Changeset 17171 for trunk/wp-includes/formatting.php

Timestamp:

12/29/2010 08:45:37 PM (13 years ago)

Author:

ryan

Message:

Don't be case sensitive to attribute names. Handle padded entities when checking for bad protocols. Normalize entities before checking for bad protocols in esc_url(). Props Mauro Gentile, duck_, miqrogroove

File:

• trunk/wp-includes/formatting.php (modified) (1 diff)

trunk/wp-includes/formatting.php

@@ -2269 +2269 @@
     // Replace ampersands and single quotes only when displaying.
     if ( 'display' == $_context ) {
-        $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
+        $url = wp_kses_normalize_entities( $url );
+        $url = str_replace( '&', '&', $url );
         $url = str_replace( "'", ''', $url );
     }