Changeset 8671

Timestamp:

08/19/2008 06:43:21 PM (18 years ago)

Author:

ryan

Message:

Apply kses bad-protocol checks only to URI typed attributes. Props takayukister. fixes #5917 #6888 #6910 #7512

File:

• trunk/wp-includes/kses.php (modified) (4 diffs)

trunk/wp-includes/kses.php

@@ -552 +552 @@
         $mode = 0;
         $attrname = '';
+        $uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
 
         # Loop through the whole attribute list
@@ -596 +597 @@
                                         # "value"
                                         {
-                                        $thisval = wp_kses_bad_protocol($match[1], $allowed_protocols);
+                                        $thisval = $match[1];
+                                        if ( in_array($attrname, $uris) )               
+                                                $thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
 
                                         if(FALSE === array_key_exists($attrname, $attrarr)) {
@@ -610 +613 @@
                                         # 'value'
                                         {
-                                        $thisval = wp_kses_bad_protocol($match[1], $allowed_protocols);
+                                        $thisval = $match[1];
+                                        if ( in_array($attrname, $uris) )               
+                                                $thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
 
                                         if(FALSE === array_key_exists($attrname, $attrarr)) {
@@ -624 +629 @@
                                         # value
                                         {
-                                        $thisval = wp_kses_bad_protocol($match[1], $allowed_protocols);
+                                        $thisval = $match[1];
+                                        if ( in_array($attrname, $uris) )               
+                                                $thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
 
                                         if(FALSE === array_key_exists($attrname, $attrarr)) {