enmi-conf.org: comparison wp/wp-includes/kses.php

equal deleted inserted replaced

-:346c88efed21
+:5e2f62d02dcd
 *
 * @since 1.2.0
 */
 if ( ! defined( 'CUSTOM_TAGS' ) )
 	define( 'CUSTOM_TAGS', false );
+// Ensure that these variables are added to the global namespace
+// (e.g. if using namespaces / autoload in the current PHP environment).
+global $allowedposttags, $allowedtags, $allowedentitynames;
 if ( ! CUSTOM_TAGS ) {
 	/**
 	 * Kses global for default allowable HTML tags.
 	 *
 			'align' => true,
 			'dir' => true,
 			'lang' => true,
 			'xml:lang' => true,
 		),
+		'audio' => array(
+			'autoplay' => true,
+			'controls' => true,
+			'loop' => true,
+			'muted' => true,
+			'preload' => true,
+			'src' => true,
+		),
 		'b' => array(),
 		'big' => array(),
 		'blockquote' => array(
 			'cite' => true,
 			'lang' => true,
 			'span' => true,
 			'dir' => true,
 			'valign' => true,
 			'width' => true,
 		),
+		'colgroup' => array(
+			'align' => true,
+			'char' => true,
+			'charoff' => true,
+			'span' => true,
+			'valign' => true,
+			'width' => true,
+		),
 		'del' => array(
 			'datetime' => true,
 		),
 		'dd' => array(),
+		'dfn' => array(),
 		'details' => array(
 			'align' => true,
 			'dir' => true,
 			'lang' => true,
 			'open' => true,
 			'value' => true,
 		),
 		'map' => array(
 			'name' => true,
 		),
+		'mark' => array(),
 		'menu' => array(
 			'type' => true,
 		),
 		'nav' => array(
 			'align' => true,
 		),
 		'q' => array(
 			'cite' => true,
 		),
 		's' => array(),
+		'samp' => array(),
 		'span' => array(
 			'dir' => true,
 			'align' => true,
 			'lang' => true,
 			'xml:lang' => true,
 			'bgcolor' => true,
 			'char' => true,
 			'charoff' => true,
 			'valign' => true,
 		),
+		'track' => array(
+			'default' => true,
+			'kind' => true,
+			'label' => true,
+			'src' => true,
+			'srclang' => true,
+		),
 		'tt' => array(),
 		'u' => array(),
 		'ul' => array(
 			'type' => true,
 		),
 		'ol' => array(
 			'start' => true,
 			'type' => true,
 		),
 		'var' => array(),
+		'video' => array(
+			'autoplay' => true,
+			'controls' => true,
+			'height' => true,
+			'loop' => true,
+			'muted' => true,
+			'poster' => true,
+			'preload' => true,
+			'src' => true,
+			'width' => true,
+		),
 	);
 	/**
 	 * Kses allowed HTML elements.
 	 *
 		'em' => array(),
 		'i' => array(),
 		'q' => array(
 			'cite' => true,
 		),
+		's' => array(),
 		'strike' => array(),
 		'strong' => array(),
 	);
 	$allowedentitynames = array(
 		'cap',     'cup',    'int',     'sim',    'cong',   'asymp',
 		'ne',      'equiv',  'le',      'ge',     'sub',    'sup',
 		'nsub',    'sube',   'supe',    'oplus',  'otimes', 'perp',
 		'sdot',    'lceil',  'rceil',   'lfloor', 'rfloor', 'lang',
 		'rang',    'loz',    'spades',  'clubs',  'hearts', 'diams',
+		'sup1',    'sup2',   'sup3',    'frac14', 'frac12', 'frac34',
+		'there4',
 	);
 	$allowedposttags = array_map( '_wp_add_global_attributes', $allowedposttags );
 } else {
 	$allowedtags = wp_kses_array_lc( $allowedtags );
 * @return array List of allowed tags and their allowed attributes.
