Changeset 14231

Timestamp:

04/25/2010 08:16:10 AM (16 years ago)

Author:

dd32

Message:

Add basic email/url validation to General options page. Prevents users entering a invalid Admin email or WordPress/Site Address which is not in URL form. Props technosailor for initial patch, slightly reworked. See #12868

File:

• trunk/wp-includes/formatting.php (modified) (4 diffs)

trunk/wp-includes/formatting.php

@@ -2197 +2197 @@
         $original_url = $url;
 
-        if ('' == $url) return $url;
+        if ( '' == $url )
+                return $url;
         $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url);
         $strip = array('%0d', '%0a', '%0D', '%0A');
@@ -2357 +2358 @@
 function sanitize_option($option, $value) {
 
-        switch ($option) {
+        switch ( $option ) {
                 case 'admin_email':
                         $value = sanitize_email($value);
-                        if ( !$value && function_exists('add_settings_error') )
-                                add_settings_error('admin_email', 'invalid_admin_email', __('The email address submitted was not in the right format. Please enter a valid email address.'));
+                        if ( !is_email($value) ) {
+                                $value = get_option( $option ); // Resets option to stored value in the case of failed sanitization
+                                if ( function_exists('add_settings_error') )
+                                        add_settings_error('admin_email', 'invalid_admin_email', __('The email address entered did not appear to be a valid email address. Please enter a valid email address.'));
+                        }
                         break;
 
@@ -2395 +2399 @@
                 case 'posts_per_rss':
                         $value = (int) $value;
-                        if ( empty($value) ) $value = 1;
-                        if ( $value < -1 ) $value = abs($value);
+                        if ( empty($value) )
+                                $value = 1;
+                        if ( $value < -1 )
+                                $value = abs($value);
                         break;
 
@@ -2436 +2442 @@
 
                 case 'siteurl':
+                        if ( (bool)preg_match( '#http(s?)://(.+)#i', $value) ) {
+                                $value = esc_url_raw($value);
+                        } else {
+                                $value = get_option( $option ); // Resets option to stored value in the case of failed sanitization
+                                if ( function_exists('add_settings_error') )
+                                        add_settings_error('siteurl', 'invalid_siteurl', __('The WordPress address you entered did not appear to be a valid URL. Please enter a valid URL.'));
+                        }
+                        break;
+
                 case 'home':
-                        $value = esc_url_raw($value);
+                        if ( (bool)preg_match( '#http(s?)://(.+)#i', $value) ) {
+                                $value = esc_url_raw($value);
+                        } else {
+                                $value = get_option( $option ); // Resets option to stored value in the case of failed sanitization
+                                if ( function_exists('add_settings_error') )
+                                        add_settings_error('home', 'invalid_home', __('The Site address you entered did not appear to be a valid URL. Please enter a valid URL.'));
+                        }
                         break;
+
                 default :
                         $value = apply_filters("sanitize_option_{$option}", $value, $option);