Changeset 34150 for branches/3.7/src/wp-includes/shortcodes.php

Timestamp:

09/14/2015 10:49:09 PM (9 years ago)

Author:

nbachiyski

Message:

Shortcodes: don't allow unclosed HTML elements in attributes

Merges [34134] for 3.7 branch

File:

• branches/3.7/src/wp-includes/shortcodes.php (modified) (1 diff)

branches/3.7/src/wp-includes/shortcodes.php

@@ -449 +449 @@
                 $atts[] = stripcslashes($m[8]);
         }
+
+        // Reject any unclosed HTML elements
+        foreach( $atts as &$value ) {
+            if ( false !== strpos( $value, '<' ) ) {
+                if ( 1 !== preg_match( '/^[^<]*+(?:<[^>]*+>[^<]*+)*+$/', $value ) ) {
+                    $value = '';
+                }
+            }
+        }
     } else {
         $atts = ltrim($text);