Ticket #5641: kses.phpdoc.r6617.diff

File kses.phpdoc.r6617.diff, 25.9 KB (added by darkdragon, 4 years ago)

Updated patch based on r6617, which might have caused previous patch to go stale.

  • kses.php

     
    11<?php 
     2/** 
     3 * HTML/XHTML filter that only allows some elements and attributes 
     4 * 
     5 * Added wp_ prefix to avoid conflicts with existing kses users 
     6 * 
     7 * @version 0.2.2 
     8 * @copyright (C) 2002, 2003, 2005 
     9 * @author Ulf Harnhammar <metaur@users.sourceforge.net> 
     10 * 
     11 * @package External 
     12 * @subpackage KSES 
     13 * 
     14 * @internal 
     15 * *** CONTACT INFORMATION *** 
     16 * E-mail:      metaur at users dot sourceforge dot net 
     17 * Web page:    http://sourceforge.net/projects/kses 
     18 * Paper mail:  Ulf Harnhammar 
     19 *              Ymergatan 17 C 
     20 *              753 25  Uppsala 
     21 *              SWEDEN 
     22 * 
     23 * [kses strips evil scripts!] 
     24 */ 
    225 
    3 // Added wp_ prefix to avoid conflicts with existing kses users 
    4 # kses 0.2.2 - HTML/XHTML filter that only allows some elements and attributes 
    5 # Copyright (C) 2002, 2003, 2005  Ulf Harnhammar 
    6 # *** CONTACT INFORMATION *** 
    7 # 
    8 # E-mail:      metaur at users dot sourceforge dot net 
    9 # Web page:    http://sourceforge.net/projects/kses 
    10 # Paper mail:  Ulf Harnhammar 
    11 #              Ymergatan 17 C 
    12 #              753 25  Uppsala 
    13 #              SWEDEN 
    14 # 
    15 # [kses strips evil scripts!] 
     26/** 
     27 * You can override this in your my-hacks.php file 
     28 * You can also override this in a plugin file. The 
     29 * my-hacks.php is deprecated in its usage. 
     30 * 
     31 * @since 1.2.0 
     32 */ 
    1633if (!defined('CUSTOM_TAGS')) 
    1734        define('CUSTOM_TAGS', false); 
    1835 
    19 // You can override this in your my-hacks.php file 
    2036if (!CUSTOM_TAGS) { 
     37        /** 
     38         * Kses global for default allowable HTML tags 
     39         * 
     40         * Can be override by using CUSTOM_TAGS constant 
     41         * @global array $allowedposttags 
     42         * @since 2.0.0 
     43         */ 
    2144        $allowedposttags = array( 
    2245                'address' => array(), 
    2346                'a' => array( 
     
    251274                'ol' => array ( 
    252275                        'class' => array ()), 
    253276                'var' => array ()); 
     277        /** 
     278         * Kses allowed HTML elements 
     279         * 
     280         * @global array $allowedtags 
     281         * @since 1.0.0 
     282         */ 
    254283        $allowedtags = array( 
    255284                'a' => array( 
    256285                        'href' => array (), 
     
