Changeset 5447

Timestamp:

05/11/2007 03:44:03 AM (17 years ago)

Author:

rob1n

Message:

Filter get_theme_data() data through KSES to get rid of evil XSS things. fixes #4236

File:

• trunk/wp-includes/theme.php (modified) (2 diffs)

trunk/wp-includes/theme.php

@@ -57 +57 @@
 
 function get_theme_data( $theme_file ) {
+    $themes_allowed_tags = array(
+        'a' => array(
+            'href' => array(),'title' => array()
+            ),
+        'abbr' => array(
+            'title' => array()
+            ),
+        'acronym' => array(
+            'title' => array()
+            ),
+        'code' => array(),
+        'em' => array(),
+        'strong' => array()
+    );
+    
     $theme_data = implode( '', file( $theme_file ) );
     $theme_data = str_replace ( '\r', '\n', $theme_data ); 
@@ -65 +80 @@
     preg_match( '|Author URI:(.*)|i', $theme_data, $author_uri );
     preg_match( '|Template:(.*)|i', $theme_data, $template );
+    
     if ( preg_match( '|Version:(.*)|i', $theme_data, $version ) )
-        $version = trim( $version[1] );
+        $version = wp_kses( trim( $version[1] ), $themes_allowed_tags );
     else
-        $version ='';
+        $version = '';
+    
     if ( preg_match('|Status:(.*)|i', $theme_data, $status) )
-        $status = trim($status[1]);
+        $status = wp_kses( trim( $status[1] ), $themes_allowed_tags );
     else
         $status = 'publish';
-
-    $description = wptexturize( trim( $description[1] ) );
-
-    $name = $theme_name[1];
-    $name = trim( $name );
-    $theme = $name;
-    $theme_uri = trim( $theme_uri[1] );
-
-    if ( '' == $author_uri[1] ) {
-        $author = trim( $author_name[1] );
+    
+    $name = $theme = wp_kses( trim( $theme_name[1] ), $themes_allowed_tags );
+    $theme_uri = clean_url( trim( $theme_uri[1] ) );
+    $description = wptexturize( wp_kses( trim( $description[1] ), $themes_allowed_tags ) );
+    $template = wp_kses( trim( $template[1] ), $themes_allowed_tags );
+    
+    $author_uri = clean_url( trim( $author_uri[1] ) );
+    
+    if ( empty( $author_uri[1] ) ) {
+        $author = wp_kses( trim( $author_name[1] ), $themes_allowed_tags );
     } else {
-        $author = '<a href="' . trim( $author_uri[1] ) . '" title="' . __('Visit author homepage') . '">' . trim( $author_name[1] ) . '</a>';
+        $author = sprintf( '<a href="%1$s" title="%2$s">%3$s</a>', $author_uri, __( 'Visit author homepage' ), wp_kses( trim( $author_name[1] ), $themes_allowed_tags ) );
     }