edb/studio-2013
Archived
9
0 Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

Updates

Browse Source
This commit is contained in:
root@pico committed 2015-05-01 21:20:47 +02:00
1 parent 70d2335bba
commit 7428b67da5
1086 files changed
+94145 -59082
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

wp-includes/kses.php
+101 -76
View File
@@ -88,6 +88,14 @@ if ( ! CUSTOM_TAGS ) {
'lang' => true,
'xml:lang' => true,
),
'audio' => array(
'autoplay' => true,
'controls' => true,
'loop' => true,
'muted' => true,
'preload' => true,
'src' => true,
),
'b' => array(),
'big' => array(),
'blockquote' => array(
@@ -119,6 +127,14 @@ if ( ! CUSTOM_TAGS ) {
'valign' => true,
'width' => true,
),
'colgroup' => array(
'align' => true,
'char' => true,
'charoff' => true,
'span' => true,
'valign' => true,
'width' => true,
),
'del' => array(
'datetime' => true,
),
@@ -364,6 +380,13 @@ if ( ! CUSTOM_TAGS ) {
'charoff' => true,
'valign' => true,
),
'track' => array(
'default' => true,
'kind' => true,
'label' => true,
'src' => true,
'srclang' => true,
),
'tt' => array(),
'u' => array(),
'ul' => array(
@@ -374,6 +397,17 @@ if ( ! CUSTOM_TAGS ) {
'type' => true,
),
'var' => array(),
'video' => array(
'autoplay' => true,
'controls' => true,
'height' => true,
'loop' => true,
'muted' => true,
'poster' => true,
'preload' => true,
'src' => true,
'width' => true,
),
);
/**
@@ -407,6 +441,7 @@ if ( ! CUSTOM_TAGS ) {
'q' => array(
'cite' => true,
),
's' => array(),
'strike' => array(),
'strong' => array(),
);
@@ -522,22 +557,22 @@ function wp_kses_allowed_html( $context = '' ) {
case 'post':
/** This filter is documented in wp-includes/kses.php */
return apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
break;
case 'user_description':
case 'pre_user_description':
$tags = $allowedtags;
$tags['a']['rel'] = true;
/** This filter is documented in wp-includes/kses.php */
return apply_filters( 'wp_kses_allowed_html', $tags, $context );
break;
case 'strip':
/** This filter is documented in wp-includes/kses.php */
return apply_filters( 'wp_kses_allowed_html', array(), $context );
break;
case 'entities':
/** This filter is documented in wp-includes/kses.php */
return apply_filters( 'wp_kses_allowed_html', $allowedentitynames, $context);
break;
case 'data':
default:
/** This filter is documented in wp-includes/kses.php */
@@ -627,7 +662,6 @@ function _wp_kses_split_callback( $match ) {
*
* @access private
* @since 1.0.0
* @uses wp_kses_attr()
*
* @param string $string Content to filter
* @param array $allowed_html Allowed HTML elements
@@ -639,7 +673,7 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) {
if (substr($string, 0, 1) != '<')
return '&gt;';
# It matched a ">" character
// It matched a ">" character
if ( '<!--' == substr( $string, 0, 4 ) ) {
$string = str_replace( array('<!--', '-->'), '', $string );
@@ -653,11 +687,11 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) {
$string = preg_replace('/-$/', '', $string);
return "<!--{$string}-->";
}
# Allow HTML comments
// Allow HTML comments
if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches))
return '';
# It's seriously malformed
// It's seriously malformed
$slash = trim($matches[1]);
$elem = $matches[2];
@@ -668,11 +702,11 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) {
if ( ! isset($allowed_html[strtolower($elem)]) )
return '';
# They are using a not allowed HTML element
// They are using a not allowed HTML element
if ($slash != '')
return "</$elem>";
# No attributes are allowed for closing elements
// No attributes are allowed for closing elements
return wp_kses_attr( $elem, $attrlist, $allowed_html, $allowed_protocols );
}
@@ -695,7 +729,7 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) {
* @return string Sanitized HTML element
*/
function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) {
# Is there a closing XHTML slash at the end of the attributes?
// Is there a closing XHTML slash at the end of the attributes?