 */
 function wp_kses_allowed_html( $context = '' ) {
 	global $allowedposttags, $allowedtags, $allowedentitynames;
-	if ( is_array( $context ) )
+	if ( is_array( $context ) ) {
+		/**
+		 * Filter HTML elements allowed for a given context.
+		 *
+		 * @since 3.5.0
+		 *
+		 * @param string $tags    Allowed tags, attributes, and/or entities.
+		 * @param string $context Context to judge allowed tags by. Allowed values are 'post',
+		 *                        'data', 'strip', 'entities', 'explicit', or the name of a filter.
+		 */
 		return apply_filters( 'wp_kses_allowed_html', $context, 'explicit' );
+	}
 	switch ( $context ) {
 		case 'post':
+			/** This filter is documented in wp-includes/kses.php */
 			return apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
-			break;
 		case 'user_description':
 		case 'pre_user_description':
 			$tags = $allowedtags;
 			$tags['a']['rel'] = true;
+			/** This filter is documented in wp-includes/kses.php */
 			return apply_filters( 'wp_kses_allowed_html', $tags, $context );
-			break;
 		case 'strip':
+			/** This filter is documented in wp-includes/kses.php */
 			return apply_filters( 'wp_kses_allowed_html', array(), $context );
-			break;
 		case 'entities':
+			/** This filter is documented in wp-includes/kses.php */
 			return apply_filters( 'wp_kses_allowed_html', $allowedentitynames, $context);
-			break;
 		case 'data':
 		default:
+			/** This filter is documented in wp-includes/kses.php */
 			return apply_filters( 'wp_kses_allowed_html', $allowedtags, $context );
 	}
 }
 /**
 * @param array $allowed_html List of allowed HTML elements
 * @param array $allowed_protocols Allowed protocol in links
 * @return string Filtered content through 'pre_kses' hook
 */
 function wp_kses_hook( $string, $allowed_html, $allowed_protocols ) {
-	$string = apply_filters('pre_kses', $string, $allowed_html, $allowed_protocols);
+	/**
+	 * Filter content to be run through kses.
+	 *
+	 * @since 2.3.0
+	 *
+	 * @param string $string            Content to run through kses.
+	 * @param array  $allowed_html      Allowed HTML elements.
+	 * @param array  $allowed_protocols Allowed protocol in links.
+	 */
+	$string = apply_filters( 'pre_kses', $string, $allowed_html, $allowed_protocols );
 	return $string;
 }
 /**
 * This function returns kses' version number.
 * through another filter which will remove illegal attributes and once that is
 * completed, will be returned.
 *
 * @access private
 * @since 1.0.0
-* @uses wp_kses_attr()
 *
 * @param string $string Content to filter
 * @param array $allowed_html Allowed HTML elements
 * @param array $allowed_protocols Allowed protocols to keep
 * @return string Fixed HTML element
 function wp_kses_split2($string, $allowed_html, $allowed_protocols) {
 	$string = wp_kses_stripslashes($string);
 	if (substr($string, 0, 1) != '<')
 		return '&gt;';
-	# It matched a ">" character
+	// It matched a ">" character
 	if ( '<!--' == substr( $string, 0, 4 ) ) {
 		$string = str_replace( array('<!--', '-->'), '', $string );
 		while ( $string != ($newstring = wp_kses($string, $allowed_html, $allowed_protocols)) )
 			$string = $newstring;
 		$string = preg_replace('/--+/', '-', $string);
 		// prevent three dashes closing a comment
 		$string = preg_replace('/-$/', '', $string);
 		return "<!--{$string}-->";
 	}
-	# Allow HTML comments
+	// Allow HTML comments
 	if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches))
 		return '';
-	# It's seriously malformed
+	// It's seriously malformed
 	$slash = trim($matches[1]);
 	$elem = $matches[2];
 	$attrlist = $matches[3];
 	if ( ! is_array( $allowed_html ) )
 		$allowed_html = wp_kses_allowed_html( $allowed_html );
 	if ( ! isset($allowed_html[strtolower($elem)]) )
 		return '';
-	# They are using a not allowed HTML element
+	// They are using a not allowed HTML element
 	if ($slash != '')
 		return "</$elem>";
-	# No attributes are allowed for closing elements
+	// No attributes are allowed for closing elements
 	return wp_kses_attr( $elem, $attrlist, $allowed_html, $allowed_protocols );
 }
 /**
 * @param array $allowed_html Allowed HTML elements
 * @param array $allowed_protocols Allowed protocols to keep
 * @return string Sanitized HTML element
 */
 function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) {
-	# Is there a closing XHTML slash at the end of the attributes?
