WordPress.org
Get WordPress

Make WordPress Core


Ignore:
Timestamp:
12/24/2003 08:43:04 PM (23 years ago)
Author:
saxmatt
Message:

Add kses HTML cleaning to comment functions.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/wp-includes/kses.php

    r649 r650  
    1111# [kses strips evil scripts!]
    1212
     13$allowedtags = array('b' => array(),
     14                 'i' => array(),
     15                                 'strong' => array(),
     16                                 'code' => array(),
     17                                 'em' => array(),
     18                                 'strike' => array(),
     19                 'a' => array('href'  => array('minlen' => 3, 'maxlen' => 50),
     20                              'title' => array('valueless' => 'n'),
     21                                                          'rel' => array('minlen' => 3, 'maxlen' => 250)),
     22                                'blockquote' => array('cite' => array()),
     23                 'br' => array());
    1324
    1425function wp_kses($string, $allowed_html, $allowed_protocols =
    … …  
    2233###############################################################################
    2334{
    24   $string = kses_no_null($string);
    25   $string = kses_js_entities($string);
    26   $string = kses_normalize_entities($string);
    27   $string = kses_hook($string);
    28   $allowed_html_fixed = kses_array_lc($allowed_html);
    29   return kses_split($string, $allowed_html_fixed, $allowed_protocols);
     35  $string = wp_kses_no_null($string);
     36  $string = wp_kses_js_entities($string);
     37  $string = wp_kses_normalize_entities($string);
     38  $string = wp_kses_hook($string);
     39  $allowed_html_fixed = wp_kses_array_lc($allowed_html);
     40  return wp_kses_split($string, $allowed_html_fixed, $allowed_protocols);
    3041} # function wp_kses
    3142
    … …  
    5970                      '(>|$)'. # > or end of string
    6071                      '|>)%e', # OR: just a >
    61                       "kses_split2('\\1', \$allowed_html, ".
     72                      "wp_kses_split2('\\1', \$allowed_html, ".
    6273                      '$allowed_protocols)',
    6374                      $string);
    … …  
    7384###############################################################################
    7485{
    75   $string = kses_stripslashes($string);
     86  $string = wp_kses_stripslashes($string);
    7687
    7788  if (substr($string, 0, 1) != '<')
    … …  
    91102    # They are using a not allowed HTML element
    92103
    93   return kses_attr("$slash$elem", $attrlist, $allowed_html,
     104  return wp_kses_attr("$slash$elem", $attrlist, $allowed_html,
    94105                   $allowed_protocols);
    95106} # function wp_kses_split2
    … …  
    99110###############################################################################
    100111# This function removes all attributes, if none are allowed for this element.
    101 # If some are allowed it calls kses_hair() to split them further, and then it
     112# If some are allowed it calls wp_kses_hair() to split them further, and then it
    102113# builds up new HTML code from the data that kses_hair() returns. It also
    103114# removes "<" and ">" characters, if there are any left. One more thing it
    … …  
    119130# Split it
    120131
    121   $attrarr = kses_hair($attr, $allowed_protocols);
     132  $attrarr = wp_kses_hair($attr, $allowed_protocols);
    122133
    123134# Go through $attrarr, and save the allowed attributes for this element
    … …  
    142153      $ok = true;
    143154      foreach ($current as $currkey => $currval)
    144         if (!kses_check_attr_val($arreach['value'], $arreach['vless'],
     155        if (!wp_kses_check_attr_val($arreach['value'], $arreach['vless'],
    145156                                 $currkey, $currval))
    146157        { $ok = false; break; }
    … …  
    219230         # "value"
    220231        {
    221           $thisval = kses_bad_protocol($match[1], $allowed_protocols);
     232          $thisval = wp_kses_bad_protocol($match[1], $allowed_protocols);
    222233
    223234          $attrarr[] = array
    … …  
    234245         # 'value'
    235246        {
    236           $thisval = kses_bad_protocol($match[1], $allowed_protocols);
     247          $thisval = wp_kses_bad_protocol($match[1], $allowed_protocols);
    237248
    238249          $attrarr[] = array
    … …  
    249260         # value
    250261        {
    251           $thisval = kses_bad_protocol($match[1], $allowed_protocols);
     262          $thisval = wp_kses_bad_protocol($match[1], $allowed_protocols);
    252263
    253264          $attrarr[] = array
    … …  
    266277    if ($working == 0) # not well formed, remove and try again
    267278    {
    268       $attr = kses_html_error($attr);
     279      $attr = wp_kses_html_error($attr);
    269280      $mode = 0;
    270281    }
    … …  
    358369###############################################################################
    359370{
    360   $string = kses_no_null($string);
     371  $string = wp_kses_no_null($string);
    361372  $string2 = $string.'a';
    362373
    … …  
    364375  {
    365376    $string2 = $string;
    366     $string = kses_bad_protocol_once($string, $allowed_protocols);
     377    $string = wp_kses_bad_protocol_once($string, $allowed_protocols);
    367378  } # while
    368379
    … …  
    431442function wp_kses_html_error($string)
    432443###############################################################################
    433 # This function deals with parsing errors in kses_hair(). The general plan is
     444# This function deals with parsing errors in wp_kses_hair(). The general plan is
    434445# to remove everything to and including some whitespace, but it deals with
    435446# quotes and apostrophes as well.
    … …  
    448459  return preg_replace('/^((&[^;]*;|[\sA-Za-z0-9])*)'.
    449460                      '(:|&#58;|&#[Xx]3[Aa];)\s*/e',
    450                       'kses_bad_protocol_once2("\\1", $allowed_protocols)',
     461                      'wp_kses_bad_protocol_once2("\\1", $allowed_protocols)',
    451462                      $string);
    452463} # function wp_kses_bad_protocol_once
    … …  
    459470###############################################################################
    460471{
    461   $string2 = kses_decode_entities($string);
     472  $string2 = wp_kses_decode_entities($string);
    462473  $string2 = preg_replace('/\s/', '', $string2);
    463   $string2 = kses_no_null($string2);
     474  $string2 = wp_kses_no_null($string2);
    464475  $string2 = strtolower($string2);
    465476
    … …  
    494505                         '&\\1;', $string);
    495506  $string = preg_replace('/&amp;#0*([0-9]{1,5});/e',
    496                          'kses_normalize_entities2("\\1")', $string);
     507                         'wp_kses_normalize_entities2("\\1")', $string);
    497508  $string = preg_replace('/&amp;#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/',
    498509                         '&#\\1\\2;', $string);
    … …  
    504515function wp_kses_normalize_entities2($i)
    505516###############################################################################
    506 # This function helps kses_normalize_entities() to only accept 16 bit values
     517# This function helps wp_kses_normalize_entities() to only accept 16 bit values
    507518# and nothing more for &#number; entities.
    508519###############################################################################
    … …  
    526537} # function wp_kses_decode_entities
    527538
     539function wp_filter_kses($data) {
     540        global $allowedtags;
     541        return wp_kses($data, $allowedtags);
     542}
     543
     544// Filter untrusted content
     545add_filter('comment_author', 'wp_filter_kses');
     546add_filter('comment_text', 'wp_filter_kses');
     547
    528548?>
Note: See TracChangeset for help on using the changeset viewer.