Changeset 11616

Timestamp:

06/20/2009 05:49:50 PM (17 years ago)

Author:

westi

Message:

Introduce _deep_replace() and use it to improve the stripping of percent encoded values from urls. Fixes #10226 for 2.8.1

Location:

branches/2.8

Files:

• wp-admin/theme-editor.php (modified) (1 diff)
• wp-includes/formatting.php (modified) (2 diffs)
• wp-includes/pluggable.php (modified) (1 diff)

branches/2.8/wp-admin/theme-editor.php

@@ -66 +66 @@
 
         $location = wp_kses_no_null($location);
-        $strip = array('%0d', '%0a');
-        $location = str_replace($strip, '', $location);
+        $strip = array('%0d', '%0a', '%0D', '%0A');
+        $location = _deep_replace($strip, $location);
         header("Location: $location");
         exit();

branches/2.8/wp-includes/formatting.php

@@ -2043 +2043 @@
         if ('' == $url) return $url;
         $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url);
-        $strip = array('%0d', '%0a');
-        $url = str_replace($strip, '', $url);
+        $strip = array('%0d', '%0a', '%0D', '%0A');
+        $url = _deep_replace($strip, $url);
         $url = str_replace(';//', '://', $url);
         /* If the URL doesn't appear to contain a scheme, we
@@ -2066 +2066 @@
 
         return apply_filters('clean_url', $url, $original_url, $context);
+}
+
+/**
+ * Perform a deep string replace operation to ensure the values in $search are no longer present
+ * 
+ * Repeats the replacement operation until it no longer replaces anything so as to remove "nested" values
+ * e.g. $subject = '%0%0%0DDD', $search ='%0D', $result ='' rather than the '%0%0DD' that
+ * str_replace would return
+ * 
+ * @since 2.8.1
+ * @access private
+ * 
+ * @param string|array $search
+ * @param string $subject
+ * @return string The processed string
+ */
+function _deep_replace($search, $subject){
+        $found = true;
+        while($found) {
+                $found = false;
+                foreach( (array) $search as $val ) {
+                        while(strpos($subject, $val) !== false) {
+                                $found = true;
+                                $subject = str_replace($val, '', $subject);
+                        }
+                }
+        }
+        
+        return $subject;
 }
 

branches/2.8/wp-includes/pluggable.php

@@ -881 +881 @@
 
         // remove %0d and %0a from location
-        $strip = array('%0d', '%0a');
-        $found = true;
-        while($found) {
-                $found = false;
-                foreach( (array) $strip as $val ) {
-                        while(strpos($location, $val) !== false) {
-                                $found = true;
-                                $location = str_replace($val, '', $location);
-                        }
-                }
-        }
+        $strip = array('%0d', '%0a', '%0D', '%0A');
+        $location = _deep_replace($strip, $location);
         return $location;
 }