X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/874d2a2f468a0d1e69aab49b1fe2d9d79d3e1142..7f1521bf193b382565eb753043c161f4cb3fcda7:/wp-includes/kses.php?ds=sidebyside diff --git a/wp-includes/kses.php b/wp-includes/kses.php index 6696161c..ba96b089 100644 --- a/wp-includes/kses.php +++ b/wp-includes/kses.php @@ -88,6 +88,14 @@ if ( ! CUSTOM_TAGS ) { 'lang' => true, 'xml:lang' => true, ), + 'audio' => array( + 'autoplay' => true, + 'controls' => true, + 'loop' => true, + 'muted' => true, + 'preload' => true, + 'src' => true, + ), 'b' => array(), 'big' => array(), 'blockquote' => array( @@ -119,6 +127,14 @@ if ( ! CUSTOM_TAGS ) { 'valign' => true, 'width' => true, ), + 'colgroup' => array( + 'align' => true, + 'char' => true, + 'charoff' => true, + 'span' => true, + 'valign' => true, + 'width' => true, + ), 'del' => array( 'datetime' => true, ), @@ -364,6 +380,13 @@ if ( ! CUSTOM_TAGS ) { 'charoff' => true, 'valign' => true, ), + 'track' => array( + 'default' => true, + 'kind' => true, + 'label' => true, + 'src' => true, + 'srclang' => true, + ), 'tt' => array(), 'u' => array(), 'ul' => array( @@ -374,6 +397,17 @@ if ( ! CUSTOM_TAGS ) { 'type' => true, ), 'var' => array(), + 'video' => array( + 'autoplay' => true, + 'controls' => true, + 'height' => true, + 'loop' => true, + 'muted' => true, + 'poster' => true, + 'preload' => true, + 'src' => true, + 'width' => true, + ), ); /** @@ -407,6 +441,7 @@ if ( ! CUSTOM_TAGS ) { 'q' => array( 'cite' => true, ), + 's' => array(), 'strike' => array(), 'strong' => array(), ); @@ -522,22 +557,22 @@ function wp_kses_allowed_html( $context = '' ) { case 'post': /** This filter is documented in wp-includes/kses.php */ return apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context ); - break; + case 'user_description': case 'pre_user_description': $tags = $allowedtags; $tags['a']['rel'] = true; /** This filter is documented in wp-includes/kses.php */ return apply_filters( 'wp_kses_allowed_html', $tags, $context ); - break; + case 'strip': /** This filter is documented in wp-includes/kses.php */ return apply_filters( 'wp_kses_allowed_html', array(), $context ); - break; + case 'entities': /** This filter is documented in wp-includes/kses.php */ return apply_filters( 'wp_kses_allowed_html', $allowedentitynames, $context); - break; + case 'data': default: /** This filter is documented in wp-includes/kses.php */ @@ -627,7 +662,6 @@ function _wp_kses_split_callback( $match ) { * * @access private * @since 1.0.0 - * @uses wp_kses_attr() * * @param string $string Content to filter * @param array $allowed_html Allowed HTML elements @@ -639,7 +673,7 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) { if (substr($string, 0, 1) != '<') return '>'; - # It matched a ">" character + // It matched a ">" character if ( ''), '', $string ); @@ -653,11 +687,11 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) { $string = preg_replace('/-$/', '', $string); return ""; } - # Allow HTML comments + // Allow HTML comments if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches)) return ''; - # It's seriously malformed + // It's seriously malformed $slash = trim($matches[1]); $elem = $matches[2]; @@ -668,11 +702,11 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) { if ( ! isset($allowed_html[strtolower($elem)]) ) return ''; - # They are using a not allowed HTML element + // They are using a not allowed HTML element if ($slash != '') return ""; - # No attributes are allowed for closing elements + // No attributes are allowed for closing elements return wp_kses_attr( $elem, $attrlist, $allowed_html, $allowed_protocols ); } @@ -695,7 +729,7 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) { * @return string Sanitized HTML element */ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) { - # Is there a closing XHTML slash at the end of the attributes? + // Is there a closing XHTML slash at the end of the attributes? if ( ! is_array( $allowed_html ) ) $allowed_html = wp_kses_allowed_html( $allowed_html ); @@ -704,25 +738,25 @@ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) { if (preg_match('%\s*/\s*$%', $attr)) $xhtml_slash = ' /'; - # Are any attributes allowed at all for this element? + // Are any attributes allowed at all for this element? if ( ! isset($allowed_html[strtolower($element)]) || count($allowed_html[strtolower($element)]) == 0 ) return "<$element$xhtml_slash>"; - # Split it + // Split it $attrarr = wp_kses_hair($attr, $allowed_protocols); - # Go through $attrarr, and save the allowed attributes for this element - # in $attr2 + // Go through $attrarr, and save the allowed attributes for this element + // in $attr2 $attr2 = ''; $allowed_attr = $allowed_html[strtolower($element)]; foreach ($attrarr as $arreach) { if ( ! isset( $allowed_attr[strtolower($arreach['name'])] ) ) - continue; # the attribute is not allowed + continue; // the attribute is not allowed $current = $allowed_attr[strtolower($arreach['name'])]; if ( $current == '' ) - continue; # the attribute is not allowed + continue; // the attribute is not allowed if ( strtolower( $arreach['name'] ) == 'style' ) { $orig_value = $arreach['value']; @@ -737,10 +771,10 @@ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) { if ( ! is_array($current) ) { $attr2 .= ' '.$arreach['whole']; - # there are no checks + // there are no checks } else { - # there are some checks + // there are some checks $ok = true; foreach ($current as $currkey => $currval) { if ( ! wp_kses_check_attr_val($arreach['value'], $arreach['vless'], $currkey, $currval) ) { @@ -750,11 +784,11 @@ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) { } if ( $ok ) - $attr2 .