X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/61343b82c4f0da4c68e4c6373daafff4a81efdd1..78ff9d91a14da1f53bd3f1ffcab1264d92359b72:/wp-includes/functions.php diff --git a/wp-includes/functions.php b/wp-includes/functions.php index f8b424a8..9b0335b6 100644 --- a/wp-includes/functions.php +++ b/wp-includes/functions.php @@ -242,9 +242,10 @@ function maybe_unserialize( $original ) { * @since 2.0.5 * * @param mixed $data Value to check to see if was serialized. + * @param bool $strict Optional. Whether to be strict about the end of the string. Defaults true. * @return bool False if not serialized and true if it was. */ -function is_serialized( $data ) { +function is_serialized( $data, $strict = true ) { // if it isn't a string, it isn't serialized if ( ! is_string( $data ) ) return false; @@ -256,21 +257,40 @@ function is_serialized( $data ) { return false; if ( ':' !== $data[1] ) return false; - $lastc = $data[$length-1]; - if ( ';' !== $lastc && '}' !== $lastc ) - return false; + if ( $strict ) { + $lastc = $data[ $length - 1 ]; + if ( ';' !== $lastc && '}' !== $lastc ) + return false; + } else { + $semicolon = strpos( $data, ';' ); + $brace = strpos( $data, '}' ); + // Either ; or } must exist. + if ( false === $semicolon && false === $brace ) + return false; + // But neither must be in the first X characters. + if ( false !== $semicolon && $semicolon < 3 ) + return false; + if ( false !== $brace && $brace < 4 ) + return false; + } $token = $data[0]; switch ( $token ) { case 's' : - if ( '"' !== $data[$length-2] ) + if ( $strict ) { + if ( '"' !== $data[ $length - 2 ] ) + return false; + } elseif ( false === strpos( $data, '"' ) ) { return false; + } + // or else fall through case 'a' : case 'O' : return (bool) preg_match( "/^{$token}:[0-9]+:/s", $data ); case 'b' : case 'i' : case 'd' : - return (bool) preg_match( "/^{$token}:[0-9.E-]+;\$/", $data ); + $end = $strict ? '$' : ''; + return (bool) preg_match( "/^{$token}:[0-9.E-]+;$end/", $data ); } return false; } @@ -317,7 +337,7 @@ function maybe_serialize( $data ) { // Double serialization is required for backward compatibility. // See http://core.trac.wordpress.org/ticket/12930 - if ( is_serialized( $data ) ) + if ( is_serialized( $data, false ) ) return serialize( $data ); return $data; @@ -392,6 +412,26 @@ function xmlrpc_removepostdata( $content ) { return $content; } +/** + * Use RegEx to extract URLs from arbitrary content + * + * @since 3.7.0 + * + * @param string $content + * @return array URLs found in passed string + */ +function wp_extract_urls( $content ) { + preg_match_all( + "#((?:[\w-]+://?|[\w\d]+[.])[^\s()<>]+[.](?:\([\w\d]+\)|(?:[^`!()\[\]{};:'\".,<>?«»“”‘’\s]|(?:[:]\d+)?/?)+))#", + $content, + $post_links + ); + + $post_links = array_unique( array_map( 'html_entity_decode', $post_links[0] ) ); + + return array_values( $post_links ); +} + /** * Check content for video and audio links to add as enclosures. * @@ -417,22 +457,17 @@ function do_enclose( $content, $post_ID ) { $pung = get_enclosed( $post_ID ); - $ltrs = '\w'; - $gunk = '/#~:.?+=&%@!\-'; - $punc = '.:?\-'; - $any = $ltrs . $gunk . $punc; - - preg_match_all( "{\b http : [$any] +? (?= [$punc] * [^$any] | $)}x", $content, $post_links_temp ); + $post_links_temp = wp_extract_urls( $content ); foreach ( $pung as $link_test ) { - if ( !in_array( $link_test, $post_links_temp[0] ) ) { // link no longer in post + if ( ! in_array( $link_test, $post_links_temp ) ) { // link no longer in post $mids = $wpdb->get_col( $wpdb->prepare("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = 'enclosure' AND meta_value LIKE (%s)", $post_ID, like_escape( $link_test ) . '%') ); foreach ( $mids as $mid ) delete_metadata_by_mid( 'post', $mid ); } } - foreach ( (array) $post_links_temp[0] as $link_test ) { + foreach ( (array) $post_links_temp as $link_test ) { if ( !in_array( $link_test, $pung ) ) { // If we haven't pung it already $test = @parse_url( $link_test ); if ( false === $test ) @@ -666,14 +701,8 @@ function add_query_arg() { } if ( strpos( $uri, '?' ) !== false ) { - $parts = explode( '?', $uri, 2 ); - if ( 1 == count( $parts ) ) { - $base = '?'; - $query = $parts[0]; - } else { - $base = $parts[0] . '?'; - $query = $parts[1]; - } + list( $base, $query ) = explode( '?', $uri, 2 ); + $base .