Changeset 4672

Timestamp:

01/02/2007 09:22:41 PM (18 years ago)

Author:

ryan

Message:

Add kses protocol checking to clean_url. Props Andy. fixes #3515

Files:

• branches/2.0/wp-includes/comment-functions.php (modified) (1 diff)
• branches/2.0/wp-includes/functions-formatting.php (modified) (1 diff)
• trunk/wp-includes/formatting.php (modified) (2 diffs)

branches/2.0/wp-includes/comment-functions.php

@@ -212 +212 @@
     do_action('wp_set_comment_status', $comment_id, 'delete');
     return true;
-}
-
-function clean_url( $url ) {
-    if ('' == $url) return $url;
-    $url = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%]|i', '', $url);
-    $strip = array('%0d', '%0a');
-    $url = str_replace($strip, '', $url);
-    $url = str_replace(';//', '://', $url);
-    $url = (!strstr($url, '://')) ? 'http://'.$url : $url;
-    $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
-    return $url;
 }
 

branches/2.0/wp-includes/functions-formatting.php

@@ -1046 +1046 @@
 }
 
+function clean_url( $url, $protocols = null ) {
+    if ('' == $url) return $url;
+    $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%]|i', '', $url);
+    $strip = array('%0d', '%0a');
+    $url = str_replace($strip, '', $url);
+    $url = str_replace(';//', '://', $url);
+    $url = (!strstr($url, '://')) ? 'http://'.$url : $url;
+    $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
+    if ( !is_array($protocols) )
+        $protocols = array('http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet'); 
+    if ( wp_kses_bad_protocol( $url, $protocols ) != $url )
+        return '';
+    return $url;
+}
+
 // Escape single quotes, specialchar double quotes, and fix line endings.
 function js_escape($text) {

trunk/wp-includes/formatting.php

@@ -1057 +1057 @@
 }
 
-function clean_url( $url ) {
+function clean_url( $url, $protocols = null ) {
     if ('' == $url) return $url;
     $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%]|i', '', $url);
@@ -1065 +1065 @@
     $url = (!strstr($url, '://')) ? 'http://'.$url : $url;
     $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
+    if ( !is_array($protocols) )
+        $protocols = array('http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet'); 
+    if ( wp_kses_bad_protocol( $url, $protocols ) != $url )
+        return '';
     return $url;
 }