Changeset 45823 for trunk/src/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

08/17/2019 01:58:12 PM (5 years ago)

Author:

SergeyBiryukov

Message:

Pings/Trackbacks: In wp_xmlrpc_server::pingback_ping(), strip inline JS and CSS while trying to figure out the pingback context.

Props david.binda.
Fixes #47283.

File:

• trunk/src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -6881 +6881 @@
         }
 
-        $remote_source = strip_tags( $remote_source, '<a>' ); // just keep the tag we need
+        // Remove all script and style tags including their content.
+        $remote_source = preg_replace( '@<(script|style)[^>]*?>.*?</\\1>@si', '', $remote_source );
+        // Just keep the tag we need.
+        $remote_source = strip_tags( $remote_source, '<a>' );
 
         $p = explode( "\n\n", $remote_source );