Changeset 11433

Timestamp:

05/22/2009 05:44:26 PM (15 years ago)

Author:

westi

Message:

Introduce sanitise_css_classname() and use it to give categories, tags, users etc meaningful classnames where possible. Falls back to the id if not. Fixes #8446.

Location:

trunk/wp-includes

Files:

• comment-template.php (modified) (1 diff)
• formatting.php (modified) (1 diff)
• post-template.php (modified) (2 diffs)

trunk/wp-includes/comment-template.php

@@ -295 +295 @@
         // For all registered users, 'byuser'
         $classes[] = 'byuser';
-        $classes[] = 'comment-author-' . $comment->user_id;
+        $classes[] = 'comment-author-' . sanitise_css_classname($user->user_nicename, $comment->user_id);
         // For comment authors who are the author of the post
         if ( $post = get_post($post_id) ) {

trunk/wp-includes/formatting.php

@@ -717 +717 @@
         return false;
     return $orderby;
+}
+
+/**
+ * Santises a css classname to ensure it only contains valid characters
+ * 
+ * Strips the classname down to A-Z,a-z,0-9,'-' if this results in an empty
+ * string then it will return the alternative value supplied.
+ *  
+ * @param string $classname The classname to be sanitised
+ * @param string $alternative The value to return if the sanitisation end's up as an empty string.
+ * @return string The sanitised value
+ */
+function sanitise_css_classname($classname, $alternative){
+    //Strip out any % encoded octets
+    $sanitised = preg_replace('|%[a-fA-F0-9][a-fA-F0-9]|', '', $classname);
+    
+    //Limit to A-Z,a-z,0-9,'-'
+    $sanitised = preg_replace('/[^A-Za-z0-9-]/', '', $sanitised);
+    
+    if ('' == $sanitised)
+        $sanitised = $alternative;
+    
+    return apply_filters('sanitise_css_classname',$sanitised, $classname, $alternative);    
 }
 

trunk/wp-includes/post-template.php

@@ -325 +325 @@
     // Categories
     foreach ( (array) get_the_category($post->ID) as $cat ) {
-        if ( empty($cat->cat_ID ) )
+        if ( empty($cat->slug ) )
             continue;
-        $classes[] = 'category-' . $cat->cat_ID;
+        $classes[] = 'category-' . sanitise_css_classname($cat->slug, $cat->cat_ID);
     }
 
     // Tags
     foreach ( (array) get_the_tags($post->ID) as $tag ) {
-        if ( empty($tag->term_id ) )
+        if ( empty($tag->slug ) )
             continue;
-        $classes[] = 'tag-' . $tag->term_id;
+        $classes[] = 'tag-' . sanitise_css_classname($tag->slug, $tag->term_id);
     }
 
@@ -408 +408 @@
             $author = $wp_query->get_queried_object();
             $classes[] = 'author';
-            $classes[] = 'author-' . $author->user_id;
+            $classes[] = 'author-' . sanitise_css_classname($author->user_nicename , $author->user_id);
         } elseif ( is_category() ) {
             $cat = $wp_query->get_queried_object();
             $classes[] = 'category';
-            $classes[] = 'category-' . $cat->cat_ID;
+            $classes[] = 'category-' . sanitise_css_classname($cat->slug, $cat->cat_ID);
         } elseif ( is_tag() ) {
             $tags = $wp_query->get_queried_object();
             $classes[] = 'tag';
-            $classes[] = 'tag-' . $tags->term_id;
+            $classes[] = 'tag-' . sanitise_css_classname($tags->slug, $tags->term_id);
         }
     } elseif ( is_page() ) {