WordPress.org
Get WordPress

Make WordPress Core

Changeset 5056


Ignore:
Timestamp:
03/17/2007 08:46:59 AM (18 years ago)
Author:
markjaquith
Message:

use clean_url() instead of attribute_escape() when dealing with src/href to protect against XSS. props xknown. fixes #3986 for trunk.

Location:
trunk
Files:
18 edited

Legend:

Unmodified
Added
Removed

  • trunk/wp-admin/admin-functions.php

    r5033 r5056  
    371371        $text       = wp_specialchars( stripslashes( urldecode( $_REQUEST['text'] ) ) );
    372372        $text       = funky_javascript_fix( $text);
    373         $popupurl   = attribute_escape($_REQUEST['popupurl']);
     373        $popupurl   = clean_url($_REQUEST['popupurl']);
    374374        $post_content = '<a href="'.$popupurl.'">'.$post_title.'</a>'."\n$text";
    375375    }
    … …  
    430430    $user->user_login   = attribute_escape($user->user_login);
    431431    $user->user_email   = attribute_escape($user->user_email);
    432     $user->user_url     = attribute_escape($user->user_url);
     432    $user->user_url     = clean_url($user->user_url);
    433433    $user->first_name   = attribute_escape($user->first_name);
    434434    $user->last_name    = attribute_escape($user->last_name);
    … …  
    575575    $link = get_link( $link_id );
    576576
    577     $link->link_url         = attribute_escape($link->link_url);
     577    $link->link_url         = clean_url($link->link_url);
    578578    $link->link_name        = attribute_escape($link->link_name);
    579579    $link->link_image       = attribute_escape($link->link_image);
    580580    $link->link_description = attribute_escape($link->link_description);
    581     $link->link_rss         = attribute_escape($link->link_rss);
     581    $link->link_rss         = clean_url($link->link_rss);
    582582    $link->link_rel         = attribute_escape($link->link_rel);
    583583    $link->link_notes       =  wp_specialchars($link->link_notes);
    … …  
    589589function get_default_link_to_edit() {
    590590    if ( isset( $_GET['linkurl'] ) )
    591         $link->link_url = attribute_escape( $_GET['linkurl']);
     591        $link->link_url = clean_url( $_GET['linkurl']);
    592592    else
    593593        $link->link_url = '';
    … …  
    880880    $r .= "</td>\n\t\t<td>";
    881881    if ( current_user_can( 'edit_user', $user_object->ID ) ) {
    882         $edit_link = attribute_escape( add_query_arg( 'wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), "user-edit.php?user_id=$user_object->ID" ));
     882        $edit_link = clean_url( add_query_arg( 'wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), "user-edit.php?user_id=$user_object->ID" ));
    883883        $r .= "<a href='$edit_link' class='edit'>".__( 'Edit' )."</a>";
    884884    }

  • trunk/wp-admin/bookmarklet.php

    r4656 r5056  
    3838
    3939$content  = wp_specialchars($_REQUEST['content']);
    40 $popupurl = attribute_escape($_REQUEST['popupurl']);
     40$popupurl = clean_url($_REQUEST['popupurl']);
    4141if ( !empty($content) ) {
    4242    $post->post_content = wp_specialchars( stripslashes($_REQUEST['content']) );

