X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/f9001779751f83dc8a10e478bfecb4d8dd5f964c..11be15bd505d66a91e2c80062190b13e315a04a9:/wp-includes/class-oembed.php diff --git a/wp-includes/class-oembed.php b/wp-includes/class-oembed.php index 87e59a69..a880448d 100644 --- a/wp-includes/class-oembed.php +++ b/wp-includes/class-oembed.php @@ -21,43 +21,45 @@ class WP_oEmbed { var $providers = array(); /** - * PHP4 constructor - */ - function WP_oEmbed() { - return $this->__construct(); - } - - /** - * PHP5 constructor + * Constructor * * @uses apply_filters() Filters a list of pre-defined oEmbed providers. */ function __construct() { // List out some popular sites that support oEmbed. // The WP_Embed class disables discovery for non-unfiltered_html users, so only providers in this array will be used for them. - // Add to this list using the wp_oembed_add_provider() function (see it's PHPDoc for details). + // Add to this list using the wp_oembed_add_provider() function (see its PHPDoc for details). $this->providers = apply_filters( 'oembed_providers', array( - '#http://(www\.)?youtube.com/watch.*#i' => array( 'http://www.youtube.com/oembed', true ), - 'http://youtu.be/*' => array( 'http://www.youtube.com/oembed', false ), - 'http://blip.tv/file/*' => array( 'http://blip.tv/oembed/', false ), - '#http://(www\.)?vimeo\.com/.*#i' => array( 'http://www.vimeo.com/api/oembed.{format}', true ), - '#http://(www\.)?dailymotion\.com/.*#i' => array( 'http://www.dailymotion.com/api/oembed', true ), - '#http://(www\.)?flickr\.com/.*#i' => array( 'http://www.flickr.com/services/oembed/', true ), - '#http://(.+)?smugmug\.com/.*#i' => array( 'http://api.smugmug.com/services/oembed/', true ), - '#http://(www\.)?hulu\.com/watch/.*#i' => array( 'http://www.hulu.com/api/oembed.{format}', true ), - '#http://(www\.)?viddler\.com/.*#i' => array( 'http://lab.viddler.com/services/oembed/', true ), - 'http://qik.com/*' => array( 'http://qik.com/api/oembed.{format}', false ), - 'http://revision3.com/*' => array( 'http://revision3.com/api/oembed/', false ), - 'http://i*.photobucket.com/albums/*' => array( 'http://photobucket.com/oembed', false ), - 'http://gi*.photobucket.com/groups/*' => array( 'http://photobucket.com/oembed', false ), - '#http://(www\.)?scribd\.com/.*#i' => array( 'http://www.scribd.com/services/oembed', true ), - 'http://wordpress.tv/*' => array( 'http://wordpress.tv/oembed/', false ), - '#http://(answers|surveys)\.polldaddy.com/.*#i' => array( 'http://polldaddy.com/oembed/', true ), - '#http://(www\.)?funnyordie\.com/videos/.*#i' => array( 'http://www.funnyordie.com/oembed', true ), + '#https?://(www\.)?youtube\.com/watch.*#i' => array( 'http://www.youtube.com/oembed', true ), + 'http://youtu.be/*' => array( 'http://www.youtube.com/oembed', false ), + 'http://blip.tv/*' => array( 'http://blip.tv/oembed/', false ), + '#https?://(www\.)?vimeo\.com/.*#i' => array( 'http://vimeo.com/api/oembed.{format}', true ), + '#https?://(www\.)?dailymotion\.com/.*#i' => array( 'http://www.dailymotion.com/services/oembed', true ), + 'http://dai.ly/*' => array( 'http://www.dailymotion.com/services/oembed', false ), + '#https?://(www\.)?flickr\.com/.*#i' => array( 'http://www.flickr.com/services/oembed/', true ), + 'http://flic.kr/*' => array( 'http://www.flickr.com/services/oembed/', false ), + '#https?://(.+\.)?smugmug\.com/.*#i' => array( 'http://api.smugmug.com/services/oembed/', true ), + '#https?://(www\.)