Changeset 4672

Timestamp:

01/02/07 21:22:41 (2 years ago)

Author:

ryan

Message:

Add kses protocol checking to clean_url. Props Andy. fixes #3515

Files:

• branches/2.0/wp-includes/comment-functions.php (modified) (1 diff)
• branches/2.0/wp-includes/functions-formatting.php (modified) (1 diff)
• trunk/wp-includes/formatting.php (modified) (2 diffs)

branches/2.0/wp-includes/comment-functions.php

@@ -212 +212 @@
-    do_action('wp_set_comment_status', $comment_id, 'delete');
-    return true;
-}
-
-function clean_url( $url ) {
-    if ('' == $url) return $url;
-    $url = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%]|i', '', $url);
-    $strip = array('%0d', '%0a');
-    $url = str_replace($strip, '', $url);
-    $url = str_replace(';//', '://', $url);
-    $url = (!strstr($url, '://')) ? 'http://'.$url : $url;
-    $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
-    return $url;
-}
-

branches/2.0/wp-includes/functions-formatting.php

@@ -1046 +1046 @@
-}
-
+function clean_url( $url, $protocols = null ) {
+    if ('' == $url) return $url;
+    $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%]|i', '', $url);
+    $strip = array('%0d', '%0a');
+    $url = str_replace($strip, '', $url);
+    $url = str_replace(';//', '://', $url);
+    $url = (!strstr($url, '://')) ? 'http://'.$url : $url;
+    $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
+    if ( !is_array($protocols) )
+        $protocols = array('http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet'); 
+    if ( wp_kses_bad_protocol( $url, $protocols ) != $url )
+        return '';
+    return $url;
+}
+
-// Escape single quotes, specialchar double quotes, and fix line endings.
-function js_escape($text) {

trunk/wp-includes/formatting.php

@@ -1057 +1057 @@
-}
-
-
+, $protocols = null
-    if ('' == $url) return $url;
-    $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%]|i', '', $url);
@@ -1065 +1065 @@
-    $url = (!strstr($url, '://')) ? 'http://'.$url : $url;
-    $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
+    if ( !is_array($protocols) )
+        $protocols = array('http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet'); 
+    if ( wp_kses_bad_protocol( $url, $protocols ) != $url )
+        return '';
-    return $url;
-}