WordPress.org

Make WordPress Core

Changeset 19675


Ignore:
Timestamp:
01/04/2012 07:45:13 PM (7 years ago)
Author:
ryan
Message:

Introduce sanitize_trackback_urls(). Don't ping bad urls. Don't ping bad urls or save them to the DB. Props xknown, SergeyBiryukov. fixes #17560

Location:
trunk/wp-includes
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-includes/formatting.php

    r19601 r19675  
    30033003}
    30043004
     3005/**
     3006 * Sanitize space or carriage return separated URLs that are used to send trackbacks.
     3007 *
     3008 * @since 3.4.0
     3009 *
     3010 * @param string $to_ping Space or carriage return separated URLs
     3011 * @return string URLs starting with the http or https protocol, separated by a carriage return.
     3012 */
     3013function sanitize_trackback_urls( $to_ping ) {
     3014    $urls_to_ping = preg_split( '/\r\n\t /', trim( $to_ping ), -1, PREG_SPLIT_NO_EMPTY );
     3015    foreach ( $urls_to_ping as $k => $url ) {
     3016        if ( !preg_match( '#^https?://.#i', $url ) )
     3017            unset( $urls_to_ping[$k] );
     3018    }
     3019    $urls_to_ping = array_map( 'esc_url_raw', $urls_to_ping );
     3020    $urls_to_ping = implode( "\n", $urls_to_ping );
     3021    return apply_filters( 'sanitize_trackback_urls', $urls_to_ping, $to_ping );
     3022}
     3023
    30053024?>
  • trunk/wp-includes/post.php

    r19593 r19675  
    25382538
    25392539    if ( isset($to_ping) )
    2540         $to_ping = preg_replace('|\s+|', "\n", $to_ping);
     2540        $to_ping = sanitize_trackback_urls( $to_ping );
    25412541    else
    25422542        $to_ping = '';
     
    30653065    global $wpdb;
    30663066    $to_ping = $wpdb->get_var( $wpdb->prepare( "SELECT to_ping FROM $wpdb->posts WHERE ID = %d", $post_id ));
    3067     $to_ping = trim($to_ping);
     3067    $to_ping = sanitize_trackback_urls( $to_ping );
    30683068    $to_ping = preg_split('/\s/', $to_ping, -1, PREG_SPLIT_NO_EMPTY);
    30693069    $to_ping = apply_filters('get_to_ping',  $to_ping);
Note: See TracChangeset for help on using the changeset viewer.