= ' '.$arreach['whole']; # it passed them - } # if !is_array($current) - } # foreach + $attr2 .= ' '.$arreach['whole']; // it passed them + } // if !is_array($current) + } // foreach - # Remove any "<" or ">" characters + // Remove any "<" or ">" characters $attr2 = preg_replace('/[<>]/', '', $attr2); return "<$element$attr2$xhtml_slash>"; @@ -783,13 +817,13 @@ function wp_kses_hair($attr, $allowed_protocols) { $attrname = ''; $uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action'); - # Loop through the whole attribute list + // Loop through the whole attribute list while (strlen($attr) != 0) { - $working = 0; # Was the last operation successful? + $working = 0; // Was the last operation successful? switch ($mode) { - case 0 : # attribute name, href for instance + case 0 : // attribute name, href for instance if ( preg_match('/^([-a-zA-Z:]+)/', $attr, $match ) ) { $attrname = $match[1]; @@ -799,9 +833,9 @@ function wp_kses_hair($attr, $allowed_protocols) { break; - case 1 : # equals sign or valueless ("selected") + case 1 : // equals sign or valueless ("selected") - if (preg_match('/^\s*=\s*/', $attr)) # equals sign + if (preg_match('/^\s*=\s*/', $attr)) // equals sign { $working = 1; $mode = 2; @@ -809,7 +843,7 @@ function wp_kses_hair($attr, $allowed_protocols) { break; } - if (preg_match('/^\s+/', $attr)) # valueless + if (preg_match('/^\s+/', $attr)) // valueless { $working = 1; $mode = 0; @@ -821,10 +855,10 @@ function wp_kses_hair($attr, $allowed_protocols) { break; - case 2 : # attribute value, a URL after href= for instance + case 2 : // attribute value, a URL after href= for instance if (preg_match('%^"([^"]*)"(\s+|/?$)%', $attr, $match)) - # "value" + // "value" { $thisval = $match[1]; if ( in_array(strtolower($attrname), $uris) ) @@ -840,7 +874,7 @@ function wp_kses_hair($attr, $allowed_protocols) { } if (preg_match("%^'([^']*)'(\s+|/?$)%", $attr, $match)) - # 'value' + // 'value' { $thisval = $match[1]; if ( in_array(strtolower($attrname), $uris) ) @@ -856,7 +890,7 @@ function wp_kses_hair($attr, $allowed_protocols) { } if (preg_match("%^([^\s\"']+)(\s+|/?$)%", $attr, $match)) - # value + // value { $thisval = $match[1]; if ( in_array(strtolower($attrname), $uris) ) @@ -865,25 +899,25 @@ function wp_kses_hair($attr, $allowed_protocols) { if(false === array_key_exists($attrname, $attrarr)) { $attrarr[$attrname] = array ('name' => $attrname, 'value' => $thisval, 'whole' => "$attrname=\"$thisval\"", 'vless' => 'n'); } - # We add quotes to conform to W3C's HTML spec. + // We add quotes to conform to W3C's HTML spec. $working = 1; $mode = 0; $attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr); } break; - } # switch + } // switch - if ($working == 0) # not well formed, remove and try again + if ($working == 0) // not well formed, remove and try again { $attr = wp_kses_html_error($attr); $mode = 0; } - } # while + } // while if ($mode == 1 && false === array_key_exists($attrname, $attrarr)) - # special case, for when the attribute list ends with a valueless - # attribute like "selected" + // special case, for when the attribute list ends with a valueless + // attribute like "selected" $attrarr[$attrname] = array ('name' => $attrname, 'value' => '', 'whole' => $attrname, 'vless' => 'y'); return $attrarr; @@ -908,28 +942,28 @@ function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) { switch (strtolower($checkname)) { case 'maxlen' : - # The maxlen check makes sure that the attribute value has a length not - # greater than the given value. This can be used to avoid Buffer Overflows - # in WWW clients and various Internet servers. + // The maxlen check makes sure that the attribute value has a length not + // greater than the given value. This can be used to avoid Buffer Overflows + // in WWW clients and various Internet servers. if (strlen($value) > $checkvalue) $ok = false; break; case 'minlen' : - # The minlen check makes sure that the attribute value has a length not - # smaller than the given value. + // The minlen check makes sure that the attribute value has a length not + // smaller than the given value. if (strlen($value) < $checkvalue) $ok = false; break; case 'maxval' : - # The maxval check does two things: it checks that the attribute value is - # an integer from 0 and up, without an excessive amount of zeroes or - # whitespace (to avoid Buffer Overflows). It also checks that the attribute - # value is not greater than the given value. - # This check can be used to avoid Denial of Service attacks. + // The maxval check does two things: it checks that the attribute value is + // an integer from 0 and up, without an excessive amount of zeroes or + // whitespace (to avoid Buffer Overflows). It also checks that the attribute + // value is not greater than the given value. + // This check can be used to avoid Denial of Service attacks. if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) $ok = false; @@ -938,8 +972,8 @@ function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) { break; case 'minval' : - # The minval check makes sure that the attribute value is a positive integer, - # and that it is not smaller than the given value. + // The minval check makes sure that the attribute value is a positive integer, + // and that it is not smaller than the given value. if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) $ok = false; @@ -948,15 +982,15 @@ function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) { break; case 'valueless' : - # The valueless check makes sure if the attribute has a value - # (like ) or not () or not (