses( $data ) { + return addslashes( wp_kses( stripslashes( $data ), 'post' ) ); } /** @@ -1556,8 +1573,8 @@ function wp_filter_post_kses($data) { * @param string $data Post content to filter * @return string Filtered post content with allowed HTML tags and attributes intact. */ -function wp_kses_post($data) { - return wp_kses( $data , 'post' ); +function wp_kses_post( $data ) { + return wp_kses( $data, 'post' ); } /** @@ -1569,7 +1586,7 @@ function wp_kses_post($data) { * @return string Filtered content without any HTML */ function wp_filter_nohtml_kses( $data ) { - return addslashes ( wp_kses( stripslashes( $data ), 'strip' ) ); + return addslashes( wp_kses( stripslashes( $data ), 'strip' ) ); } /** @@ -1641,8 +1658,9 @@ function kses_remove_filters() { function kses_init() { kses_remove_filters(); - if (current_user_can('unfiltered_html') == false) + if ( ! current_user_can( 'unfiltered_html' ) ) { kses_init_filters(); + } } /**