  • trunk/wp-admin/edit-comments.php

    r5025 r5056  
    102102if ( 1 < $page ) {
    103103    $args['apage'] = ( 1 == $page - 1 ) ? FALSE : $page - 1;
    104     $r .=  '<a class="prev" href="' . attribute_escape(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
     104    $r .=  '<a class="prev" href="' . clean_url(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
    105105}
    106106if ( ( $total_pages = ceil( $total / 20 ) ) > 1 ) {
    … …  
    112112            if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
    113113                $args['apage'] = ( 1 == $page_num ) ? FALSE : $page_num;
    114                 $r .= '<a class="page-numbers" href="' . attribute_escape(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
     114                $r .= '<a class="page-numbers" href="' . clean_url(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
    115115                $in = true;
    116116            elseif ( $in == true ) :
    … …  
    123123if ( ( $page ) * 20 < $total || -1 == $total ) {
    124124    $args['apage'] = $page + 1;
    125     $r .=  '<a class="next" href="' . attribute_escape(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
     125    $r .=  '<a class="next" href="' . clean_url(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
    126126}
    127127echo "<p class='pagenav'>$r</p>";
    … …  
    249249if ( 1 < $page ) {
    250250    $args['apage'] = ( 1 == $page - 1 ) ? FALSE : $page - 1;
    251     $r .=  '<a class="prev" href="' . attribute_escape(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
     251    $r .=  '<a class="prev" href="' . clean_url(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
    252252}
    253253if ( ( $total_pages = ceil( $total / 20 ) ) > 1 ) {
    … …  
    259259            if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
    260260                $args['apage'] = ( 1 == $page_num ) ? FALSE : $page_num;
    261                 $r .= '<a class="page-numbers" href="' . attribute_escape(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
     261                $r .= '<a class="page-numbers" href="' . clean_url(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
    262262                $in = true;
    263263            elseif ( $in == true ) :
    … …  
    270270if ( ( $page ) * 20 < $total || -1 == $total ) {
    271271    $args['apage'] = $page + 1;
    272     $r .=  '<a class="next" href="' . attribute_escape(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
     272    $r .=  '<a class="next" href="' . clean_url(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
    273273}
    274274echo "<p class='pagenav'>$r</p>";

  • trunk/wp-admin/edit-form-advanced.php

    r4994 r5056  
    169169<input name="referredby" type="hidden" id="referredby" value="<?php
    170170if ( !empty($_REQUEST['popupurl']) )
    171     echo attribute_escape(stripslashes($_REQUEST['popupurl']));
     171    echo clean_url(stripslashes($_REQUEST['popupurl']));
    172172else if ( url_to_postid(wp_get_referer()) == $post_ID )
    173173    echo 'redo';
    174174else
    175     echo attribute_escape(stripslashes(wp_get_referer()));
     175    echo clean_url(stripslashes(wp_get_referer()));
    176176?>" /></p>
    177177

  • trunk/wp-admin/edit-page-form.php

    r4787 r5056  
    1414}
    1515
    16 $sendto = attribute_escape(stripslashes(wp_get_referer()));
     16$sendto = clean_url(stripslashes(wp_get_referer()));
    1717
    1818if ( 0 != $post_ID && $sendto == get_permalink($post_ID) )

  • trunk/wp-admin/link-manager.php

    r5011 r5056  
    134134        $link->link_name = attribute_escape(apply_filters('link_title', $link->link_name));
    135135        $link->link_description = wp_specialchars(apply_filters('link_description', $link->link_description));
    136         $link->link_url = attribute_escape($link->link_url);
     136        $link->link_url = clean_url($link->link_url);
    137137        $link->link_category = wp_get_link_cats($link->link_id);
    138138        $short_url = str_replace('http://', '', $link->link_url);

  • trunk/wp-admin/page.php

    r4990 r5056  
    6565    <div id='preview' class='wrap'>
    6666    <h2 id="preview-post"><?php _e('Page Preview (updated when page is saved)'); ?></h2>
    67         <iframe src="<?php echo attribute_escape(apply_filters('preview_page_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
     67        <iframe src="<?php echo clean_url(apply_filters('preview_page_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
    6868    </div>
    6969    <?php

  • trunk/wp-admin/post.php

    r4990 r5056  
    7070    <div id='preview' class='wrap'>
    7171    <h2 id="preview-post"><?php _e('Post Preview (updated when post is saved)'); ?></h2>
    72         <iframe src="<?php echo attribute_escape(apply_filters('preview_post_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
     72        <iframe src="<?php echo clean_url(apply_filters('preview_post_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
    7373    </div>
    7474    <?php