    286315        ); 
    287316} 
    288317 
    289 function wp_kses($string, $allowed_html, $allowed_protocols = array ('http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet')) 
    290         ############################################################################### 
    291                 # This function makes sure that only the allowed HTML element names, attribute 
    292                 # names and attribute values plus only sane HTML entities will occur in 
    293                 # $string. You have to remove any slashes from PHP's magic quotes before you 
    294                 # call this function. 
    295                 ############################################################################### 
    296         { 
     318/** 
     319 * wp_kses() - Filters content and keeps only allowable HTML elements. 
     320 * 
     321 * This function makes sure that only the allowed HTML element names, 
     322 * attribute names and attribute values plus only sane HTML entities 
     323 * will occur in $string. You have to remove any slashes from PHP's 
     324 * magic quotes before you call this function. 
     325 * 
     326 * The default allowed protocols are 'http', 'https', 'ftp', 'mailto', 
     327 * 'news', 'irc', 'gopher', 'nntp', 'feed', and finally 'telnet. This 
     328 * covers all common link protocols, except for 'javascript' which 
     329 * should not be allowed for untrusted users. 
     330 * 
     331 * @since 1.0.0 
     332 * 
     333 * @param string $string Content to filter through kses 
     334 * @param array $allowed_html List of allowed HTML elements 
     335 * @param array $allowed_protocols Optional. Allowed protocol in links. 
     336 * @return string Filtered content with only allowed HTML elements 
     337 */ 
     338function wp_kses($string, $allowed_html, $allowed_protocols = array ('http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet')) { 
    297339        $string = wp_kses_no_null($string); 
    298340        $string = wp_kses_js_entities($string); 
    299341        $string = wp_kses_normalize_entities($string); 
    300342        $allowed_html_fixed = wp_kses_array_lc($allowed_html); 
    301343        $string = wp_kses_hook($string, $allowed_html_fixed, $allowed_protocols); // WP changed the order of these funcs and added args to wp_kses_hook 
    302344        return wp_kses_split($string, $allowed_html_fixed, $allowed_protocols); 
    303 } # function wp_kses 
     345} 
    304346 
    305 function wp_kses_hook($string, $allowed_html, $allowed_protocols) 
    306 ############################################################################### 
    307 # You add any kses hooks here. 
    308 ############################################################################### 
    309 { 
     347/** 
     348 * wp_kses_hook() - You add any kses hooks here. 
     349 * 
     350 * There is currently only one kses WordPress hook and it is 
     351 * called here. All parameters are passed to the hooks and 
     352 * expected to recieve a string. 
     353 * 
     354 * @since 1.0.0 
     355 * 
     356 * @param string $string Content to filter through kses 
     357 * @param array $allowed_html List of allowed HTML elements 
     358 * @param array $allowed_protocols Allowed protocol in links 
     359 * @return string Filtered content through 'pre_kses' hook 
     360 */ 
     361function wp_kses_hook($string, $allowed_html, $allowed_protocols) { 
    310362        $string = apply_filters('pre_kses', $string, $allowed_html, $allowed_protocols); 
    311363        return $string; 
    312 } # function wp_kses_hook 
     364} 
    313365 
    314 function wp_kses_version() 
    315 ############################################################################### 
    316 # This function returns kses' version number. 
    317 ############################################################################### 
    318 { 
     366/** 
     367 * wp_kses_version() - This function returns kses' version number. 
     368 * 
     369 * @since 1.0.0 
     370 * 
     371 * @return string Version Number 
     372 */ 
     373function wp_kses_version() { 
    319374        return '0.2.2'; 
    320 } # function wp_kses_version 
     375} 
    321376 
    322 function wp_kses_split($string, $allowed_html, $allowed_protocols) 
    323 ############################################################################### 
    324 # This function searches for HTML tags, no matter how malformed. It also 
    325 # matches stray ">" characters. 
    326 ############################################################################### 
    327 { 
     377/** 
     378 * wp_kses_split() - Searches for HTML tags, no matter how malformed 
     379 * 
     380 * It also matches stray ">" characters. 
     381 * 
     382 * @since 1.0.0 
     383 * 
     384 * @param string $string Content to filter 
     385 * @param array $allowed_html Allowed HTML elements 
     386 * @param array $allowed_protocols Allowed protocols to keep 
     387 * @return string Content with fixed HTML tags 
     388 */ 
     389function wp_kses_split($string, $allowed_html, $allowed_protocols) { 
    328390        return preg_replace('%((<!--.*?(-->|$))|(<[^>]*(>|$)|>))%e', 
    329391        "wp_kses_split2('\\1', \$allowed_html, ".'$allowed_protocols)', $string); 
    330 } # function wp_kses_split 
     392} 
    331393 
    332 function wp_kses_split2($string, $allowed_html, $allowed_protocols) 
    333 ############################################################################### 
    334 # This function does a lot of work. It rejects some very malformed things 
    335 # like <:::>. It returns an empty string, if the element isn't allowed (look 
    336 # ma, no strip_tags()!). Otherwise it splits the tag into an element and an 
    337 # attribute list. 
    338 ############################################################################### 
    339 { 
     394/** 
     395 * wp_kses_split2() - Callback for wp_kses_split for fixing malformed HTML tags 
     396 * 
     397 * This function does a lot of work. It rejects some very malformed things 
     398 * like <:::>. It returns an empty string, if the element isn't allowed (look 
     399 * ma, no strip_tags()!). Otherwise it splits the tag into an element and an 
     400 * attribute list. 
     401 * 
     402 * After the tag is split into an element and an attribute list, it is run 
     403 * through another filter which will remove illegal attributes and once 
     404 * that is completed, will be returned. 
     405 * 
     406 * @since 1.0.0 
     407 * @uses wp_kses_attr() 
     408 * 
     409 * @param string $string Content to filter 
     410 * @param array $allowed_html Allowed HTML elements 
     411 * @param array $allowed_protocols Allowed protocols to keep 
     412 * @return string Fixed HTML element 
     413 */ 
     414function wp_kses_split2($string, $allowed_html, $allowed_protocols) { 
    340415        $string = wp_kses_stripslashes($string); 
    341416 
    342417        if (substr($string, 0, 1) != '<') 
     
