Ticket #7363: kses-create_function.patch

wp-includes/kses.php

@@ -850 +850 @@
 
         $string2 = preg_split('/:|:|:/i', $string, 2);
         if ( isset($string2[1]) && !preg_match('%/\?%', $string2[0]) )
-                $string = wp_kses_bad_protocol_once2($string2[0], $allowed_protocols) . trim($string2[1]);
+                $string = wp_kses_bad_protocol_once2($string2[0]) . trim($string2[1]);
         else
-                $string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|:|&#[Xx]3[Aa];)\s*/', create_function('$matches', 'global $_kses_allowed_protocols; return wp_kses_bad_protocol_once2($matches[1], $_kses_allowed_protocols);'), $string);
+                $string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|:|&#[Xx]3[Aa];)\s*/', 'wp_kses_bad_protocol_once2', $string);
 
         return $string;
 }
@@ -865 +865 @@
  *
  * @since 1.0.0
  *
- * @param string $string Content to check for bad protocols
- * @param array $allowed_protocols Allowed protocols
+ * @param mixed $matches string or preg_replace_callback() matches array to check for bad protocols
  * @return string Sanitized content
  */
-function wp_kses_bad_protocol_once2($string, $allowed_protocols) {
+function wp_kses_bad_protocol_once2($matches) {
+        global $_kses_allowed_protocols;
+
+        if ( is_array($matches) ) {
+                if ( ! isset($matches[1]) || empty($matches[1]) )
+                        return '';
+
+                $string = $matches[1];
+        } else {
+                $string = $matches;
+        }
+
         $string2 = wp_kses_decode_entities($string);
         $string2 = preg_replace('/\s/', '', $string2);
         $string2 = wp_kses_no_null($string2);
@@ -878 +888 @@
         $string2 = strtolower($string2);
 
         $allowed = false;
-        foreach ($allowed_protocols as $one_protocol)
+        foreach ( (array) $_kses_allowed_protocols as $one_protocol)
                 if (strtolower($one_protocol) == $string2) {
                         $allowed = true;
                         break;
@@ -910 +920 @@
         # Change back the allowed entities in our entity whitelist
 
         $string = preg_replace('/&([A-Za-z][A-Za-z0-9]{0,19});/', '&\\1;', $string);
-        $string = preg_replace_callback('/&#0*([0-9]{1,5});/', create_function('$matches', 'return wp_kses_normalize_entities2($matches[1]);'), $string);
-        $string = preg_replace_callback('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', create_function('$matches', 'return wp_kses_normalize_entities3($matches[2]);'), $string);
+        $string = preg_replace_callback('/&#0*([0-9]{1,5});/', 'wp_kses_normalize_entities2', $string);
+        $string = preg_replace_callback('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', 'wp_kses_normalize_entities3', $string);
 
         return $string;
 }
@@ -924 +934 @@
  *
  * @since 1.0.0
  *
- * @param int $i Number encoded entity
+ * @param array $matches preg_replace_callback() matches array
  * @return string Correctly encoded entity
  */
-function wp_kses_normalize_entities2($i) {
-        return ( (!valid_unicode($i)) || ($i > 65535) ? "&#$i;" : "&#$i;");
+function wp_kses_normalize_entities2($matches) {
+        if ( ! isset($matches[1]) || empty($matches[1]) )
+                return '';
+
+        $i = $matches[1];
+        return ( ( ! valid_unicode($i) ) || ($i > 65535) ? "&#$i;" : "&#$i;" );
 }
 
 /**
@@ -937 +951 @@
  * This function helps wp_kses_normalize_entities() to only accept valid Unicode numeric entities
  * in hex form.
  *
- * @param string $h Hex string of encoded entity
+ * @param array $matches preg_replace_callback() matches array
  * @return string Correctly encoded entity
  */
-function wp_kses_normalize_entities3($hexchars) {
-        return ( (!valid_unicode(hexdec($hexchars))) ? "&#x$hexchars;" : "&#x$hexchars;");
+function wp_kses_normalize_entities3($matches) {
+        if ( ! isset($matches[2]) || empty($matches[2]) )
+                return '';
+
+        $hexchars = $matches[2];
+        return ( ( ! valid_unicode(hexdec($hexchars)) ) ? "&#x$hexchars;" : "&#x$hexchars;" );
 }
 
 /**