+	// Is there a closing XHTML slash at the end of the attributes?
 	if ( ! is_array( $allowed_html ) )
 		$allowed_html = wp_kses_allowed_html( $allowed_html );
 	$xhtml_slash = '';
 	if (preg_match('%\s*/\s*$%', $attr))
 		$xhtml_slash = ' /';
-	# Are any attributes allowed at all for this element?
+	// Are any attributes allowed at all for this element?
 	if ( ! isset($allowed_html[strtolower($element)]) || count($allowed_html[strtolower($element)]) == 0 )
 		return "<$element$xhtml_slash>";
-	# Split it
+	// Split it
 	$attrarr = wp_kses_hair($attr, $allowed_protocols);
-	# Go through $attrarr, and save the allowed attributes for this element
+	// Go through $attrarr, and save the allowed attributes for this element
-	# in $attr2
+	// in $attr2
 	$attr2 = '';
 	$allowed_attr = $allowed_html[strtolower($element)];
 	foreach ($attrarr as $arreach) {
 		if ( ! isset( $allowed_attr[strtolower($arreach['name'])] ) )
-			continue; # the attribute is not allowed
+			continue; // the attribute is not allowed
 		$current = $allowed_attr[strtolower($arreach['name'])];
 		if ( $current == '' )
-			continue; # the attribute is not allowed
+			continue; // the attribute is not allowed
 		if ( strtolower( $arreach['name'] ) == 'style' ) {
 			$orig_value = $arreach['value'];
 			$value = safecss_filter_attr( $orig_value );
 			$arreach['whole'] = str_replace( $orig_value, $value, $arreach['whole'] );
 		}
 		if ( ! is_array($current) ) {
 			$attr2 .= ' '.$arreach['whole'];
-		# there are no checks
+		// there are no checks
 		} else {
-			# there are some checks
+			// there are some checks
 			$ok = true;
 			foreach ($current as $currkey => $currval) {
 				if ( ! wp_kses_check_attr_val($arreach['value'], $arreach['vless'], $currkey, $currval) ) {
 					$ok = false;
 					break;
 				}
 			}
 			if ( $ok )
-				$attr2 .= ' '.$arreach['whole']; # it passed them
+				$attr2 .= ' '.$arreach['whole']; // it passed them
-		} # if !is_array($current)
+		} // if !is_array($current)
-	} # foreach
+	} // foreach
-	# Remove any "<" or ">" characters
+	// Remove any "<" or ">" characters
 	$attr2 = preg_replace('/[<>]/', '', $attr2);
 	return "<$element$attr2$xhtml_slash>";
 }
 	$attrarr = array();
 	$mode = 0;
 	$attrname = '';
 	$uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
-	# Loop through the whole attribute list
+	// Loop through the whole attribute list
 	while (strlen($attr) != 0) {
-		$working = 0; # Was the last operation successful?
