Ticket #17780: miqro-17780.5.patch

src/wp-admin/edit-form-advanced.php

@@ -494 +494 @@
         $title_placeholder = apply_filters( 'enter_title_here', __( 'Enter title here' ), $post );
         ?>
         <label class="screen-reader-text" id="title-prompt-text" for="title"><?php echo $title_placeholder; ?></label>
-        <input type="text" name="post_title" size="30" value="<?php echo esc_attr( htmlspecialchars( $post->post_title ) ); ?>" id="title" spellcheck="true" autocomplete="off" />
+        <input type="text" name="post_title" size="30" value="<?php echo esc_attr( $post->post_title ); ?>" id="title" spellcheck="true" autocomplete="off" />
 </div>
 <?php
 /**

src/wp-includes/formatting.php

@@ -751 +751 @@
                 $quote_style = ENT_NOQUOTES;
         }
 
-        // Handle double encoding ourselves
-        if ( $double_encode ) {
-                $string = @htmlspecialchars( $string, $quote_style, $charset );
-        } else {
-                // Decode & into &
-                $string = wp_specialchars_decode( $string, $_quote_style );
-
-                // Guarantee every &entity; is valid or re-encode the &
+        if ( ! $double_encode ) {
+                // Guarantee every &entity; is valid, convert &garbage; into &garbage;
+                // This is required for PHP < 5.4.0 because ENT_HTML401 flag is unavailable.
                 $string = wp_kses_normalize_entities( $string );
+        }
 
-                // Now re-encode everything except &entity;
-                $string = preg_split( '/(&#?x?[0-9a-z]+;)/i', $string, -1, PREG_SPLIT_DELIM_CAPTURE );
+        $string = @htmlspecialchars( $string, $quote_style, $charset, $double_encode );
 
-                for ( $i = 0, $c = count( $string ); $i < $c; $i += 2 ) {
-                        $string[$i] = @htmlspecialchars( $string[$i], $quote_style, $charset );
-                }
-                $string = implode( '', $string );
-        }
-
         // Backwards compatibility
         if ( 'single' === $_quote_style )
                 $string = str_replace( "'", '&#039;', $string );

tests/phpunit/tests/formatting/EscAttr.php

@@ -26 +26 @@
         }
 
         function test_esc_attr_amp() {
-                $out = esc_attr( 'foo & bar &baz; '' );
-                $this->assertEquals( "foo & bar &baz; '", $out );
+                $out = esc_attr( 'foo & bar &baz;  ' );
+                $this->assertEquals( "foo & bar &baz;  ", $out );
         }
 }

tests/phpunit/tests/formatting/EscHtml.php

@@ -34 +34 @@
 
         function test_ignores_existing_entities() {
                 $source = '& £ " &';
-                $res = '& £ " &';
+                $res = '& £ " &';
                 $this->assertEquals( $res, esc_html($source) );
         }
 }

tests/phpunit/tests/formatting/JSEscape.php

@@ -23 +23 @@
         }
 
         function test_js_escape_amp() {
-                $out = esc_js('foo & bar &baz; '');
-                $this->assertEquals("foo & bar &baz; '", $out);
+                $out = esc_js('foo & bar &baz;  ');
+                $this->assertEquals("foo & bar &baz;  ", $out);
         }
 
         function test_js_escape_quote_entity() {
                 $out = esc_js('foo ' bar ' baz &');
-                $this->assertEquals("foo \\' bar \\' baz &", $out);
+                $this->assertEquals("foo \\' bar \\' baz &", $out);
         }
 
         function test_js_no_carriage_return() {

tests/phpunit/tests/formatting/WPSpecialchars.php

@@ -17 +17 @@
 
                 // Allowed entities should be unchanged
                 foreach ( $allowedentitynames as $ent ) {
+                        if ( 'apos' == $ent ) {
+                                // But for some reason, PHP doesn't allow '
+                                continue;
+                        }
                         $ent = '&' . $ent . ';';
                         $this->assertEquals( $ent, _wp_specialchars( $ent ) );
                 }
@@ -39 +43 @@
                 $this->assertEquals( '"'hello!'"', _wp_specialchars($source, true) );
                 $this->assertEquals( $source, _wp_specialchars($source) );
         }
+
+        /**
+         * Check some of the double-encoding features for entity references.
+         *
+         * @ticket 17780
+         * @dataProvider data_double_encoding
+         */
+        function test_double_encoding( $input, $output ) {
+                return $this->assertEquals( $output, _wp_specialchars( $input, ENT_NOQUOTES, false, true ) );
+        }
+
+        function data_double_encoding() {
+                return array(
+                        array(
+                                'This & that, this & that, — " " Ú   " " " " " $ ×',
+                                'This & that, this & that, — " " Ú   " " " " " $ ×',
+                        ),
+                        array(
+                                '&& && && &;',
+                                '&& && && &;',
+                        ),
+                        array(
+                                '&garbage; &***; &aaaa; &0000; &####; &;;',
+                                '&garbage; &***; &aaaa; &0000; &####; &;;',
+                        ),
+                );
+        }
+
+        /**
+         * Check some of the double-encoding features for entity references.
+         *
+         * @ticket 17780
+         * @dataProvider data_no_double_encoding
+         */
+        function test_no_double_encoding( $input, $output ) {
+                return $this->assertEquals( $output, _wp_specialchars( $input, ENT_NOQUOTES, false, false ) );
+        }
+
+        function data_no_double_encoding() {
+                return array(
+                        array(
+                                'This & that, this & that, — " " Ú   " " " " " $ ×',
+                                'This & that, this & that, — " " Ú   " " " " " $ ×',
+                        ),
+                        array(
+                                '&& && && &;',
+                                '&& && && &;',
+                        ),
+                        array(
+                                '&garbage; &***; &aaaa; &0000; &####; &;;',
+                                '&garbage; &***; &aaaa; &0000; &####; &;;',
+                        ),
+                );
+        }
 }