= '?'; } elseif ( $protocol || strpos( $uri, '=' ) === false ) { $base = $uri . '?'; $query = ''; @@ -865,27 +894,24 @@ function get_status_header_desc( $code ) { * Set HTTP status header. * * @since 2.0.0 - * @uses apply_filters() Calls 'status_header' on status header string, HTTP - * HTTP code, HTTP code description, and protocol string as separate - * parameters. + * @see get_status_header_desc() * - * @param int $header HTTP status code - * @return unknown + * @param int $code HTTP status code. */ -function status_header( $header ) { - $text = get_status_header_desc( $header ); +function status_header( $code ) { + $description = get_status_header_desc( $code ); - if ( empty( $text ) ) - return false; + if ( empty( $description ) ) + return; - $protocol = $_SERVER["SERVER_PROTOCOL"]; + $protocol = $_SERVER['SERVER_PROTOCOL']; if ( 'HTTP/1.1' != $protocol && 'HTTP/1.0' != $protocol ) $protocol = 'HTTP/1.0'; - $status_header = "$protocol $header $text"; + $status_header = "$protocol $code $description"; if ( function_exists( 'apply_filters' ) ) - $status_header = apply_filters( 'status_header', $status_header, $header, $text, $protocol ); + $status_header = apply_filters( 'status_header', $status_header, $code, $description, $protocol ); - return @header( $status_header, true, $header ); + @header( $status_header, true, $code ); } /** @@ -896,7 +922,6 @@ function status_header( $header ) { * * @since 2.8.0 * - * @uses apply_filters() * @return array The associative array of header names and field values. */ function wp_get_nocache_headers() { @@ -920,7 +945,7 @@ function wp_get_nocache_headers() { * be sent so that all of them get the point that no caching should occur. * * @since 2.0.0 - * @uses wp_get_nocache_headers() + * @see wp_get_nocache_headers() */ function nocache_headers() { $headers = wp_get_nocache_headers(); @@ -1005,10 +1030,8 @@ function do_feed() { $feed = get_default_feed(); $hook = 'do_feed_' . $feed; - if ( !has_action($hook) ) { - $message = sprintf( __( 'ERROR: %s is not a valid feed template.' ), esc_html($feed)); - wp_die( $message, '', array( 'response' => 404 ) ); - } + if ( ! has_action( $hook ) ) + wp_die( __( 'ERROR: This is not a valid feed template.' ), '', array( 'response' => 404 ) ); do_action( $hook, $wp_query->is_comment_feed ); } @@ -1276,6 +1299,8 @@ function wp_original_referer_field( $echo = true, $jump_back_to = 'current' ) { * @return string|bool False on failure. Referer URL on success. */ function wp_get_referer() { + if ( ! function_exists( 'wp_validate_redirect' ) ) + return false; $ref = false; if ( ! empty( $_REQUEST['_wp_http_referer'] ) ) $ref = wp_unslash( $_REQUEST['_wp_http_referer'] ); @@ -1283,7 +1308,7 @@ function wp_get_referer() { $ref = wp_unslash( $_SERVER['HTTP_REFERER'] ); if ( $ref && $ref !== wp_unslash( $_SERVER['REQUEST_URI'] ) ) - return wp_unslash( $ref ); + return wp_validate_redirect( $ref, false ); return false; } @@ -1297,8 +1322,8 @@ function wp_get_referer() { * @return string|bool False if no original referer or original referer if set. */ function wp_get_original_referer() { - if ( !empty( $_REQUEST['_wp_original_http_referer'] ) ) - return wp_unslash( $_REQUEST['_wp_original_http_referer'] ); + if ( ! empty( $_REQUEST['_wp_original_http_referer'] ) && function_exists( 'wp_validate_redirect' ) ) + return wp_validate_redirect( wp_unslash( $_REQUEST['_wp_original_http_referer'] ), false ); return false; } @@ -1336,19 +1361,32 @@ function wp_mkdir_p( $target ) { if ( file_exists( $target ) ) return @is_dir( $target ); - // Attempting to create the directory may clutter up our display. - if ( @mkdir( $target ) ) { - $stat = @stat( dirname( $target ) ); - $dir_perms = $stat['mode'] & 0007777; // Get the permission bits. - @chmod( $target, $dir_perms ); - return true; - } elseif ( is_dir( dirname( $target ) ) ) { - return false; + // We need to find the permissions of the parent folder that exists and inherit that. + $target_parent = dirname( $target ); + while ( '.' != $target_parent && ! is_dir( $target_parent ) ) { + $target_parent = dirname( $target_parent ); + } + + // Get the permission bits. + $dir_perms = false; + if ( $stat = @stat( $target_parent ) ) { + $dir_perms = $stat['mode'] & 0007777; + } else { + $dir_perms = 0777; } - // If the above failed, attempt to create the parent node, then try again. - if ( ( $target != '/' ) && ( wp_mkdir_p( dirname( $target ) ) ) ) - return wp_mkdir_p( $target ); + if ( @mkdir( $target, $dir_perms, true ) ) { + + // If a umask is set that modifies $dir_perms, we'll have to re-set the $dir_perms correctly with chmod() + if ( $dir_perms != ( $dir_perms & ~umask() ) ) { + $folder_parts = explode( '/', substr( $target, strlen( $target_parent ) + 1 ) ); + for ( $i = 1; $i <= count( $folder_parts ); $i++ ) { + @chmod( $target_parent . '/' . implode( '/', array_slice( $folder_parts, 0, $i ) ), $dir_perms ); + } + } + + return true; + } return false; } @@ -1424,7 +1462,7 @@ function get_temp_dir() { } $temp = ini_get('upload_tmp_dir'); - if ( is_dir( $temp ) && wp_is_writable( $temp ) ) + if ( @is_dir( $temp ) && wp_is_writable( $temp ) ) return trailingslashit( rtrim( $temp, '\\' ) ); $temp = WP_CONTENT_DIR . '/'; @@ -1550,7 +1588,7 @@ function wp_upload_dir( $time = null ) { } // If multisite (and if not the main site in a post-MU network) - if ( is_multisite() && ! ( is_main_site() && defined( 'MULTISITE' ) ) ) { + if ( is_multisite() && ! ( is_main_network() && is_main_site() && defined( 'MULTISITE' ) ) ) { if ( ! get_site_option( 'ms_files_rewriting' ) ) { // If ms-files rewriting is disabled (networks created post-3.5), it is fairly straightforward: @@ -1780,7 +1818,9 @@ function wp_upload_bits( $name, $deprecated, $bits, $time = null ) { * @return string|null The file type, example: audio, video, document, spreadsheet, etc. Null if not found. */ function wp_ext2type( $ext ) { + $ext = strtolower( $ext ); $ext2type = apply_filters( 'ext2type', array( + 'image' => array( 'jpg', 'jpeg', 'jpe', 'gif', 'png', 'bmp', 'tif', 'tiff', 'ico' ), 'audio' => array( 'aac', 'ac3', 'aif', 'aiff', 'm3a', 'm4a', 'm4b', 'mka', 'mp1', 'mp2', 'mp3', 'ogg', 'oga', 'ram', 'wav', 'wma' ), 'video' => array( 'asf', 'avi', 'divx', 'dv', 'flv', 'm4v', 'mkv', 'mov', 'mp4', 'mpeg', 'mpg', 'mpv', 'ogm', 'ogv', 'qt', 'rm', 'vob', 'wmv' ), 'document' => array( 'doc', 'docx', 'docm', 'dotm', 'odt', 'pages', 'pdf', 'rtf', 'wp', 'wpd' ), @@ -1789,10 +1829,13 @@ function wp_ext2type( $ext ) { 'text' => array( 'asc', 'csv', 'tsv', 'txt' ), 'archive' => array( 'bz2', 'cab', 'dmg', 'gz', 'rar', 'sea', 'sit', 'sqx', 'tar', 'tgz', 'zip', '7z' ), 'code' => array( 'css', 'htm', 'html', 'php', 'js' ), - )); + ) ); + foreach ( $ext2type as $type => $exts ) if ( in_array( $ext, $exts ) ) return $type; + + return null; } /** @@ -1835,8 +1878,8 @@ function wp_check_filetype( $filename, $mimes = null ) { * * @since 3.0.0 * - * @param string $file Full path to the image. - * @param string $filename The filename of the image (may differ from $file due to $file being in a tmp directory) + * @param string $file Full path to the file. + * @param string $filename The name of the file (may differ from $file due to $file being in a tmp directory) * @param array $mimes Optional. Key is the file extension with value as the mime type. * @return array Values for the extension, MIME, and either a corrected filename or false if original $filename is valid */ @@ -2006,10 +2049,20 @@ function wp_get_mime_types() { * @uses apply_filters() Calls 'upload_mimes' on returned array * @uses wp_get_upload_mime_types() to fetch the list of mime types * + * @param int|WP_User $user Optional. User to check. Defaults to current user. * @return array Array of mime types keyed by the file extension regex corresponding to those types. */ -function get_allowed_mime_types() { - return apply_filters( 'upload_mimes', wp_get_mime_types() ); +function get_allowed_mime_types( $user = null ) { + $t = wp_get_mime_types(); + + unset( $t['swf'], $t['exe'] ); + if ( function_exists( 'current_user_can' ) ) + $unfiltered = $user ? user_can( $user, 'unfiltered_html' ) : current_user_can( 'unfiltered_html' ); + + if ( empty( $unfiltered ) ) + unset( $t['htm|html'] ); + + return apply_filters( 'upload_mimes', $t, $user ); } /** @@ -2135,24 +2188,23 @@ function _default_wp_die_handler( $message, $title = '', $args = array() ) { <?php echo $title ?>