Changeset 11688
- Timestamp:
- 07/04/2009 04:47:58 AM (15 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/2.8/wp-includes/kses.php
r11212 r11688 522 522 } 523 523 524 if ( $arreach['name'] == 'style' ) { 525 $orig_value = $arreach['value']; 526 527 $value = safecss_filter_attr($orig_value, $element); 528 529 if ( empty($value) ) 530 continue; 531 532 $arreach['value'] = $value; 533 534 $arreach['whole'] = str_replace($orig_value, $value, $arreach['whole']); 535 } 536 524 537 if ($ok) 525 538 $attr2 .= ' '.$arreach['whole']; # it passed them … … 1123 1136 add_action('init', 'kses_init'); 1124 1137 add_action('set_current_user', 'kses_init'); 1125 ?> 1138 1139 function safecss_filter_attr( $css, $element ) { 1140 $css = wp_kses_no_null($css); 1141 $css = str_replace(array("\n","\r","\t"), '', $css); 1142 1143 if ( preg_match( '%[\\(&]|/\*%', $css ) ) // remove any inline css containing \ ( & or comments 1144 return ''; 1145 1146 $css_array = split( ';', trim( $css ) ); 1147 $allowed_attr = apply_filters( 'safe_style_css', array( 'text-align', 'margin', 'color', 'float', 1148 'border', 'background', 'background-color', 'border-bottom', 'border-bottom-color', 1149 'border-bottom-style', 'border-bottom-width', 'border-collapse', 'border-color', 'border-left', 1150 'border-left-color', 'border-left-style', 'border-left-width', 'border-right', 'border-right-color', 1151 'border-right-style', 'border-right-width', 'border-spacing', 'border-style', 'border-top', 1152 'border-top-color', 'border-top-style', 'border-top-width', 'border-width', 'caption-side', 1153 'clear', 'cursor', 'direction', 'font', 'font-family', 'font-size', 'font-style', 1154 'font-variant', 'font-weight', 'height', 'letter-spacing', 'line-height', 'margin-bottom', 1155 'margin-left', 'margin-right', 'margin-top', 'overflow', 'padding', 'padding-bottom', 1156 'padding-left', 'padding-right', 'padding-top', 'text-decoration', 'text-indent', 'vertical-align', 1157 'width' ) ); 1158 1159 if ( empty($allowed_attr) ) 1160 return $css; 1161 1162 $css = ''; 1163 foreach ( $css_array as $css_item ) { 1164 if ( $css_item == '' ) 1165 continue; 1166 $css_item = trim( $css_item ); 1167 $found = false; 1168 if ( strpos( $css_item, ':' ) === false ) { 1169 $found = true; 1170 } else { 1171 $parts = split( ':', $css_item ); 1172 if ( in_array( trim( $parts[0] ), $allowed_attr ) ) 1173 $found = true; 1174 } 1175 if ( $found ) { 1176 if( $css != '' ) 1177 $css .= ';'; 1178 $css .= $css_item; 1179 } 1180 } 1181 1182 return $css; 1183 }
Note: See TracChangeset
for help on using the changeset viewer.