    370445        # No attributes are allowed for closing elements 
    371446 
    372447        return wp_kses_attr("$slash$elem", $attrlist, $allowed_html, $allowed_protocols); 
    373 } # function wp_kses_split2 
     448} 
    374449 
    375 function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) 
    376 ############################################################################### 
    377 # This function removes all attributes, if none are allowed for this element. 
    378 # If some are allowed it calls wp_kses_hair() to split them further, and then it 
    379 # builds up new HTML code from the data that kses_hair() returns. It also 
    380 # removes "<" and ">" characters, if there are any left. One more thing it 
    381 # does is to check if the tag has a closing XHTML slash, and if it does, 
    382 # it puts one in the returned code as well. 
    383 ############################################################################### 
    384 { 
     450/** 
     451 * wp_kses_attr() - Removes all attributes, if none are allowed for this element 
     452 * 
     453 * If some are allowed it calls wp_kses_hair() to split them further, and then 
     454 * it builds up new HTML code from the data that kses_hair() returns. It also 
     455 * removes "<" and ">" characters, if there are any left. One more thing it 
     456 * does is to check if the tag has a closing XHTML slash, and if it does, it 
     457 * puts one in the returned code as well. 
     458 * 
     459 * @since 1.0.0 
     460 * 
     461 * @param string $element HTML element/tag 
     462 * @param string $attr HTML attributes from HTML element to closing HTML element tag 
     463 * @param array $allowed_html Allowed HTML elements 
     464 * @param array $allowed_protocols Allowed protocols to keep 
     465 * @return string Sanitized HTML element 
     466 */ 
     467function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) { 
    385468        # Is there a closing XHTML slash at the end of the attributes? 
    386469 
    387470        $xhtml_slash = ''; 
     
    433516        $attr2 = preg_replace('/[<>]/', '', $attr2); 
    434517 
    435518        return "<$element$attr2$xhtml_slash>"; 
    436 } # function wp_kses_attr 
     519} 
    437520 
    438 function wp_kses_hair($attr, $allowed_protocols) 
    439 ############################################################################### 
    440 # This function does a lot of work. It parses an attribute list into an array 
    441 # with attribute data, and tries to do the right thing even if it gets weird 
    442 # input. It will add quotes around attribute values that don't have any quotes 
    443 # or apostrophes around them, to make it easier to produce HTML code that will 
    444 # conform to W3C's HTML specification. It will also remove bad URL protocols 
    445 # from attribute values. 
    446 ############################################################################### 
    447 { 
     521/** 
     522 * wp_kses_hair() - Builds an attribute list from string containing attributes. 
     523 * 
     524 * This function does a lot of work. It parses an attribute list into an array 
     525 * with attribute data, and tries to do the right thing even if it gets weird 
     526 * input. It will add quotes around attribute values that don't have any quotes 
     527 * or apostrophes around them, to make it easier to produce HTML code that will 
     528 * conform to W3C's HTML specification. It will also remove bad URL protocols 
     529 * from attribute values. 
     530 * 
     531 * @since 1.0.0 
     532 * 
     533 * @param string $attr Attribute list from HTML element to closing HTML element tag 
     534 * @param array $allowed_protocols Allowed protocols to keep 
     535 * @return array List of attributes after parsing 
     536 */ 
     537function wp_kses_hair($attr, $allowed_protocols) { 
    448538        $attrarr = array (); 
    449539        $mode = 0; 
    450540        $attrname = ''; 
     
