Ticket #7363: 7363_2.patch

wp-includes/kses.php

@@ -850 +850 @@
 
         $string2 = preg_split('/:|:|:/i', $string, 2);
         if ( isset($string2[1]) && !preg_match('%/\?%', $string2[0]) )
-                $string = wp_kses_bad_protocol_once2($string2[0]) . trim($string2[1]);
+                $string = wp_kses_bad_protocol_once2($string2[0], $allowed_protocols) . trim($string2[1]);
         else
-                $string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|:|&#[Xx]3[Aa];)\s*/', 'wp_kses_bad_protocol_once2', $string);
+                $string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|:|&#[Xx]3[Aa];)\s*/', 'call_wp_kses_bad_protocol_once2', $string);
 
         return $string;
 }
 
+// Helper function used instead of create_function() for preg_replace_callback() in wp_kses_bad_protocol_once()
+function call_wp_kses_bad_protocol_once2( $matches ) {
+        global $_kses_allowed_protocols;
+
+        if ( ! isset($matches[1]) || empty($matches[1]) )
+                return '';
+
+        return wp_kses_bad_protocol_once2($matches[1], $_kses_allowed_protocols);
+}
+
 /**
  * wp_kses_bad_protocol_once2() - Callback for wp_kses_bad_protocol_once() regular expression.
  *
@@ -865 +875 @@
  *
  * @since 1.0.0
  *
- * @param mixed $matches string or preg_replace_callback() matches array to check for bad protocols
+ * @param string $string Content to check for bad protocols
+ * @param array $allowed_protocols Allowed protocols
  * @return string Sanitized content
  */
-function wp_kses_bad_protocol_once2($matches) {
-        global $_kses_allowed_protocols;
-
-        if ( is_array($matches) ) {
-                if ( ! isset($matches[1]) || empty($matches[1]) )
-                        return '';
-
-                $string = $matches[1];
-        } else {
-                $string = $matches;
-        }
-
+function wp_kses_bad_protocol_once2($string, $allowed_protocols) {
         $string2 = wp_kses_decode_entities($string);
         $string2 = preg_replace('/\s/', '', $string2);
         $string2 = wp_kses_no_null($string2);
@@ -888 +888 @@
         $string2 = strtolower($string2);
 
         $allowed = false;
-        foreach ( (array) $_kses_allowed_protocols as $one_protocol)
+        foreach ($allowed_protocols as $one_protocol)
                 if (strtolower($one_protocol) == $string2) {
                         $allowed = true;
                         break;
@@ -920 +920 @@
         # Change back the allowed entities in our entity whitelist
 
         $string = preg_replace('/&([A-Za-z][A-Za-z0-9]{0,19});/', '&\\1;', $string);
-        $string = preg_replace_callback('/&#0*([0-9]{1,5});/', 'wp_kses_normalize_entities2', $string);
-        $string = preg_replace_callback('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', 'wp_kses_normalize_entities3', $string);
+        $string = preg_replace_callback('/&#0*([0-9]{1,5});/', 'call_wp_kses_normalize_entities2', $string);
+        $string = preg_replace_callback('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', 'call_wp_kses_normalize_entities3', $string);
 
         return $string;
 }
 
+// Helper function used instead of create_function() for preg_replace_callback() in wp_kses_normalize_entities() 
+function call_wp_kses_normalize_entities2($matches) {
+        if ( ! isset($matches[1]) || empty($matches[1]) )
+                return '';
+
+        return wp_kses_normalize_entities2($matches[1]);
+}
+
 /**
  * wp_kses_normalize_entities2() - Callback for wp_kses_normalize_entities() regular expression
  *
@@ -934 +942 @@
  *
  * @since 1.0.0
  *
- * @param array $matches preg_replace_callback() matches array
+ * @param int $i Number encoded entity
  * @return string Correctly encoded entity
  */
-function wp_kses_normalize_entities2($matches) {
-        if ( ! isset($matches[1]) || empty($matches[1]) )
+function wp_kses_normalize_entities2($i) {
+        return ( (!valid_unicode($i)) || ($i > 65535) ? "&#$i;" : "&#$i;");
+}
+
+// Helper function used instead of create_function() for preg_replace_callback() in wp_kses_normalize_entities() 
+function call_wp_kses_normalize_entities3($matches) {
+        if ( ! isset($matches[2]) || empty($matches[2]) )
                 return '';
 
-        $i = $matches[1];
-        return ( ( ! valid_unicode($i) ) || ($i > 65535) ? "&#$i;" : "&#$i;" );
+        return wp_kses_normalize_entities3($matches[2]);
 }
 
 /**
@@ -951 +963 @@
  * This function helps wp_kses_normalize_entities() to only accept valid Unicode numeric entities
  * in hex form.
  *
- * @param array $matches preg_replace_callback() matches array
+ * @param string $h Hex string of encoded entity
  * @return string Correctly encoded entity
  */
-function wp_kses_normalize_entities3($matches) {
-        if ( ! isset($matches[2]) || empty($matches[2]) )
-                return '';
-
-        $hexchars = $matches[2];
-        return ( ( ! valid_unicode(hexdec($hexchars)) ) ? "&#x$hexchars;" : "&#x$hexchars;" );
+function wp_kses_normalize_entities3($hexchars) {
+        return ( (!valid_unicode(hexdec($hexchars))) ? "&#x$hexchars;" : "&#x$hexchars;");
 }
 
 /**