?hulu\.com/watch/.*#i' => array( 'http://www.hulu.com/api/oembed.{format}', true ), + '#https?://(www\.)?viddler\.com/.*#i' => array( 'http://lab.viddler.com/services/oembed/', true ), + 'http://qik.com/*' => array( 'http://qik.com/api/oembed.{format}', false ), + 'http://revision3.com/*' => array( 'http://revision3.com/api/oembed/', false ), + 'http://i*.photobucket.com/albums/*' => array( 'http://photobucket.com/oembed', false ), + 'http://gi*.photobucket.com/groups/*' => array( 'http://photobucket.com/oembed', false ), + '#https?://(www\.)?scribd\.com/.*#i' => array( 'http://www.scribd.com/services/oembed', true ), + 'http://wordpress.tv/*' => array( 'http://wordpress.tv/oembed/', false ), + '#https?://(.+\.)?polldaddy\.com/.*#i' => array( 'http://polldaddy.com/oembed/', true ), + '#https?://(www\.)?funnyordie\.com/videos/.*#i' => array( 'http://www.funnyordie.com/oembed', true ), + '#https?://(www\.)?twitter\.com/.+?/status(es)?/.*#i'=> array( 'http://api.twitter.com/1/statuses/oembed.{format}', true ), + '#https?://(www\.)?soundcloud\.com/.*#i' => array( 'http://soundcloud.com/oembed', true ), + '#https?://(www\.)?slideshare\.net/*#' => array( 'http://www.slideshare.net/api/oembed/2', true ), + '#http://instagr(\.am|am\.com)/p/.*#i' => array( 'http://api.instagram.com/oembed', true ), + '#https?://(www\.)?rdio\.com/.*#i' => array( 'http://www.rdio.com/api/oembed/', true ), + '#https?://rd\.io/x/.*#i' => array( 'http://www.rdio.com/api/oembed/', true ), + '#https?://(open|play)\.spotify\.com/.*#i' => array( 'https://embed.spotify.com/oembed/', true ), ) ); // Fix any embeds that contain new lines in the middle of the HTML which breaks wpautop(). - add_filter( 'oembed_dataparse', array(&$this, '_strip_newlines'), 10, 3 ); + add_filter( 'oembed_dataparse', array($this, '_strip_newlines'), 10, 3 ); } /** @@ -81,8 +83,10 @@ class WP_oEmbed { list( $providerurl, $regex ) = $data; // Turn the asterisk-type provider URLs into regex - if ( !$regex ) + if ( !$regex ) { $matchmask = '#' . str_replace( '___wildcard___', '(.+)', preg_quote( str_replace( '*', '___wildcard___', $matchmask ), '#' ) ) . '#i'; + $matchmask = preg_replace( '|^#http\\\://|', '#https?\://', $matchmask ); + } if ( preg_match( $matchmask, $url ) ) { $provider = str_replace( '{format}', 'json', $providerurl ); // JSON is easier to deal with than XML @@ -109,7 +113,7 @@ class WP_oEmbed { $providers = array(); // Fetch URL content - if ( $html = wp_remote_retrieve_body( wp_remote_get( $url ) ) ) { + if ( $html = wp_remote_retrieve_body( wp_safe_remote_get( $url ) ) ) { // types that contain oEmbed provider URLs $linktypes = apply_filters( 'oembed_linktypes', array( @@ -165,10 +169,12 @@ class WP_oEmbed { function fetch( $provider, $url, $args = '' ) { $args = wp_parse_args( $args, wp_embed_defaults() ); - $provider = add_query_arg( 'maxwidth', $args['width'], $provider ); - $provider = add_query_arg( 'maxheight', $args['height'], $provider ); + $provider = add_query_arg( 'maxwidth', (int) $args['width'], $provider ); + $provider = add_query_arg( 'maxheight', (int) $args['height'], $provider ); $provider = add_query_arg( 'url', urlencode($url), $provider ); + $provider = apply_filters( 'oembed_fetch_url', $provider, $url, $args ); + foreach( array( 'json', 'xml' ) as $format ) { $result = $this->_fetch_with_format( $provider, $format ); if ( is_wp_error( $result ) && 'not-implemented' == $result->get_error_code() ) @@ -189,7 +195,7 @@ class WP_oEmbed { */ function _fetch_with_format( $provider_url_with_args, $format ) { $provider_url_with_args = add_query_arg( 'format', $format, $provider_url_with_args ); - $response = wp_remote_get( $provider_url_with_args ); + $response = wp_safe_remote_get( $provider_url_with_args ); if ( 501 == wp_remote_retrieve_response_code( $response ) ) return new WP_Error( 'not-implemented' ); if ( ! $body = wp_remote_retrieve_body( $response ) ) @@ -215,14 +221,53 @@ class WP_oEmbed { * @access private */ function _parse_xml( $response_body ) { - if ( function_exists('simplexml_load_string') ) { - $errors = libxml_use_internal_errors( 'true' ); - $data = simplexml_load_string( $response_body ); - libxml_use_internal_errors( $errors ); - if ( is_object( $data ) ) - return $data; + if ( ! function_exists( 'libxml_disable_entity_loader' ) ) + return false; + + $loader = libxml_disable_entity_loader( true ); + $errors = libxml_use_internal_errors( true ); + + $return = $this->_parse_xml_body( $response_body ); + + libxml_use_internal_errors( $errors ); + libxml_disable_entity_loader( $loader ); + + return $return; + } + + /** + * Helper function for parsing an XML response body. + * + * @since 3.6.0 + * @access private + */ + private function _parse_xml_body( $response_body ) { + if ( ! function_exists( 'simplexml_import_dom' ) || ! class_exists( 'DOMDocument' ) ) + return false; + + $dom = new DOMDocument; + $success = $dom->loadXML( $response_body ); + if ( ! $success ) + return false; + + if ( isset( $dom->doctype ) ) + return false; + + foreach ( $dom->childNodes as $child ) { + if ( XML_DOCUMENT_TYPE_NODE === $child->nodeType ) + return false; } - return false; + + $xml = simplexml_import_dom( $dom ); + if ( ! $xml ) + return false; + + $return = new stdClass; + foreach ( $xml as $key => $value ) { + $return->$key = (string) $value; + } + + return $return; } /** @@ -233,28 +278,34 @@ class WP_oEmbed { * @return bool|string False on error, otherwise the HTML needed to embed. */ function data2html( $data, $url ) { - if ( !is_object($data) || empty($data->type) ) + if ( ! is_object( $data ) || empty( $data->type ) ) return false; + $return = false; + switch ( $data->type ) { case 'photo': - if ( empty($data->url) || empty($data->width) || empty($data->height) ) - return false; + if ( empty( $data->url ) || empty( $data->width ) || empty( $data->height ) ) + break; + if ( ! is_string( $data->url ) || ! is_numeric( $data->width ) || ! is_numeric( $data->height ) ) + break; - $title = ( !empty($data->title) ) ? $data->title : ''; + $title = ! empty( $data->title ) && is_string( $data->title ) ? $data->title : ''; $return = '' . esc_attr($title) . ''; break; case 'video': case 'rich': - $return = ( !empty($data->html) ) ? $data->html : false; + if ( ! empty( $data->html ) && is_string( $data->html ) ) + $return = $data->html; break; case 'link': - $return = ( !empty($data->title) ) ? '' . esc_html($data->title) . '' : false; + if ( ! empty( $data->title ) && is_string( $data->title ) ) + $return = '' . esc_html( $data->title ) . ''; break; - default; + default: $return = false; } @@ -290,7 +341,7 @@ class WP_oEmbed { * * @return WP_oEmbed object. */ -function &_wp_oembed_get_object() { +function _wp_oembed_get_object() { static $wp_oembed; if ( is_null($wp_oembed) ) @@ -298,5 +349,3 @@ function &_wp_oembed_get_object() { return $wp_oembed; } - -?> \ No newline at end of file