    527617                } # switch 
    528618 
    529619                if ($working == 0) # not well formed, remove and try again 
    530                         { 
     620                { 
    531621                        $attr = wp_kses_html_error($attr); 
    532622                        $mode = 0; 
    533623                } 
     
    539629                $attrarr[] = array ('name' => $attrname, 'value' => '', 'whole' => $attrname, 'vless' => 'y'); 
    540630 
    541631        return $attrarr; 
    542 } # function wp_kses_hair 
     632} 
    543633 
    544 function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) 
    545 ############################################################################### 
    546 # This function performs different checks for attribute values. The currently 
    547 # implemented checks are "maxlen", "minlen", "maxval", "minval" and "valueless" 
    548 # with even more checks to come soon. 
    549 ############################################################################### 
    550 { 
     634/** 
     635 * wp_kses_check_attr_val() - Performs different checks for attribute values. 
     636 * 
     637 * The currently implemented checks are "maxlen", "minlen", "maxval", "minval" 
     638 * and "valueless" with even more checks to come soon. 
     639 * 
     640 * @since 1.0.0 
     641 * 
     642 * @param string $value Attribute value 
     643 * @param string $vless Whether the value is valueless or not. Use 'y' or 'n' 
     644 * @param string $checkname What $checkvalue is checking for. 
     645 * @param mixed $checkvalue What constraint the value should pass 
     646 * @return bool Whether check passes (true) or not (false) 
     647 */ 
     648function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) { 
    551649        $ok = true; 
    552650 
    553651        switch (strtolower($checkname)) { 
     
    603701        } # switch 
    604702 
    605703        return $ok; 
    606 } # function wp_kses_check_attr_val 
     704} 
    607705 
    608 function wp_kses_bad_protocol($string, $allowed_protocols) 
    609 ############################################################################### 
    610 # This function removes all non-allowed protocols from the beginning of 
    611 # $string. It ignores whitespace and the case of the letters, and it does 
    612 # understand HTML entities. It does its work in a while loop, so it won't be 
    613 # fooled by a string like "javascript:javascript:alert(57)". 
    614 ############################################################################### 
    615 { 
     706/** 
     707 * wp_kses_bad_protocol() - Sanitize string from bad protocols 
     708 * 
     709 * This function removes all non-allowed protocols from the beginning 
     710 * of $string. It ignores whitespace and the case of the letters, and 
     711 * it does understand HTML entities. It does its work in a while loop, 
     712 * so it won't be fooled by a string like "javascript:javascript:alert(57)". 
     713 * 
     714 * @since 1.0.0 
     715 * 
     716 * @param string $string Content to filter bad protocols from 
     717 * @param array $allowed_protocols Allowed protocols to keep 
     718 * @return string Filtered content 
     719 */ 
     720function wp_kses_bad_protocol($string, $allowed_protocols) { 
    616721        $string = wp_kses_no_null($string); 
    617722        $string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature" 
    618723        $string2 = $string.'a'; 
     
    623728        } # while 
    624729 
    625730        return $string; 
    626 } # function wp_kses_bad_protocol 
     731} 
    627732 
    628 function wp_kses_no_null($string) 
    629 ############################################################################### 
    630 # This function removes any NULL characters in $string. 
    631 ############################################################################### 
    632 { 
     733/** 
     734 * wp_kses_no_null() - Removes any NULL characters in $string. 
     735 * 
     736 * @since 1.0.0 
     737 * 
     738 * @param string $string 
     739 * @return string 
     740 */ 
     741function wp_kses_no_null($string) { 
    633742        $string = preg_replace('/\0+/', '', $string); 
    634743        $string = preg_replace('/(\\\\0)+/', '', $string); 
    635744 
    636745        return $string; 
    637 } # function wp_kses_no_null 
     746} 
    638747 
    639 function wp_kses_stripslashes($string) 
    640 ############################################################################### 
    641 # This function changes the character sequence  \"  to just  " 
    642 # It leaves all other slashes alone. It's really weird, but the quoting from 
    643 # preg_replace(//e) seems to require this. 
    644 ############################################################################### 
    645 { 
     748/** 
     749 * wp_kses_stripslashes() - Strips slashes from in front of quotes 
     750 * 
     751 * This function changes the character sequence  \"  to just  " 
     752 * It leaves all other slashes alone. It's really weird, but the 
     753 * quoting from preg_replace(//e) seems to require this. 
     754 * 
     755 * @since 1.0.0 
     756 * 
     757 * @param string $string String to strip slashes 
     758 * @return string Fixed strings with quoted slashes 
     759 */ 
     760function wp_kses_stripslashes($string) { 
    646761        return preg_replace('%\\\\"%', '"', $string); 
    647 } # function wp_kses_stripslashes 
     762} 
    648763 
    649 function wp_kses_array_lc($inarray) 
    650 ############################################################################### 
    651 # This function goes through an array, and changes the keys to all lower case. 
    652 ############################################################################### 
    653 { 
     764/** 
     765 * wp_kses_array_lc() - Goes through an array and changes the keys to all lower case. 
     766 * 
     767 * @since 1.0.0 
     768 * 
     769 * @param array $inarray Unfiltered array 
     770 * @return array Fixed array with all lowercase keys 
     771 */ 
     772function wp_kses_array_lc($inarray) { 
    654773        $outarray = array (); 
    655774 
    656775        foreach ($inarray as $inkey => $inval) { 
     
