Changeset 20539

Timestamp:

04/19/2012 07:46:34 PM (14 years ago)

Author:

nacin

Message:

Add sanity checks to WP_oEmbed::data2html() to ensure we are working with scalar values. Always use the filter. props mdawaffe, fixes #20322.

File:

• trunk/wp-includes/class-oembed.php (modified) (2 diffs)

trunk/wp-includes/class-oembed.php

@@ -228 +228 @@
          */
         function data2html( $data, $url ) {
-                if ( !is_object($data) || empty($data->type) )
+                if ( ! is_object( $data ) || empty( $data->type ) )
                         return false;
+
+                $return = false;
 
                 switch ( $data->type ) {
                         case 'photo':
-                                if ( empty($data->url) || empty($data->width) || empty($data->height) )
-                                        return false;
-
-                                $title = ( !empty($data->title) ) ? $data->title : '';
+                                if ( empty( $data->url ) || empty( $data->width ) || empty( $data->height ) )
+                                        break;
+                                if ( ! is_string( $data->url ) || ! is_numeric( $data->width ) || ! is_numeric( $data->height ) )
+                                        break;
+
+                                $title = ! empty( $data->title ) && is_string( $data->title ) ? $data->title : '';
                                 $return = '<a href="' . esc_url( $url ) . '"><img src="' . esc_url( $data->url ) . '" alt="' . esc_attr($title) . '" width="' . esc_attr($data->width) . '" height="' . esc_attr($data->height) . '" /></a>';
                                 break;
@@ -242 +246 @@
                         case 'video':
                         case 'rich':
-                                $return = ( !empty($data->html) ) ? $data->html : false;
+                                if ( ! empty( $data->html ) && is_string( $data->html ) )
+                                        $return = $data->html;
                                 break;
 
                         case 'link':
-                                $return = ( !empty($data->title) ) ? '<a href="' . esc_url($url) . '">' . esc_html($data->title) . '</a>' : false;
+                                if ( ! empty( $data->title ) && is_string( $data->title ) )
+                                        $return = '<a href="' . esc_url( $url ) . '">' . esc_html( $data->title ) . '</a>';
                                 break;