Changeset 31148

Timestamp:

01/11/2015 10:26:55 PM (11 years ago)

Author:

wonderboymusic

Message:

In WP_oEmbed, only allow __call() to run against a whitelist of methods, $compat_methods.

See #30891.

File:

• trunk/src/wp-includes/class-oembed.php (modified) (2 diffs)

trunk/src/wp-includes/class-oembed.php

@@ -21 +21 @@
     public $providers = array();
     public static $early_providers = array();
+
+    private $compat_methods = array( '_fetch_with_format', '_parse_json', '_parse_xml', '_parse_body' );
 
     /**
@@ -171 +173 @@
      */
     public function __call( $name, $arguments ) {
-        return call_user_func_array( array( $this, $name ), $arguments );
+        if ( in_array( $name, $this->compat_methods ) ) {
+            return call_user_func_array( array( $this, $name ), $arguments );
+        }
+        return false;
     }