if ( ! is_array( $allowed_html ) )
$allowed_html = wp_kses_allowed_html( $allowed_html );
@@ -704,25 +738,25 @@ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) {
if (preg_match('%\s*/\s*$%', $attr))
$xhtml_slash = ' /';
# Are any attributes allowed at all for this element?
// Are any attributes allowed at all for this element?
if ( ! isset($allowed_html[strtolower($element)]) || count($allowed_html[strtolower($element)]) == 0 )
return "<$element$xhtml_slash>";
# Split it
// Split it
$attrarr = wp_kses_hair($attr, $allowed_protocols);
# Go through $attrarr, and save the allowed attributes for this element
# in $attr2
// Go through $attrarr, and save the allowed attributes for this element
// in $attr2
$attr2 = '';
$allowed_attr = $allowed_html[strtolower($element)];
foreach ($attrarr as $arreach) {
if ( ! isset( $allowed_attr[strtolower($arreach['name'])] ) )
continue; # the attribute is not allowed
continue; // the attribute is not allowed
$current = $allowed_attr[strtolower($arreach['name'])];
if ( $current == '' )
continue; # the attribute is not allowed
continue; // the attribute is not allowed
if ( strtolower( $arreach['name'] ) == 'style' ) {
$orig_value = $arreach['value'];
@@ -737,10 +771,10 @@ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) {
if ( ! is_array($current) ) {
$attr2 .= ' '.$arreach['whole'];
# there are no checks
// there are no checks
} else {
# there are some checks
// there are some checks
$ok = true;
foreach ($current as $currkey => $currval) {
if ( ! wp_kses_check_attr_val($arreach['value'], $arreach['vless'], $currkey, $currval) ) {
@@ -750,11 +784,11 @@ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) {
}
if ( $ok )
$attr2 .= ' '.$arreach['whole']; # it passed them
} # if !is_array($current)
} # foreach
$attr2 .= ' '.$arreach['whole']; // it passed them
} // if !is_array($current)
} // foreach
# Remove any "<" or ">" characters
// Remove any "<" or ">" characters
$attr2 = preg_replace('/[<>]/', '', $attr2);
return "<$element$attr2$xhtml_slash>";
@@ -783,13 +817,13 @@ function wp_kses_hair($attr, $allowed_protocols) {
$attrname = '';
$uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
# Loop through the whole attribute list
// Loop through the whole attribute list
while (strlen($attr) != 0) {
$working = 0; # Was the last operation successful?
$working = 0; // Was the last operation successful?
switch ($mode) {
case 0 : # attribute name, href for instance
case 0 : // attribute name, href for instance
if ( preg_match('/^([-a-zA-Z:]+)/', $attr, $match ) ) {
$attrname = $match[1];
@@ -799,9 +833,9 @@ function wp_kses_hair($attr, $allowed_protocols) {
break;
case 1 : # equals sign or valueless ("selected")
case 1 : // equals sign or valueless ("selected")
if (preg_match('/^\s*=\s*/', $attr)) # equals sign
if (preg_match('/^\s*=\s*/', $attr)) // equals sign
{
$working = 1;
$mode = 2;
@@ -809,7 +843,7 @@ function wp_kses_hair($attr, $allowed_protocols) {
break;
}
if (preg_match('/^\s+/', $attr)) # valueless
if (preg_match('/^\s+/', $attr)) // valueless
{
$working = 1;
$mode = 0;
@@ -821,10 +855,10 @@ function wp_kses_hair($attr, $allowed_protocols) {
break;
case 2 : # attribute value, a URL after href= for instance
case 2 : // attribute value, a URL after href= for instance
if (preg_match('%^"([^"]*)"(\s+|/?$)%', $attr, $match))
# "value"
// "value"
{
$thisval = $match[1];
if ( in_array(strtolower($attrname), $uris) )
@@ -840,7 +874,7 @@ function wp_kses_hair($attr, $allowed_protocols) {
}
if (preg_match("%^'([^']*)'(\s+|/?$)%", $attr, $match))
# 'value'
// 'value'
{
$thisval = $match[1];
if ( in_array(strtolower($attrname), $uris) )
@@ -856,7 +890,7 @@ function wp_kses_hair($attr, $allowed_protocols) {
}
if (preg_match("%^([^\s\"']+)(\s+|/?$)%", $attr, $match))
# value
// value
{
$thisval = $match[1];
if ( in_array(strtolower($attrname), $uris) )
@@ -865,25 +899,25 @@ function wp_kses_hair($attr, $allowed_protocols) {
if(false === array_key_exists($attrname, $attrarr)) {
$attrarr[$attrname] = array ('name' => $attrname, 'value' => $thisval, 'whole' => "$attrname=\"$thisval\"", 'vless' => 'n');