+		$working = 0; // Was the last operation successful?
 		switch ($mode) {
-			case 0 : # attribute name, href for instance
+			case 0 : // attribute name, href for instance
-				if (preg_match('/^([-a-zA-Z]+)/', $attr, $match)) {
+				if ( preg_match('/^([-a-zA-Z:]+)/', $attr, $match ) ) {
 					$attrname = $match[1];
 					$working = $mode = 1;
-					$attr = preg_replace('/^[-a-zA-Z]+/', '', $attr);
+					$attr = preg_replace( '/^[-a-zA-Z:]+/', '', $attr );
 				}
 				break;
-			case 1 : # equals sign or valueless ("selected")
+			case 1 : // equals sign or valueless ("selected")
-				if (preg_match('/^\s*=\s*/', $attr)) # equals sign
+				if (preg_match('/^\s*=\s*/', $attr)) // equals sign
 					{
 					$working = 1;
 					$mode = 2;
 					$attr = preg_replace('/^\s*=\s*/', '', $attr);
 					break;
 				}
-				if (preg_match('/^\s+/', $attr)) # valueless
+				if (preg_match('/^\s+/', $attr)) // valueless
 					{
 					$working = 1;
 					$mode = 0;
 					if(false === array_key_exists($attrname, $attrarr)) {
 						$attrarr[$attrname] = array ('name' => $attrname, 'value' => '', 'whole' => $attrname, 'vless' => 'y');
 					$attr = preg_replace('/^\s+/', '', $attr);
 				}
 				break;
-			case 2 : # attribute value, a URL after href= for instance
+			case 2 : // attribute value, a URL after href= for instance
 				if (preg_match('%^"([^"]*)"(\s+|/?$)%', $attr, $match))
-					# "value"
+					// "value"
 					{
 					$thisval = $match[1];
 					if ( in_array(strtolower($attrname), $uris) )
 						$thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
 					$attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr);
 					break;
 				}
 				if (preg_match("%^'([^']*)'(\s+|/?$)%", $attr, $match))
-					# 'value'
+					// 'value'
 					{
 					$thisval = $match[1];
 					if ( in_array(strtolower($attrname), $uris) )
 						$thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
 					$attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr);
 					break;
 				}
 				if (preg_match("%^([^\s\"']+)(\s+|/?$)%", $attr, $match))
-					# value
+					// value
 					{
 					$thisval = $match[1];
 					if ( in_array(strtolower($attrname), $uris) )
 						$thisval = wp_kses_bad_protocol($thisval, $allowed_protocols);
 					if(false === array_key_exists($attrname, $attrarr)) {
 						$attrarr[$attrname] = array ('name' => $attrname, 'value' => $thisval, 'whole' => "$attrname=\"$thisval\"", 'vless' => 'n');
 					}
-					# We add quotes to conform to W3C's HTML spec.
+					// We add quotes to conform to W3C's HTML spec.
 					$working = 1;
 					$mode = 0;
 					$attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr);
 				}
 				break;
-		} # switch
+		} // switch
-		if ($working == 0) # not well formed, remove and try again
+		if ($working == 0) // not well formed, remove and try again
 		{
 			$attr = wp_kses_html_error($attr);
 			$mode = 0;
 		}
-	} # while
+	} // while
 	if ($mode == 1 && false === array_key_exists($attrname, $attrarr))
-		# special case, for when the attribute list ends with a valueless
+		// special case, for when the attribute list ends with a valueless
-		# attribute like "selected"
+		// attribute like "selected"
 		$attrarr[$attrname] = array ('name' => $attrname, 'value' => '', 'whole' => $attrname, 'vless' => 'y');
 	return $attrarr;
 }
 function wp_kses_check_attr_val($value, $vless, $checkname, $checkvalue) {
 	$ok = true;
 	switch (strtolower($checkname)) {
 		case 'maxlen' :
-			# The maxlen check makes sure that the attribute value has a length not
+			// The maxlen check makes sure that the attribute value has a length not
-			# greater than the given value. This can be used to avoid Buffer Overflows
+			// greater than the given value. This can be used to avoid Buffer Overflows
-			# in WWW clients and various Internet servers.
+			// in WWW clients and various Internet servers.
 			if (strlen($value) > $checkvalue)
 				$ok = false;
 			break;
 		case 'minlen' :
-			# The minlen check makes sure that the attribute value has a length not
+			// The minlen check makes sure that the attribute value has a length not
-			# smaller than the given value.
