![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Changeset 47122 for trunk/src/wp-includes/shortcodes.php
- Timestamp:
- 01/29/2020 12:43:23 AM (7 years ago)
- File:
-
- 1 edited
-
trunk/src/wp-includes/shortcodes.php (modified) (10 diffs)
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/wp-includes/shortcodes.php
r47087 r47122 218 218 $content = preg_replace_callback( "/$pattern/", 'do_shortcode_tag', $content ); 219 219 220 // Always restore square braces so we don't break things like <!--[if IE ]> 220 // Always restore square braces so we don't break things like <!--[if IE ]>. 221 221 $content = unescape_invalid_shortcodes( $content ); 222 222 … … 255 255 $tagregexp = join( '|', array_map( 'preg_quote', $tagnames ) ); 256 256 257 // WARNING! Do not change this regex without changing do_shortcode_tag() and strip_shortcode_tag() 257 // WARNING! Do not change this regex without changing do_shortcode_tag() and strip_shortcode_tag(). 258 258 // Also, see shortcode_unautop() and shortcode.js. 259 259 260 260 // phpcs:disable Squiz.Strings.ConcatenationSpacing.PaddingFound -- don't remove regex indentation 261 261 return 262 '\\[' // Opening bracket 263 . '(\\[?)' // 1: Optional second opening bracket for escaping shortcodes: [[tag]] 264 . "($tagregexp)" // 2: Shortcode name 265 . '(?![\\w-])' // Not followed by word character or hyphen 266 . '(' // 3: Unroll the loop: Inside the opening shortcode tag 267 . '[^\\]\\/]*' // Not a closing bracket or forward slash 262 '\\[' // Opening bracket. 263 . '(\\[?)' // 1: Optional second opening bracket for escaping shortcodes: [[tag]]. 264 . "($tagregexp)" // 2: Shortcode name. 265 . '(?![\\w-])' // Not followed by word character or hyphen. 266 . '(' // 3: Unroll the loop: Inside the opening shortcode tag. 267 . '[^\\]\\/]*' // Not a closing bracket or forward slash. 268 268 . '(?:' 269 . '\\/(?!\\])' // A forward slash not followed by a closing bracket 270 . '[^\\]\\/]*' // Not a closing bracket or forward slash 269 . '\\/(?!\\])' // A forward slash not followed by a closing bracket. 270 . '[^\\]\\/]*' // Not a closing bracket or forward slash. 271 271 . ')*?' 272 272 . ')' 273 273 . '(?:' 274 . '(\\/)' // 4: Self closing tag 275 . '\\]' // ... and closing bracket274 . '(\\/)' // 4: Self closing tag... 275 . '\\]' // ...and closing bracket. 276 276 . '|' 277 . '\\]' // Closing bracket 277 . '\\]' // Closing bracket. 278 278 . '(?:' 279 . '(' // 5: Unroll the loop: Optionally, anything between the opening and closing shortcode tags 280 . '[^\\[]*+' // Not an opening bracket 279 . '(' // 5: Unroll the loop: Optionally, anything between the opening and closing shortcode tags. 280 . '[^\\[]*+' // Not an opening bracket. 281 281 . '(?:' 282 . '\\[(?!\\/\\2\\])' // An opening bracket not followed by the closing shortcode tag 283 . '[^\\[]*+' // Not an opening bracket 282 . '\\[(?!\\/\\2\\])' // An opening bracket not followed by the closing shortcode tag. 283 . '[^\\[]*+' // Not an opening bracket. 284 284 . ')*+' 285 285 . ')' 286 . '\\[\\/\\2\\]' // Closing shortcode tag 286 . '\\[\\/\\2\\]' // Closing shortcode tag. 287 287 . ')?' 288 288 . ')' 289 . '(\\]?)'; // 6: Optional second closing brocket for escaping shortcodes: [[tag]] 289 . '(\\]?)'; // 6: Optional second closing brocket for escaping shortcodes: [[tag]]. 290 290 // phpcs:enable 291 291 } … … 307 307 global $shortcode_tags; 308 308 309 // allow [[foo]] syntax for escaping a tag309 // Allow [[foo]] syntax for escaping a tag. 310 310 if ( $m[1] == '[' && $m[6] == ']' ) { 311 311 return substr( $m[0], 1, -1 ); … … 397 397 // This element does not contain shortcodes. 398 398 if ( $noopen xor $noclose ) { 399 // Need to encode stray [ or ]chars.399 // Need to encode stray '[' or ']' chars. 400 400 $element = strtr( $element, $trans ); 401 401 } … … 404 404 405 405 if ( $ignore_html || '<!--' === substr( $element, 0, 4 ) || '<![CDATA[' === substr( $element, 0, 9 ) ) { 406 // Encode all [ and ]chars.406 // Encode all '[' and ']' chars. 407 407 $element = strtr( $element, $trans ); 408 408 continue; … … 416 416 } 417 417 418 // Looks like we found some crazy unfiltered HTML. 418 // Looks like we found some crazy unfiltered HTML. Skipping it for sanity. 419 419 $element = strtr( $element, $trans ); 420 420 continue; 421 421 } 422 422 423 // Get element name 423 // Get element name. 424 424 $front = array_shift( $attributes ); 425 425 $back = array_pop( $attributes ); … … 433 433 $close = strpos( $attr, ']' ); 434 434 if ( false === $open || false === $close ) { 435 continue; // Go to next attribute. 435 continue; // Go to next attribute. Square braces will be escaped at end of loop. 436 436 } 437 437 $double = strpos( $attr, '"' ); 438 438 $single = strpos( $attr, "'" ); 439 439 if ( ( false === $single || $open < $single ) && ( false === $double || $open < $double ) ) { 440 // $attr like '[shortcode]' or 'name = [shortcode]' implies unfiltered_html. 441 // In this specific situation we assume KSES did not run because the input 442 // was written by an administrator, so we should avoid changing the output 443 // and we do not need to run KSES here. 440 /* 441 * $attr like '[shortcode]' or 'name = [shortcode]' implies unfiltered_html. 442 * In this specific situation we assume KSES did not run because the input 443 * was written by an administrator, so we should avoid changing the output 444 * and we do not need to run KSES here. 445 */ 444 446 $attr = preg_replace_callback( "/$pattern/", 'do_shortcode_tag', $attr ); 445 447 } else { 446 // $attr like 'name = "[shortcode]"' or "name = '[shortcode]'" 448 // $attr like 'name = "[shortcode]"' or "name = '[shortcode]'". 447 449 // We do not know if $content was unfiltered. Assume KSES ran before shortcodes. 448 450 $count = 0; … … 460 462 $element = $front . implode( '', $attributes ) . $back; 461 463 462 // Now encode any remaining [ or ]chars.464 // Now encode any remaining '[' or ']' chars. 463 465 $element = strtr( $element, $trans ); 464 466 } … … 647 649 $content = preg_replace_callback( "/$pattern/", 'strip_shortcode_tag', $content ); 648 650 649 // Always restore square braces so we don't break things like <!--[if IE ]> 651 // Always restore square braces so we don't break things like <!--[if IE ]>. 650 652 $content = unescape_invalid_shortcodes( $content ); 651 653 … … 662 664 */ 663 665 function strip_shortcode_tag( $m ) { 664 // allow [[foo]] syntax for escaping a tag666 // Allow [[foo]] syntax for escaping a tag. 665 667 if ( $m[1] == '[' && $m[6] == ']' ) { 666 668 return substr( $m[0], 1, -1 );
Note:
See TracChangeset
for help on using the changeset viewer.