  • trunk/wp-admin/upgrade.php

    r4887 r5056  
    3636switch($step) :
    3737    case 0:
    38         $goback = attribute_escape(stripslashes(wp_get_referer()));
     38        $goback = clean_url(stripslashes(wp_get_referer()));
    3939?>
    4040<h2><?php _e('Database Upgrade Required'); ?></h2>
    … …  
    5050            $backto = __get_option('home') . '/';
    5151        else
    52             $backto = attribute_escape(stripslashes($_GET['backto']));
     52            $backto = clean_url(stripslashes($_GET['backto']));
    5353?>
    5454<h2><?php _e('Upgrade Complete'); ?></h2>

  • trunk/wp-admin/upload-functions.php

    r4986 r5056  
    8484                echo '<a href="' . get_permalink() . '">' . __('view') . '</a>';
    8585                echo '&nbsp;|&nbsp;';
    86                     echo '<a href="' . attribute_escape(add_query_arg('action', 'edit')) . '" title="' . __('Edit this file') . '">' . __('edit') . '</a>';
     86                    echo '<a href="' . clean_url(add_query_arg('action', 'edit')) . '" title="' . __('Edit this file') . '">' . __('edit') . '</a>';
    8787                echo '&nbsp;|&nbsp;';
    88                 echo '<a href="' . attribute_escape(remove_query_arg(array('action', 'ID'))) . '" title="' . __('Browse your files') . '">' . __('cancel') . '</a>';
     88                echo '<a href="' . clean_url(remove_query_arg(array('action', 'ID'))) . '" title="' . __('Browse your files') . '">' . __('cancel') . '</a>';
    8989                echo '&nbsp;]'; ?></span>
    9090        </div>
    … …  
    124124                echo '<a href="' . get_permalink() . '">' . __('view') . '</a>';
    125125                echo '&nbsp;|&nbsp;';
    126                     echo '<a href="' . attribute_escape(add_query_arg('action', 'view')) . '">' . __('links') . '</a>';
     126                    echo '<a href="' . clean_url(add_query_arg('action', 'view')) . '">' . __('links') . '</a>';
    127127                echo '&nbsp;|&nbsp;';
    128                 echo '<a href="' . attribute_escape(remove_query_arg(array('action','ID'))) . '" title="' . __('Browse your files') . '">' . __('cancel') . '</a>';
     128                echo '<a href="' . clean_url(remove_query_arg(array('action','ID'))) . '" title="' . __('Browse your files') . '">' . __('cancel') . '</a>';
    129129                echo '&nbsp;]'; ?></span>
    130130        </div>

  • trunk/wp-admin/upload.php

    r4708 r5056  
    9191    if ( isset($tab_array[4]) && is_array($tab_array[4]) )
    9292        add_query_arg( $tab_array[4], $href );
    93     $_href = attribute_escape( $href);
     93    $_href = clean_url( $href);
    9494    $page_links = '';
    9595    $class = 'upload-tab alignleft';

  • trunk/wp-admin/user-edit.php

    r4758 r5056  
    5656    <p><strong><?php _e('User updated.') ?></strong></p>
    5757    <?php if ( $wp_http_referer ) : ?>
    58     <p><a href="<?php echo attribute_escape($wp_http_referer); ?>"><?php _e('&laquo; Back to Authors and Users'); ?></a></p>
     58    <p><a href="<?php echo clean_url($wp_http_referer); ?>"><?php _e('&laquo; Back to Authors and Users'); ?></a></p>
    5959    <?php endif; ?>
    6060</div>

  • trunk/wp-includes/bookmark-template.php

    r5011 r5056  
    9797        $the_link = '#';
    9898        if ( !empty($row->link_url) )
    99             $the_link = wp_specialchars($row->link_url);
     99            $the_link = clean_url($row->link_url);
    100100        $rel = $row->link_rel;
    101101        if ( '' != $rel )
    … …  
    261261        $the_link = '#';
    262262        if ( !empty($bookmark->link_url) )
    263             $the_link = wp_specialchars($bookmark->link_url);
     263            $the_link = clean_url($bookmark->link_url);
    264264
    265265        $rel = $bookmark->link_rel;

