Changeset 47959 for branches/5.3/src/wp-includes/embed.php

Timestamp:

06/10/2020 05:58:07 PM (6 years ago)

Author:

desrosj

Message:

General: Backport several commits for release.

• Embeds: Ensure that the title attribute is set correctly on embeds.
• Editor: Prevent HTML decoding on by setting the proper editor context.
• Formatting: Ensure that wp_validate_redirect() sanitizes a wider variety of characters.
• Themes: Ensure a broken theme name is returned properly.
• Administration: Add a new filter to extend set-screen-option.

Merges [47948-47951] to the 5.3 branch.
Props xknown, sstoqnov, vortfu, SergeyBiryukov, whyisjake.

Location:

branches/5.3

Files:

• . (modified) (1 prop)
• src/wp-includes/embed.php (modified) (2 diffs)

branches/5.3/src/wp-includes/embed.php

@@ -798 +798 @@
         $title = ! empty( $data->title ) ? $data->title : '';
 
-        $pattern        = '`<iframe[^>]*?title=(\\\\\'|\\\\"|[\'"])([^>]*?)\1`i';
-        $has_title_attr = preg_match( $pattern, $result, $matches );
-
-        if ( $has_title_attr && ! empty( $matches[2] ) ) {
-                $title = $matches[2];
+        $pattern = '`<iframe([^>]*)>`i';
+        if ( preg_match( $pattern, $result, $matches ) ) {
+                $attrs = wp_kses_hair( $matches[1], wp_allowed_protocols() );
+
+                foreach ( $attrs as $attr => $item ) {
+                        $lower_attr = strtolower( $attr );
+                        if ( $lower_attr === $attr ) {
+                                continue;
+                        }
+                        if ( ! isset( $attrs[ $lower_attr ] ) ) {
+                                $attrs[ $lower_attr ] = $item;
+                                unset( $attrs[ $attr ] );
+                        }
+                }
+        }
+
+        if ( ! empty( $attrs['title']['value'] ) ) {
+                $title = $attrs['title']['value'];
         }
 
@@ -821 +834 @@
         }
 
-        if ( $has_title_attr ) {
-                // Remove the old title, $matches[1]: quote, $matches[2]: title attribute value.
-                $result = str_replace( ' title=' . $matches[1] . $matches[2] . $matches[1], '', $result );
-        }
-
+        if ( isset( $attrs['title'] ) ) {
+                unset( $attrs['title'] );
+                $attr_string = join( ' ', wp_list_pluck( $attrs, 'whole' ) );
+                $result      = str_replace( $matches[0], '<iframe ' . trim( $attr_string ) . '>', $result );
+        }
         return str_ireplace( '<iframe ', sprintf( '<iframe title="%s" ', esc_attr( $title ) ), $result );
 }