Ticket #40916: 40916.diff

wp-admin/edit-comments.php

@@ -16 +16 @@
         );
 }
 
+//* TODO determine whether to move globally (i.e. filter "pre_comment_content"). Ticket #40916
+add_filter( 'comment_text', 'wp_unbind_links', 35 );
+
 $wp_list_table = _get_list_table('WP_Comments_List_Table');
 $pagenum = $wp_list_table->get_pagenum();
 

wp-admin/includes/class-wp-comments-list-table.php

@@ -440 +440 @@
                 $this->display_tablenav( 'top' );
 
                 $this->screen->render_screen_reader_content( 'heading_list' );
-
 ?>
 <table class="wp-list-table <?php echo implode( ' ', $this->get_table_classes() ); ?>">
         <thead>
@@ -652 +651 @@
                 }
 
                 comment_text( $comment );
+
                 if ( $this->user_can ) { ?>
                 <div id="inline-<?php echo $comment->comment_ID; ?>" class="hidden">
                 <textarea class="comment" rows="1" cols="1"><?php
@@ -685 +685 @@
 
                 echo "<strong>"; comment_author( $comment ); echo '</strong><br />';
                 if ( ! empty( $author_url_display ) ) {
-                        printf( '<a href="%s">%s</a><br />', esc_url( $author_url ), esc_html( $author_url_display ) );
+                        // Ticket #40916
+                        printf( '<a href="%s" rel="noopener noreferrer" target="_blank">%s</a><br />', esc_url( $author_url ), esc_html( $author_url_display ) );
                 }
 
                 if ( $this->user_can ) {

wp-includes/formatting.php

@@ -2758 +2758 @@
 }
 
 /**
+ * Adds target="_blank" and rel="noreferrer noopener" strings to all HTML A elements
+ * in content.
+ *
+ * Removes current target and rel attributes prior.
+ *
+ * @since TODO Ticket #40916
+ *
+ * @param string $text Content that may contain HTML A elements.
+ * @return string Converted content.
+ */
+function wp_unbind_links( $text ) {
+
+        // Ticket #40916 Filter usage to be determined...
+        if ( 'pre_comment_content' === current_filter() ) {
+                // This is a pre save filter, so text is already escaped.
+                $text = stripslashes( $text );
+                $text = preg_replace_callback( '|<a (.+?)>|i', 'wp_unbind_links_callback', $text );
+                return wp_slash( $text );
+        }
+
+        return preg_replace_callback( '|<a (.+?)>|i', 'wp_unbind_links_callback', $text );
+}
+
+/**
+ * Callback to add target="_blank" and rel="noreferrer noopener" string to HTML A element.
+ *
+ * Will remove already existing rel="noreferrer", rel='noreferrer', rel="noopener"
+ * and rel='noopener' from the string to prevent from invalidating (X)HTML.
+ *
+ * @since TODO Ticket #40916
+ *
+ * @param array $matches Single Match
+ * @return string HTML A Element with target="_blank" and rel="noreferrer noopener".
+ */
+function wp_unbind_links_callback( $matches ) {
+
+        $text = $matches[1];
+
+        // TODO Do we want to exclude own pages?
+        /*
+        if ( preg_match( '%href=["\'](https?' . preg_quote( str_replace( 'http://', '://', set_url_scheme( home_url(), 'http' ) ) ) . ')%i', $text ) ) {
+                return "<a $text>";
+        }
+        */
+
+        /**
+         * Captures rel and target attributes with content.
+         * Closing/opening tag aware, i.e. it captures:
+         * rel='nofollow"', rel="nofollow", rel=nofollow, rel="nofollow noreferrer"
+         */
+        $regex = '/(target|rel)\=(\'|"?)((?:.(?!\2?\s+(?:\S+)=|[>]\2))+.)\2?/i';
+
+        //* TODO This will add stray whitespaces... It's not important enough to clean up.
+        $text = preg_replace( $regex, '', $text );
+
+        return sprintf( '<a %s target=_blank rel="noopener noreferrer">', $text );
+}
+
+/**
  * Convert one smiley code to the icon graphic file equivalent.
  *
  * Callback handler for convert_smilies().