  • trunk/wp-includes/comment.php

    r4705 r5056  
    170170        $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]);
    171171        $comment_author_url = stripslashes($comment_author_url);
    172         $comment_author_url = attribute_escape($comment_author_url);
     172        $comment_author_url = clean_url($comment_author_url);
    173173        $_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url;
    174174    }

  • trunk/wp-includes/functions.php

    r5044 r5056  
    12731273    $adminurl = get_option('siteurl') . '/wp-admin';
    12741274    if ( wp_get_referer() )
    1275         $adminurl = attribute_escape(wp_get_referer());
     1275        $adminurl = clean_url(wp_get_referer());
    12761276
    12771277    $title = __('WordPress Confirmation');
    … …  
    12901290        $html .= "\t\t<div id='message' class='confirm fade'>\n\t\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t\t<p><a href='$adminurl'>" . __('No') . "</a> <input type='submit' value='" . __('Yes') . "' /></p>\n\t\t</div>\n\t</form>\n";
    12911291    } else {
    1292         $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . attribute_escape(add_query_arg( '_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'] )) . "'>" . __('Yes') . "</a></p>\n\t</div>\n";
     1292        $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . clean_url(add_query_arg( '_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'] )) . "'>" . __('Yes') . "</a></p>\n\t</div>\n";
    12931293    }
    12941294    $html .= "</body>\n</html>";

  • trunk/wp-includes/general-template.php

    r5036 r5056  
    298298    $text = wptexturize($text);
    299299    $title_text = attribute_escape($text);
     300    $url = clean_url($url);
    300301
    301302    if ('link' == $format)
    … …  
    986987        if ( $add_args )
    987988            $link = add_query_arg( $add_args, $link );
    988         $page_links[] = "<a class='prev page-numbers' href='" . attribute_escape($link) . "'>$prev_text</a>";
     989        $page_links[] = "<a class='prev page-numbers' href='" . clean_url($link) . "'>$prev_text</a>";
    989990    endif;
    990991    for ( $n = 1; $n <= $total; $n++ ) :
    … …  
    998999                if ( $add_args )
    9991000                    $link = add_query_arg( $add_args, $link );
    1000                 $page_links[] = "<a class='page-numbers' href='" . attribute_escape($link) . "'>$n</a>";
     1001                $page_links[] = "<a class='page-numbers' href='" . clean_url($link) . "'>$n</a>";
    10011002                $dots = true;
    10021003            elseif ( $dots && !$show_all ) :
    … …  
    10111012        if ( $add_args )
    10121013            $link = add_query_arg( $add_args, $link );
    1013         $page_links[] = "<a class='next page-numbers' href='" . attribute_escape($link) . "'>$next_text</a>";
     1014        $page_links[] = "<a class='next page-numbers' href='" . clean_url($link) . "'>$next_text</a>";
    10141015    endif;
    10151016    switch ( $type ) :

  • trunk/wp-includes/link-template.php

    r5045 r5056  
    504504
    505505function next_posts($max_page = 0) {
    506     echo attribute_escape(get_next_posts_page_link($max_page));
     506    echo clean_url(get_next_posts_page_link($max_page));
    507507}
    508508
    … …  
    534534
    535535function previous_posts() {
    536     echo attribute_escape(get_previous_posts_page_link());
     536    echo clean_url(get_previous_posts_page_link());
    537537}
    538538

  • trunk/wp-includes/script-loader.php

    r5007 r5056  
    151151                    $src = 0 === strpos($this->scripts[$handle]->src, 'http://') ? $this->scripts[$handle]->src : get_option( 'siteurl' ) . $this->scripts[$handle]->src;
    152152                    $src = add_query_arg('ver', $ver, $src);
    153                     $src = attribute_escape(apply_filters( 'script_loader_src', $src ));
     153                    $src = clean_url(apply_filters( 'script_loader_src', $src ));
    154154                    echo "<script type='text/javascript' src='$src'></script>\n";
    155155                    $this->print_scripts_l10n( $handle );
Note: See TracChangeset for help on using the changeset viewer.