    664783        } # foreach $inarray 
    665784 
    666785        return $outarray; 
    667 } # function wp_kses_array_lc 
     786} 
    668787 
    669 function wp_kses_js_entities($string) 
    670 ############################################################################### 
    671 # This function removes the HTML JavaScript entities found in early versions of 
    672 # Netscape 4. 
    673 ############################################################################### 
    674 { 
     788/** 
     789 * wp_kses_js_entities() - Removes the HTML JavaScript entities found in early versions of Netscape 4. 
     790 * 
     791 * @since 1.0.0 
     792 * 
     793 * @param string $string 
     794 * @return string 
     795 */ 
     796function wp_kses_js_entities($string) { 
    675797        return preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string); 
    676 } # function wp_kses_js_entities 
     798} 
    677799 
    678 function wp_kses_html_error($string) 
    679 ############################################################################### 
    680 # This function deals with parsing errors in wp_kses_hair(). The general plan is 
    681 # to remove everything to and including some whitespace, but it deals with 
    682 # quotes and apostrophes as well. 
    683 ############################################################################### 
    684 { 
     800/** 
     801 * wp_kses_html_error() - Handles parsing errors in wp_kses_hair() 
     802 * 
     803 * The general plan is to remove everything to and including some 
     804 * whitespace, but it deals with quotes and apostrophes as well. 
     805 * 
     806 * @since 1.0.0 
     807 * 
     808 * @param string $string 
     809 * @return string 
     810 */ 
     811function wp_kses_html_error($string) { 
    685812        return preg_replace('/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $string); 
    686 } # function wp_kses_html_error 
     813} 
    687814 
    688 function wp_kses_bad_protocol_once($string, $allowed_protocols) 
    689 ############################################################################### 
    690 # This function searches for URL protocols at the beginning of $string, while 
    691 # handling whitespace and HTML entities. 
    692 ############################################################################### 
    693 { 
     815/** 
     816 * wp_kses_bad_protocol_once() - Sanitizes content from bad protocols and other characters 
     817 * 
     818 * This function searches for URL protocols at the beginning of $string, 
     819 * while handling whitespace and HTML entities. 
     820 * 
     821 * @since 1.0.0 
     822 * 
     823 * @param string $string Content to check for bad protocols 
     824 * @param string $allowed_protocols Allowed protocols 
     825 * @return string Sanitized content 
     826 */ 
     827function wp_kses_bad_protocol_once($string, $allowed_protocols) { 
    694828        return preg_replace('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|&#58;|&#[Xx]3[Aa];)\s*/e', 'wp_kses_bad_protocol_once2("\\1", $allowed_protocols)', $string); 
    695 } # function wp_kses_bad_protocol_once 
     829} 
    696830 
    697 function wp_kses_bad_protocol_once2($string, $allowed_protocols) 
    698 ############################################################################### 
    699 # This function processes URL protocols, checks to see if they're in the white- 
    700 # list or not, and returns different data depending on the answer. 
    701 ############################################################################### 
    702 { 
     831/** 
     832 * wp_kses_bad_protocol_once2() - Callback for wp_kses_bad_protocol_once() regular expression. 
     833 * 
     834 * This function processes URL protocols, checks to see if they're in the 
     835 * white-list or not, and returns different data depending on the answer. 
     836 * 
     837 * @since 1.0.0 
     838 * 
     839 * @param string $string Content to check for bad protocols 
     840 * @param array $allowed_protocols Allowed protocols 
     841 * @return string Sanitized content 
     842 */ 
     843function wp_kses_bad_protocol_once2($string, $allowed_protocols) { 
    703844        $string2 = wp_kses_decode_entities($string); 
    704845        $string2 = preg_replace('/\s/', '', $string2); 
    705846        $string2 = wp_kses_no_null($string2); 
     
