Changeset 31148

Timestamp:

01/11/2015 10:26:55 PM (12 years ago)

Author:

wonderboymusic

Message:

In WP_oEmbed, only allow __call() to run against a whitelist of methods, $compat_methods.

See #30891.

File:

• trunk/src/wp-includes/class-oembed.php (modified) (2 diffs)

trunk/src/wp-includes/class-oembed.php

@@ -21 +21 @@
         public $providers = array();
         public static $early_providers = array();
+
+        private $compat_methods = array( '_fetch_with_format', '_parse_json', '_parse_xml', '_parse_body' );
 
         /**
@@ -171 +173 @@
          */
         public function __call( $name, $arguments ) {
-                return call_user_func_array( array( $this, $name ), $arguments );
+                if ( in_array( $name, $this->compat_methods ) ) {
+                        return call_user_func_array( array( $this, $name ), $arguments );
+                }
+                return false;
         }