Make WordPress Core

Changeset 34144


Ignore:
Timestamp:
09/14/2015 10:46:42 PM (10 years ago)
Author:
nbachiyski
Message:

Shortcodes: don't allow unclosed HTML elements in attributes

Merges [34134] for 4.3 branch

Location:
branches/4.3/src/wp-includes
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.3/src/wp-includes/media.php

    r33489 r34144  
    864864            $attr['caption'] = trim( $matches[2] );
    865865        }
     866    } elseif ( strpos( $attr['caption'], '<' ) !== false ) {
     867        $attr['caption'] = wp_kses( $attr['caption'], 'post' );
    866868    }
    867869
  • branches/4.3/src/wp-includes/shortcodes.php

    r33627 r34144  
    463463                $atts[] = stripcslashes($m[8]);
    464464        }
     465
     466        // Reject any unclosed HTML elements
     467        foreach( $atts as &$value ) {
     468            if ( false !== strpos( $value, '<' ) ) {
     469                if ( 1 !== preg_match( '/^[^<]*+(?:<[^>]*+>[^<]*+)*+$/', $value ) ) {
     470                    $value = '';
     471                }
     472            }
     473        }
    465474    } else {
    466475        $atts = ltrim($text);
Note: See TracChangeset for help on using the changeset viewer.