Changeset 8671

Timestamp:

08/19/2008 06:43:21 PM (16 years ago)

Author:

ryan

Message:

Apply kses bad-protocol checks only to URI typed attributes. Props takayukister. fixes #5917 #6888 #6910 #7512

File:

• trunk/wp-includes/kses.php (modified) (4 diffs)

trunk/wp-includes/kses.php

@@ -552 +552 @@
     $mode = 0;
     $attrname = '';
+    $uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
 
     # Loop through the whole attribute list
@@ -596 +597 @@
                     # "value"
                     {
-                    $thisval = wp_kses_bad_protocol($match[1], $allowed_protocols);
+                    $thisval = $match[1];
+                    if ( in_array($attrname, $uris) )       
+                        $thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
 
                     if(FALSE === array_key_exists($attrname, $attrarr)) {
@@ -610 +613 @@
                     # 'value'
                     {
-                    $thisval = wp_kses_bad_protocol($match[1], $allowed_protocols);
+                    $thisval = $match[1];
+                    if ( in_array($attrname, $uris) )       
+                        $thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
 
                     if(FALSE === array_key_exists($attrname, $attrarr)) {
@@ -624 +629 @@
                     # value
                     {
-                    $thisval = wp_kses_bad_protocol($match[1], $allowed_protocols);
+                    $thisval = $match[1];
+                    if ( in_array($attrname, $uris) )       
+                        $thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
 
                     if(FALSE === array_key_exists($attrname, $attrarr)) {