}
# We add quotes to conform to W3C's HTML spec.
// We add quotes to conform to W3C's HTML spec.
$working = 1;
$mode = 0;
$attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr);
}
break;
} # switch
} // switch
if ($working == 0) # not well formed, remove and try again
if ($working == 0) // not well formed, remove and try again
{
$attr = wp_kses_html_error($attr);
$mode = 0;
}
} # while
} // while
if ($mode == 1 && false === array_key_exists($attrname, $attrarr))
# special case, for when the attribute list ends with a valueless
# attribute like "selected"
// special case, for when the attribute list ends with a valueless
// attribute like "selected"
$attrarr[$attrname] = array ('name' => $attrname, 'value' => '', 'whole' => $attrname, 'vless' => 'y');
return $attrarr;
@@ -908,28 +942,28 @@ function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) {
switch (strtolower($checkname)) {
case 'maxlen' :
# The maxlen check makes sure that the attribute value has a length not
# greater than the given value. This can be used to avoid Buffer Overflows
# in WWW clients and various Internet servers.
// The maxlen check makes sure that the attribute value has a length not
// greater than the given value. This can be used to avoid Buffer Overflows
// in WWW clients and various Internet servers.
if (strlen($value) > $checkvalue)
$ok = false;
break;
case 'minlen' :
# The minlen check makes sure that the attribute value has a length not
# smaller than the given value.
// The minlen check makes sure that the attribute value has a length not
// smaller than the given value.
if (strlen($value) < $checkvalue)
$ok = false;
break;
case 'maxval' :
# The maxval check does two things: it checks that the attribute value is
# an integer from 0 and up, without an excessive amount of zeroes or
# whitespace (to avoid Buffer Overflows). It also checks that the attribute
# value is not greater than the given value.
# This check can be used to avoid Denial of Service attacks.
// The maxval check does two things: it checks that the attribute value is
// an integer from 0 and up, without an excessive amount of zeroes or
// whitespace (to avoid Buffer Overflows). It also checks that the attribute
// value is not greater than the given value.
// This check can be used to avoid Denial of Service attacks.
if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value))
$ok = false;
@@ -938,8 +972,8 @@ function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) {
break;
case 'minval' :
# The minval check makes sure that the attribute value is a positive integer,
# and that it is not smaller than the given value.
// The minval check makes sure that the attribute value is a positive integer,
// and that it is not smaller than the given value.
if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value))
$ok = false;
@@ -948,15 +982,15 @@ function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) {
break;
case 'valueless' :
# The valueless check makes sure if the attribute has a value
# (like <a href="blah">) or not (<option selected>). If the given value
# is a "y" or a "Y", the attribute must not have a value.
# If the given value is an "n" or an "N", the attribute must have one.
// The valueless check makes sure if the attribute has a value
// (like <a href="blah">) or not (<option selected>). If the given value
// is a "y" or a "Y", the attribute must not have a value.