    718859                return "$string2:"; 
    719860        else 
    720861                return ''; 
    721 } # function wp_kses_bad_protocol_once2 
     862} 
    722863 
    723 function wp_kses_normalize_entities($string) 
    724 ############################################################################### 
    725 # This function normalizes HTML entities. It will convert "AT&T" to the correct 
    726 # "AT&amp;T", "&#00058;" to "&#58;", "&#XYZZY;" to "&amp;#XYZZY;" and so on. 
    727 ############################################################################### 
    728 { 
     864/** 
     865 * wp_kses_normalize_entities() - Converts and fixes HTML entities 
     866 * 
     867 * This function normalizes HTML entities. It will convert "AT&T" to the 
     868 * correct "AT&amp;T", "&#00058;" to "&#58;", "&#XYZZY;" to "&amp;#XYZZY;" 
     869 * and so on. 
     870 * 
     871 * @since 1.0.0 
     872 * 
     873 * @param string $string Content to normalize entities 
     874 * @return string Content with normalized entities 
     875 */ 
     876function wp_kses_normalize_entities($string) { 
    729877        # Disarm all entities by converting & to &amp; 
    730878 
    731879        $string = str_replace('&', '&amp;', $string); 
     
    737885        $string = preg_replace('/&amp;#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', '&#\\1\\2;', $string); 
    738886 
    739887        return $string; 
    740 } # function wp_kses_normalize_entities 
     888} 
    741889 
    742 function wp_kses_normalize_entities2($i) 
    743 ############################################################################### 
    744 # This function helps wp_kses_normalize_entities() to only accept 16 bit values 
    745 # and nothing more for &#number; entities. 
    746 ############################################################################### 
    747 { 
     890/** 
     891 * wp_kses_normalize_entities2() - Callback for wp_kses_normalize_entities() regular expression 
     892 * 
     893 * This function helps wp_kses_normalize_entities() to only accept 16 bit 
     894 * values and nothing more for &#number; entities. 
     895 * 
     896 * @since 1.0.0 
     897 * 
     898 * @param int $i Number encoded entity 
     899 * @return string Correctly encoded entity 
     900 */ 
     901function wp_kses_normalize_entities2($i) { 
    748902        return (($i > 65535) ? "&amp;#$i;" : "&#$i;"); 
    749 } # function wp_kses_normalize_entities2 
     903} 
    750904 
    751 function wp_kses_decode_entities($string) 
    752 ############################################################################### 
    753 # This function decodes numeric HTML entities (&#65; and &#x41;). It doesn't 
    754 # do anything with other entities like &auml;, but we don't need them in the 
    755 # URL protocol whitelisting system anyway. 
    756 ############################################################################### 
    757 { 
     905/** 
     906 * wp_kses_decode_entities() - Convert all entities to their character counterparts. 
     907 * 
     908 * This function decodes numeric HTML entities (&#65; and &#x41;). It 
     909 * doesn't do anything with other entities like &auml;, but we don't need 
     910 * them in the URL protocol whitelisting system anyway. 
     911 * 
     912 * @since 1.0.0 
     913 * 
     914 * @param string $string Content to change entities 
     915 * @return string Content after decoded entities 
     916 */ 
     917function wp_kses_decode_entities($string) { 
    758918        $string = preg_replace('/&#([0-9]+);/e', 'chr("\\1")', $string); 
    759919        $string = preg_replace('/&#[Xx]([0-9A-Fa-f]+);/e', 'chr(hexdec("\\1"))', $string); 
    760920 
    761921        return $string; 
    762 } # function wp_kses_decode_entities 
     922} 
    763923 
     924/** 
     925 * wp_filter_kses() - Sanitize content with allowed HTML Kses rules 
     926 * 
     927 * @since 1.0.0 
     928 * @uses $allowedtags 
     929 * 
     930 * @param string $data Content to filter 
     931 * @return string Filtered content 
     932 */ 
    764933function wp_filter_kses($data) { 
    765934        global $allowedtags; 
    766935        return addslashes( wp_kses(stripslashes( $data ), $allowedtags) ); 
    767936} 
    768937 
     938/** 
     939 * wp_filter_post_kses() - Sanitize content for allowed HTML tags for post content 
     940 * 
     941 * Post content refers to the page contents of the 'post' type and not 
     942 * $_POST data from forms. 
     943 * 
     944 * @since 2.0.0 
     945 * @uses $allowedposttags 
     946 * 
     947 * @param string $data Post content to filter 
     948 * @return string Filtered post content with allowed HTML tags and attributes intact. 
     949 */ 
    769950function wp_filter_post_kses($data) { 
    770951        global $allowedposttags; 
    771952        return addslashes ( wp_kses(stripslashes( $data ), $allowedposttags) ); 
    772953} 
    773954 
     955/** 
     956 * wp_filter_nohtml_kses() - Strips all of the HTML in the content 
     957 * 
     958 * @since 2.1.0 
     959 * 
     960 * @param string $data Content to strip all HTML from 
     961 * @return string Filtered content without any HTML 
     962 */ 
    774963function wp_filter_nohtml_kses($data) { 
    775964        return addslashes ( wp_kses(stripslashes( $data ), array()) ); 
    776965} 
    777966 
     967/** 
     968 * kses_init_filters() - Adds all Kses input form content filters 
     969 * 
     970 * All hooks have default priority. The wp_filter_kses() fucntion 
     971 * is added to the 'pre_comment_content' and 'title_save_pre' 
     972 * hooks. The wp_filter_post_kses() function is added to the 
     973 * 'content_save_pre', 'excerpt_save_pre', and 'content_filtered_save_pre' 
     974 * hooks. 
     975 * 
     976 * @since 2.0.0 
     977 * @uses add_filter() See description for what functions are added to what hooks. 
     978 */ 
    778979function kses_init_filters() { 
    779980        // Normal filtering. 
    780981        add_filter('pre_comment_content', 'wp_filter_kses'); 
     
