WordPress.org

Make WordPress Core


Ignore:
Timestamp:
05/11/2007 03:44:03 AM (14 years ago)
Author:
rob1n
Message:

Filter get_theme_data() data through KSES to get rid of evil XSS things. fixes #4236

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-includes/theme.php

    r5149 r5447  
    5757
    5858function get_theme_data( $theme_file ) {
     59    $themes_allowed_tags = array(
     60        'a' => array(
     61            'href' => array(),'title' => array()
     62            ),
     63        'abbr' => array(
     64            'title' => array()
     65            ),
     66        'acronym' => array(
     67            'title' => array()
     68            ),
     69        'code' => array(),
     70        'em' => array(),
     71        'strong' => array()
     72    );
     73   
    5974    $theme_data = implode( '', file( $theme_file ) );
    6075    $theme_data = str_replace ( '\r', '\n', $theme_data );
     
    6580    preg_match( '|Author URI:(.*)|i', $theme_data, $author_uri );
    6681    preg_match( '|Template:(.*)|i', $theme_data, $template );
     82   
    6783    if ( preg_match( '|Version:(.*)|i', $theme_data, $version ) )
    68         $version = trim( $version[1] );
     84        $version = wp_kses( trim( $version[1] ), $themes_allowed_tags );
    6985    else
    70         $version ='';
     86        $version = '';
     87   
    7188    if ( preg_match('|Status:(.*)|i', $theme_data, $status) )
    72         $status = trim($status[1]);
     89        $status = wp_kses( trim( $status[1] ), $themes_allowed_tags );
    7390    else
    7491        $status = 'publish';
    75 
    76     $description = wptexturize( trim( $description[1] ) );
    77 
    78     $name = $theme_name[1];
    79     $name = trim( $name );
    80     $theme = $name;
    81     $theme_uri = trim( $theme_uri[1] );
    82 
    83     if ( '' == $author_uri[1] ) {
    84         $author = trim( $author_name[1] );
     92   
     93    $name = $theme = wp_kses( trim( $theme_name[1] ), $themes_allowed_tags );
     94    $theme_uri = clean_url( trim( $theme_uri[1] ) );
     95    $description = wptexturize( wp_kses( trim( $description[1] ), $themes_allowed_tags ) );
     96    $template = wp_kses( trim( $template[1] ), $themes_allowed_tags );
     97   
     98    $author_uri = clean_url( trim( $author_uri[1] ) );
     99   
     100    if ( empty( $author_uri[1] ) ) {
     101        $author = wp_kses( trim( $author_name[1] ), $themes_allowed_tags );
    85102    } else {
    86         $author = '<a href="' . trim( $author_uri[1] ) . '" title="' . __('Visit author homepage') . '">' . trim( $author_name[1] ) . '</a>';
     103        $author = sprintf( '<a href="%1$s" title="%2$s">%3$s</a>', $author_uri, __( 'Visit author homepage' ), wp_kses( trim( $author_name[1] ), $themes_allowed_tags ) );
    87104    }
    88105
Note: See TracChangeset for help on using the changeset viewer.