WordPress.org

Make WordPress Core

Changeset 39560


Ignore:
Timestamp:
12/10/16 06:59:24 (7 months ago)
Author:
westonruter
Message:

Customize: Trim whitespace for URLs supplied for external_header_video to prevent esc_url_raw() from making them invalid.

Props tyxla.
See #38172.
Fixes #39125.

Location:
trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/class-wp-customize-manager.php

    r39545 r39560  
    38973897            'theme_supports'    => array( 'custom-header', 'video' ), 
    38983898            'transport'         => 'postMessage', 
    3899             'sanitize_callback' => 'esc_url_raw', 
     3899            'sanitize_callback' => array( $this, '_sanitize_external_header_video' ), 
    39003900            'validate_callback' => array( $this, '_validate_external_header_video' ), 
    39013901        ) ); 
     
    43204320 
    43214321    /** 
     4322     * Callback for sanitizing the external_header_video value. 
     4323     * 
     4324     * @since 4.7.1 
     4325     * 
     4326     * @param string $value URL. 
     4327     * @return string Sanitized URL. 
     4328     */ 
     4329    public function _sanitize_external_header_video( $value ) { 
     4330        return esc_url_raw( trim( $value ) ); 
     4331    } 
     4332 
     4333    /** 
    43224334     * Callback for rendering the custom logo, used in the custom_logo partial. 
    43234335     * 
  • trunk/tests/phpunit/tests/customize/manager.php

    r39506 r39560  
    25812581        $this->assertEquals( $panels_sorted, array_keys( $result ) ); 
    25822582    } 
     2583 
     2584    /** 
     2585     * Verify sanitization of external header video URL will trim the whitespaces in the beginning and end of the URL. 
     2586     * 
     2587     * @ticket 39125 
     2588     */ 
     2589    function test_sanitize_external_header_video_trim() { 
     2590        $this->manager->register_controls(); 
     2591        $setting = $this->manager->get_setting( 'external_header_video' ); 
     2592        $video_url = 'https://www.youtube.com/watch?v=KiS8rZBeIO0'; 
     2593 
     2594        $whitespaces = array( 
     2595            ' ',  // space 
     2596            "\t", // horizontal tab 
     2597            "\n", // line feed 
     2598            "\r", // carriage return, 
     2599            "\f", // form feed, 
     2600            "\v", // vertical tab 
     2601        ); 
     2602 
     2603        foreach ( $whitespaces as $whitespace  ) { 
     2604            $sanitized = $setting->sanitize( $whitespace . $video_url . $whitespace ); 
     2605            $this->assertEquals( $video_url, $sanitized ); 
     2606        } 
     2607    } 
    25832608} 
    25842609 
Note: See TracChangeset for help on using the changeset viewer.