Changeset 10297 for trunk/wp-includes/compat.php

Timestamp:

01/04/2009 10:25:50 PM (17 years ago)

Author:

azaozz

Message:

Refactor filters to avoid potential XSS attacks, props sambauers and DD32, see #8767

File:

• trunk/wp-includes/compat.php (modified) (1 diff)

trunk/wp-includes/compat.php

@@ -97 +97 @@
 }
 
-// from php.net
-if ( !function_exists('htmlspecialchars_decode') ) {
+if ( !function_exists( 'htmlspecialchars_decode' ) ) {
+    // Added in PHP 5.1.0
+    // from php.net (modified by Sam Bauers to deal with some quirks in HTML_SPECIALCHARS constant)
     function htmlspecialchars_decode( $str, $quote_style = ENT_COMPAT ) {
-        return strtr( $str, array_flip( get_html_translation_table(HTML_SPECIALCHARS, $quote_style) ) );
-    }
+        $table = array_flip( get_html_translation_table( HTML_SPECIALCHARS, $quote_style ) );
+        $table = array_merge( array( ''' => "'" ), $table, array( '&' => "&", '&' => "&" ) );
+        return strtr( $str, $table );
+    }
 }