+			// smaller than the given value.
 			if (strlen($value) < $checkvalue)
 				$ok = false;
 			break;
 		case 'maxval' :
-			# The maxval check does two things: it checks that the attribute value is
+			// The maxval check does two things: it checks that the attribute value is
-			# an integer from 0 and up, without an excessive amount of zeroes or
+			// an integer from 0 and up, without an excessive amount of zeroes or
-			# whitespace (to avoid Buffer Overflows). It also checks that the attribute
+			// whitespace (to avoid Buffer Overflows). It also checks that the attribute
-			# value is not greater than the given value.
+			// value is not greater than the given value.
-			# This check can be used to avoid Denial of Service attacks.
+			// This check can be used to avoid Denial of Service attacks.
 			if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value))
 				$ok = false;
 			if ($value > $checkvalue)
 				$ok = false;
 			break;
 		case 'minval' :
-			# The minval check makes sure that the attribute value is a positive integer,
+			// The minval check makes sure that the attribute value is a positive integer,
-			# and that it is not smaller than the given value.
+			// and that it is not smaller than the given value.
 			if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value))
 				$ok = false;
 			if ($value < $checkvalue)
 				$ok = false;
 			break;
 		case 'valueless' :
-			# The valueless check makes sure if the attribute has a value
+			// The valueless check makes sure if the attribute has a value
-			# (like <a href="blah">) or not (<option selected>). If the given value
+			// (like <a href="blah">) or not (<option selected>). If the given value
-			# is a "y" or a "Y", the attribute must not have a value.
+			// is a "y" or a "Y", the attribute must not have a value.
-			# If the given value is an "n" or an "N", the attribute must have one.
+			// If the given value is an "n" or an "N", the attribute must have one.
 			if (strtolower($checkvalue) != $vless)
 				$ok = false;
 			break;
-	} # switch
+	} // switch
 	return $ok;
 }
 /**
 	return $string;
 }
 /**
-* Removes any null characters in $string.
+* Removes any invalid control characters in $string.
+*
+* Also removes any instance of the '\0' string.
 *
 * @since 1.0.0
 *
 * @param string $string
 * @return string
 */
 function wp_kses_no_null($string) {
-	$string = preg_replace('/\0+/', '', $string);
+	$string = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F]/', '', $string);
 	$string = preg_replace('/(\\\\0)+/', '', $string);
 	return $string;
 }
 		$outarray[$outkey] = array ();
 		foreach ( (array) $inval as $inkey2 => $inval2) {
 			$outkey2 = strtolower($inkey2);
 			$outarray[$outkey][$outkey2] = $inval2;
-		} # foreach $inval
+		} // foreach $inval
-	} # foreach $inarray
+	} // foreach $inarray
 	return $outarray;
 }
 /**
 }
 /**
 * Converts and fixes HTML entities.
 *
-* This function normalizes HTML entities. It will convert "AT&T" to the correct
+* This function normalizes HTML entities. It will convert `AT&T` to the correct
-* "AT&amp;T", "&#00058;" to "&#58;", "&#XYZZY;" to "&amp;#XYZZY;" and so on.
+* `AT&amp;T`, `&#00058;` to `&#58;`, `&#XYZZY;` to `&amp;#XYZZY;` and so on.
 *
 * @since 1.0.0
 *
 * @param string $string Content to normalize entities
 * @return string Content with normalized entities
 */
 function wp_kses_normalize_entities($string) {
-	# Disarm all entities by converting & to &amp;
+	// Disarm all entities by converting & to &amp;
 	$string = str_replace('&', '&amp;', $string);
-	# Change back the allowed entities in our entity whitelist
+	// Change back the allowed entities in our entity whitelist
-	$string = preg_replace_callback('/&amp;([A-Za-z]{2,8});/', 'wp_kses_named_entities', $string);
+	$string = preg_replace_callback('/&amp;([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string);
 	$string = preg_replace_callback('/&amp;#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $string);
 	$string = preg_replace_callback('/&amp;#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $string);
 	return $string;
 }
 }
 /**
 * Callback for wp_kses_normalize_entities() regular expression.
