WordPress.org
Get WordPress

Make WordPress Core

Ticket #62885: 62885.diff

File 62885.diff, 3.2 KB (added by kapasias, 10 months ago)

  • src/wp-includes/formatting.php 

    diff --git a/src/wp-includes/formatting.php b/src/wp-includes/formatting.php
index 3ecc352528..8e89401d34 100644
    a b function wp_html_split( $input ) { 
    621621 *
    622622 * @since 4.4.0
    623623 *
    624  * @return string The regular expression
     624 * @return string The regular expression.
    625625 */
    626626function get_html_split_regex() {
    627627        static $regex;
    … … function get_html_split_regex() { 
    681681 * @since 4.4.0
    682682 *
    683683 * @param string $shortcode_regex Optional. The result from _get_wptexturize_shortcode_regex().
    684  * @return string The regular expression
     684 * @return string The regular expression.
    685685 */
    686686function _get_wptexturize_split_regex( $shortcode_regex = '' ) {
    687687        static $html_regex;
    … … function _get_wptexturize_split_regex( $shortcode_regex = '' ) { 
    723723 * @since 4.4.0
    724724 *
    725725 * @param string[] $tagnames Array of shortcodes to find.
    726  * @return string The regular expression
     726 * @return string The regular expression.
    727727 */
    728728function _get_wptexturize_shortcode_regex( $tagnames ) {
    729729        $tagregexp = implode( '|', array_map( 'preg_quote', $tagnames ) );
    … … function shortcode_unautop( $text ) { 
    877877 * @author bmorel at ssi dot fr (modified)
    878878 * @since 1.2.1
    879879 *
    880  * @param string $str The string to be checked
     880 * @param string $str The string to be checked.
    881881 * @return bool True if $str fits a UTF-8 model, false otherwise.
    882882 */
    883883function seems_utf8( $str ) {
    … … function wp_check_invalid_utf8( $text, $strip = false ) { 
    11391139 * @since 5.8.3 Added the `encode_ascii_characters` parameter.
    11401140 *
    11411141 * @param string $utf8_string             String to encode.
    1142  * @param int    $length                  Max length of the string
     1142 * @param int    $length                  Max length of the string.
    11431143 * @param bool   $encode_ascii_characters Whether to encode ascii characters such as < " '
    11441144 * @return string String with Unicode encoded for URI.
    11451145 */
    … … function convert_invalid_entities( $content ) { 
    25362536 *
    25372537 * @since 0.71
    25382538 *
    2539  * @param string $text  Text to be balanced
     2539 * @param string $text  Text to be balanced.
    25402540 * @param bool   $force If true, forces balancing, ignoring the value of the option. Default false.
    2541  * @return string Balanced text
     2541 * @return string Balanced text.
    25422542 */
    25432543function balanceTags( $text, $force = false ) {  // phpcs:ignore WordPress.NamingConventions.ValidFunctionName.FunctionNameInvalid
    25442544        if ( $force || (int) get_option( 'use_balanceTags' ) === 1 ) {
    … … function esc_html( $text ) { 
    46884688function esc_attr( $text ) {
    46894689        $safe_text = wp_check_invalid_utf8( $text );
    46904690        $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );
     4691        $safe_text = preg_replace( '/\s*on\w+\s*=\s*["\']?.*?["\']?/i', '', $safe_text );
    46914692        /**
    46924693         * Filters a string cleaned and escaped for output in an HTML attribute.
    46934694         *
    … … function esc_attr( $text ) { 
    46964697         *
    46974698         * @since 2.0.6
    46984699         *
    4699          * @param string $safe_text The text after it has been escaped.
     4700         * @param string $safe_text The text after it has been sanitized and escaped.
    47004701         * @param string $text      The text prior to being escaped.
    47014702         */
    47024703        return apply_filters( 'attribute_escape', $safe_text, $text );