Changeset 8387

Timestamp:

07/21/2008 05:11:00 AM (16 years ago)

Author:

azaozz

Message:

kses - don't use create_function in preg_replace_callback. Fixes #7363.

File:

• trunk/wp-includes/kses.php (modified) (6 diffs)

trunk/wp-includes/kses.php

@@ -851 +851 @@
     $string2 = preg_split('/:|:|:/i', $string, 2);
     if ( isset($string2[1]) && !preg_match('%/\?%', $string2[0]) )
-        $string = wp_kses_bad_protocol_once2($string2[0], $allowed_protocols) . trim($string2[1]);
+        $string = wp_kses_bad_protocol_once2($string2[0]) . trim($string2[1]);
     else
-        $string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|:|&#[Xx]3[Aa];)\s*/', create_function('$matches', 'global $_kses_allowed_protocols; return wp_kses_bad_protocol_once2($matches[1], $_kses_allowed_protocols);'), $string);
+        $string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|:|&#[Xx]3[Aa];)\s*/', 'wp_kses_bad_protocol_once2', $string);
 
     return $string;
@@ -866 +866 @@
  * @since 1.0.0
  *
- * @param string $string Content to check for bad protocols
- * @param array $allowed_protocols Allowed protocols
+ * @param mixed $matches string or preg_replace_callback() matches array to check for bad protocols
  * @return string Sanitized content
  */
-function wp_kses_bad_protocol_once2($string, $allowed_protocols) {
+function wp_kses_bad_protocol_once2($matches) {
+    global $_kses_allowed_protocols;
+
+    if ( is_array($matches) ) {
+        if ( ! isset($matches[1]) || empty($matches[1]) )
+            return '';
+
+        $string = $matches[1];
+    } else {
+        $string = $matches;
+    }
+
     $string2 = wp_kses_decode_entities($string);
     $string2 = preg_replace('/\s/', '', $string2);
@@ -879 +889 @@
 
     $allowed = false;
-    foreach ($allowed_protocols as $one_protocol)
+    foreach ( (array) $_kses_allowed_protocols as $one_protocol)
         if (strtolower($one_protocol) == $string2) {
             $allowed = true;
@@ -911 +921 @@
 
     $string = preg_replace('/&([A-Za-z][A-Za-z0-9]{0,19});/', '&\\1;', $string);
-    $string = preg_replace_callback('/&#0*([0-9]{1,5});/', create_function('$matches', 'return wp_kses_normalize_entities2($matches[1]);'), $string);
-    $string = preg_replace_callback('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', create_function('$matches', 'return wp_kses_normalize_entities3($matches[2]);'), $string);
+    $string = preg_replace_callback('/&#0*([0-9]{1,5});/', 'wp_kses_normalize_entities2', $string);
+    $string = preg_replace_callback('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', 'wp_kses_normalize_entities3', $string);
 
     return $string;
@@ -925 +935 @@
  * @since 1.0.0
  *
- * @param int $i Number encoded entity
+ * @param array $matches preg_replace_callback() matches array
  * @return string Correctly encoded entity
  */
-function wp_kses_normalize_entities2($i) {
-    return ( (!valid_unicode($i)) || ($i > 65535) ? "&#$i;" : "&#$i;");
+function wp_kses_normalize_entities2($matches) {
+    if ( ! isset($matches[1]) || empty($matches[1]) )
+        return '';
+
+    $i = $matches[1];
+    return ( ( ! valid_unicode($i) ) || ($i > 65535) ? "&#$i;" : "&#$i;" );
 }
 
@@ -938 +952 @@
  * in hex form.
  *
- * @param string $h Hex string of encoded entity
+ * @param array $matches preg_replace_callback() matches array
  * @return string Correctly encoded entity
  */
-function wp_kses_normalize_entities3($hexchars) {
-    return ( (!valid_unicode(hexdec($hexchars))) ? "&#x$hexchars;" : "&#x$hexchars;");
+function wp_kses_normalize_entities3($matches) {
+    if ( ! isset($matches[2]) || empty($matches[2]) )
+        return '';
+
+    $hexchars = $matches[2];
+    return ( ( ! valid_unicode(hexdec($hexchars)) ) ? "&#x$hexchars;" : "&#x$hexchars;" );
 }