 *
-* This function helps wp_kses_normalize_entities() to only accept 16-bit values
+* This function helps {@see wp_kses_normalize_entities()} to only accept 16-bit
-* and nothing more for &#number; entities.
+* values and nothing more for `&#number;` entities.
 *
 * @access private
 * @since 1.0.0
 *
 * @param array $matches preg_replace_callback() matches array
 }
 /**
 * Convert all entities to their character counterparts.
 *
-* This function decodes numeric HTML entities (&#65; and &#x41;). It doesn't do
+* This function decodes numeric HTML entities (`&#65;` and `&#x41;`).
-* anything with other entities like &auml;, but we don't need them in the URL
+* It doesn't do anything with other entities like &auml;, but we don't
-* protocol whitelisting system anyway.
+* need them in the URL protocol whitelisting system anyway.
 *
 * @since 1.0.0
 *
 * @param string $string Content to change entities
 * @return string Content after decoded entities
 /**
 * Sanitize content with allowed HTML Kses rules.
 *
 * @since 1.0.0
-* @uses $allowedtags
 *
 * @param string $data Content to filter, expected to be escaped with slashes
 * @return string Filtered content
 */
 function wp_filter_kses( $data ) {
 /**
 * Sanitize content with allowed HTML Kses rules.
 *
 * @since 2.9.0
-* @uses $allowedtags
 *
 * @param string $data Content to filter, expected to not be escaped
 * @return string Filtered content
 */
 function wp_kses_data( $data ) {
 *
 * The wp_filter_post_kses() function is added to the 'content_save_pre',
 * 'excerpt_save_pre', and 'content_filtered_save_pre' hooks.
 *
 * @since 2.0.0
-* @uses add_filter() See description for what functions are added to what hooks.
 */
 function kses_init_filters() {
 	// Normal filtering
 	add_filter('title_save_pre', 'wp_filter_kses');
 *
 * First removes all of the Kses filters in case the current user does not need
 * to have Kses filter the content. If the user does not have unfiltered_html
 * capability, then Kses filters are added.
 *
-* @uses kses_remove_filters() Removes the Kses filters
-* @uses kses_init_filters() Adds the Kses filters back if the user
-*		does not have unfiltered HTML capability.
 * @since 2.0.0
 */
 function kses_init() {
 	kses_remove_filters();
 	if (current_user_can('unfiltered_html') == false)
 		kses_init_filters();
 }
-add_action('init', 'kses_init');
-add_action('set_current_user', 'kses_init');
 /**
 * Inline CSS filter
 *
 * @since 2.8.1
 		_deprecated_argument( __FUNCTION__, '2.8.1' ); // Never implemented
 	$css = wp_kses_no_null($css);
 	$css = str_replace(array("\n","\r","\t"), '', $css);
-	if ( preg_match( '%[\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
+	if ( preg_match( '%[\\\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
 		return '';
 	$css_array = explode( ';', trim( $css ) );
+	/**
+	 * Filter list of allowed CSS attributes.
+	 *
+	 * @since 2.8.1
+	 *
+	 * @param array $attr List of allowed CSS attributes.
+	 */
 	$allowed_attr = apply_filters( 'safe_style_css', array( 'text-align', 'margin', 'color', 'float',
 	'border', 'background', 'background-color', 'border-bottom', 'border-bottom-color',
 	'border-bottom-style', 'border-bottom-width', 'border-collapse', 'border-color', 'border-left',
 	'border-left-color', 'border-left-style', 'border-left-width', 'border-right', 'border-right-color',
 	'border-right-style', 'border-right-width', 'border-spacing', 'border-style', 'border-top',
 	$global_attributes = array(
 		'class' => true,
 		'id' => true,
 		'style' => true,
 		'title' => true,
+		'role' => true,
 	);
 	if ( true === $value )
 		$value = array();

changeset 5	5e2f62d02dcd
parent 0	d970ebf37754
child 7	cf61fcea0001