    786987        add_filter('content_filtered_save_pre', 'wp_filter_post_kses'); 
    787988} 
    788989 
     990/** 
     991 * kses_remove_filters() - Removes all Kses input form content filters 
     992 * 
     993 * A quick procedural method to removing all of the filters 
     994 * that kses uses for content in WordPress Loop. 
     995 * 
     996 * Does not remove the kses_init() function from 'init' hook 
     997 * (priority is default). Also does not remove kses_init() 
     998 * function from 'set_current_user' hook (priority is also 
     999 * default). 
     1000 * 
     1001 * @since 2.0.6 
     1002 */ 
    7891003function kses_remove_filters() { 
    7901004        // Normal filtering. 
    7911005        remove_filter('pre_comment_content', 'wp_filter_kses'); 
     
    7971011        remove_filter('content_filtered_save_pre', 'wp_filter_post_kses'); 
    7981012} 
    7991013 
     1014/** 
     1015 * kses_init() - Sets up most of the Kses filters for input form content 
     1016 * 
     1017 * If you remove the kses_init() function from 'init' hook and 
     1018 * 'set_current_user' (priority is default), then none of the 
     1019 * Kses filter hooks will be added. 
     1020 * 
     1021 * First removes all of the Kses filters in case the current user 
     1022 * does not need to have Kses filter the content. If the user does 
     1023 * not have unfiltered html capability, then Kses filters are added. 
     1024 * 
     1025 * @uses kses_remove_filters() Removes the Kses filters 
     1026 * @uses kses_init_filters() Adds the Kses filters back if the user 
     1027 *              does not have unfiltered HTML capability. 
     1028 * @since 2.0.0 
     1029 */ 
    8001030function kses_init() { 
    8011031        kses_remove_filters(); 
    8021032 
     
    8061036 
    8071037add_action('init', 'kses_init'); 
    8081038add_action('set_current_user', 'kses_init'); 
    809 ?> 
     1039?> 
     1040 No newline at end of file