Changeset 11929 for trunk/wp-includes/formatting.php

Timestamp:

09/14/2009 01:57:48 PM (15 years ago)

Author:

ryan

Message:

Filter fields through kses upon display. Introduce sanitize_user_object() and sanitize_user_field(). see #10751

File:

• trunk/wp-includes/formatting.php (modified) (5 diffs)

trunk/wp-includes/formatting.php

@@ -629 +629 @@
 function sanitize_user( $username, $strict = false ) {
     $raw_username = $username;
-    $username = strip_tags($username);
+    $username = wp_strip_all_tags($username);
     // Kill octets
     $username = preg_replace('|%([a-fA-F0-9][a-fA-F0-9])|', '', $username);
@@ -2246 +2246 @@
     $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );
     return apply_filters( 'esc_html', $safe_text, $text );
-    return $text;
 }
 
@@ -2602 +2601 @@
  */
 function wp_html_excerpt( $str, $count ) {
-    $str = strip_tags( $str );
+    $str = wp_strip_all_tags( $str, true );
     $str = mb_substr( $str, 0, $count );
     // remove part of an entity at the end
@@ -2669 +2668 @@
             $content);
 }
+
 /**
  * Callback to add a target attribute to all links in passed content.
@@ -2693 +2693 @@
 }
 
+/**
+ * Properly strip all HTML tags including script and style
+ *
+ * @since 2.9.0
+ *
+ * @param string $string String containing HTML tags
+ * @param bool $remove_breaks optional Whether to remove left over line breaks and white space chars
+ * @return string The processed string.
+ */
+function wp_strip_all_tags($string, $remove_breaks = false) {
+    $string = preg_replace( '@<(script|style)[^>]*?>.*?</\\1>@si', '', $string );
+    $string = strip_tags($string);
+
+    if ( $remove_breaks )
+        $string = preg_replace('/\s+/', ' ', $string);
+
+    return trim($string);
+}
+
+/**
+ * Sanitize a string from user input or from the db
+ *
+ * check for invalid UTF-8,
+ * Convert single < characters to entity,
+ * strip all tags,
+ * remove line breaks, tabs and extra whitre space,
+ * strip octets.
+ *
+ * @since 2.9
+ *
+ * @param string $str
+ * @return string
+ */
+function sanitize_text_field($str) {
+    $filtered = wp_check_invalid_utf8( $str );
+
+    if ( strpos($filtered, '<') !== false ) {
+        $filtered = wp_pre_kses_less_than( $filtered );
+        $filtered = wp_strip_all_tags( $filtered, true );
+    } else {
+         $filtered = trim( preg_replace('/\s+/', ' ', $filtered) );
+    }
+
+    $match = array();
+    while ( preg_match('/%[a-f0-9]{2}/i', $filtered, $match) )
+        $filtered = str_replace($match[0], '', $filtered);
+
+    return apply_filters('sanitize_text_field', $filtered, $str);
+}
+
 ?>