// If the given value is an "n" or an "N", the attribute must have one.
if (strtolower($checkvalue) != $vless)
$ok = false;
break;
} # switch
} // switch
return $ok;
}
@@ -1041,8 +1075,8 @@ function wp_kses_array_lc($inarray) {
foreach ( (array) $inval as $inkey2 => $inval2) {
$outkey2 = strtolower($inkey2);
$outarray[$outkey][$outkey2] = $inval2;
} # foreach $inval
} # foreach $inarray
} // foreach $inval
} // foreach $inarray
return $outarray;
}
@@ -1139,8 +1173,8 @@ function wp_kses_bad_protocol_once2( $string, $allowed_protocols ) {
/**
* Converts and fixes HTML entities.
*
* This function normalizes HTML entities. It will convert "AT&T" to the correct
* "AT&amp;T", "&#00058;" to "&#58;", "&#XYZZY;" to "&amp;#XYZZY;" and so on.
* This function normalizes HTML entities. It will convert `AT&T` to the correct
* `AT&amp;T`, `&#00058;` to `&#58;`, `&#XYZZY;` to `&amp;#XYZZY;` and so on.
*
* @since 1.0.0
*
@@ -1148,11 +1182,11 @@ function wp_kses_bad_protocol_once2( $string, $allowed_protocols ) {
* @return string Content with normalized entities
*/
function wp_kses_normalize_entities($string) {
# Disarm all entities by converting & to &amp;
// Disarm all entities by converting & to &amp;
$string = str_replace('&', '&amp;', $string);
# Change back the allowed entities in our entity whitelist
// Change back the allowed entities in our entity whitelist
$string = preg_replace_callback('/&amp;([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string);
$string = preg_replace_callback('/&amp;#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $string);
@@ -1185,8 +1219,8 @@ function wp_kses_named_entities($matches) {
/**
* Callback for wp_kses_normalize_entities() regular expression.
*
* This function helps wp_kses_normalize_entities() to only accept 16-bit values
* and nothing more for &#number; entities.
* This function helps {@see wp_kses_normalize_entities()} to only accept 16-bit
* values and nothing more for `&#number;` entities.
*
* @access private
* @since 1.0.0
@@ -1244,9 +1278,9 @@ function valid_unicode($i) {
/**
* Convert all entities to their character counterparts.
*
* This function decodes numeric HTML entities (&#65; and &#x41;). It doesn't do
* anything with other entities like &auml;, but we don't need them in the URL
* protocol whitelisting system anyway.
* This function decodes numeric HTML entities (`&#65;` and `&#x41;`).
* It doesn't do anything with other entities like &auml;, but we don't
* need them in the URL protocol whitelisting system anyway.
*
* @since 1.0.0
*
@@ -1284,7 +1318,6 @@ function _wp_kses_decode_entities_chr_hexdec( $match ) {
* Sanitize content with allowed HTML Kses rules.
*
* @since 1.0.0
* @uses $allowedtags
*
* @param string $data Content to filter, expected to be escaped with slashes
* @return string Filtered content
@@ -1297,7 +1330,6 @@ function wp_filter_kses( $data ) {
* Sanitize content with allowed HTML Kses rules.
*
* @since 2.9.0
* @uses $allowedtags
*
* @param string $data Content to filter, expected to not be escaped
* @return string Filtered content
@@ -1358,7 +1390,6 @@ function wp_filter_nohtml_kses( $data ) {
* 'excerpt_save_pre', and 'content_filtered_save_pre' hooks.
*
* @since 2.0.0
* @uses add_filter() See description for what functions are added to what hooks.
*/
function kses_init_filters() {
// Normal filtering
@@ -1413,9 +1444,6 @@ function kses_remove_filters() {
* to have Kses filter the content. If the user does not have unfiltered_html
* capability, then Kses filters are added.
*
* @uses kses_remove_filters() Removes the Kses filters
* @uses kses_init_filters() Adds the Kses filters back if the user
* does not have unfiltered HTML capability.
* @since 2.0.0
*/
function kses_init() {
@@ -1425,9 +1453,6 @@ function kses_init() {
kses_init_filters();
}
add_action('init', 'kses_init');
add_action('set_current_user', 'kses_init');
/**
* Inline CSS filter
*