Changeset 29681

Timestamp:

09/03/2014 12:39:05 AM (12 years ago)

Author:

nacin

Message:

Ensure oEmbed previews listen to [embed] width/height attributes.

props azaozz.
fixes #29474.

File:

• trunk/src/wp-admin/includes/ajax-actions.php (modified) (5 diffs)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -2639 +2639 @@
         global $post, $wp_embed;
 
-        if ( ! $post = get_post( (int) $_REQUEST['post_ID'] ) ) {
+        if ( ! $post = get_post( (int) $_POST['post_ID'] ) ) {
                 wp_send_json_error();
         }
@@ -2647 +2647 @@
         }
 
-        $shortcode = $_POST['shortcode'];
+        $shortcode = wp_unslash( $_POST['shortcode'] );
         $url = str_replace( '[embed]', '', str_replace( '[/embed]', '', $shortcode ) );
         $parsed = false;
@@ -2654 +2654 @@
         $wp_embed->return_false_on_fail = true;
 
-        if ( is_ssl() && preg_match( '%^\\[embed\\]http://%i', $shortcode ) ) {
+        if ( is_ssl() && preg_match( '%^\\[embed[^\\]]*\\]http://%i', $shortcode ) ) {
                 // Admin is ssl and the user pasted non-ssl URL.
                 // Check if the provider supports ssl embeds and use that for the preview.
-                $ssl_shortcode = preg_replace( '%^\\[embed\\]http://%i', '[embed]https://', $shortcode );
+                $ssl_shortcode = preg_replace( '%^(\\[embed[^\\]]*\\])http://%i', '$1https://', $shortcode );
                 $parsed = $wp_embed->run_shortcode( $ssl_shortcode );
 
@@ -2714 +2714 @@
         global $post, $wp_scripts;
 
-        if ( ! $post = get_post( (int) $_REQUEST['post_ID'] ) ) {
+        if ( ! $post = get_post( (int) $_POST['post_ID'] ) ) {
                 wp_send_json_error();
         }
@@ -2723 +2723 @@
 
         setup_postdata( $post );
-        $shortcode = do_shortcode( wp_unslash( $_REQUEST['shortcode'] ) );
+        $shortcode = do_shortcode( wp_unslash( $_POST['shortcode'] ) );
 
         if ( empty( $shortcode ) ) {