equal
deleted
inserted
replaced
37 * {@see 'wp_kses_allowed_html'} filter is more powerful and supplies context. |
37 * {@see 'wp_kses_allowed_html'} filter is more powerful and supplies context. |
38 * |
38 * |
39 * @see wp_kses_allowed_html() |
39 * @see wp_kses_allowed_html() |
40 * @since 1.2.0 |
40 * @since 1.2.0 |
41 * |
41 * |
42 * @var array[]|bool Array of default allowable HTML tags, or false to use the defaults. |
42 * @var array[]|false Array of default allowable HTML tags, or false to use the defaults. |
43 */ |
43 */ |
44 if ( ! defined( 'CUSTOM_TAGS' ) ) { |
44 if ( ! defined( 'CUSTOM_TAGS' ) ) { |
45 define( 'CUSTOM_TAGS', false ); |
45 define( 'CUSTOM_TAGS', false ); |
46 } |
46 } |
47 |
47 |
249 'align' => true, |
249 'align' => true, |
250 ), |
250 ), |
251 'li' => array( |
251 'li' => array( |
252 'align' => true, |
252 'align' => true, |
253 'value' => true, |
253 'value' => true, |
|
254 ), |
|
255 'main' => array( |
|
256 'align' => true, |
|
257 'dir' => true, |
|
258 'lang' => true, |
|
259 'xml:lang' => true, |
254 ), |
260 ), |
255 'map' => array( |
261 'map' => array( |
256 'name' => true, |
262 'name' => true, |
257 ), |
263 ), |
258 'mark' => array(), |
264 'mark' => array(), |
1409 * Based on `wp_kses_split2()` and `wp_kses_attr()`. |
1415 * Based on `wp_kses_split2()` and `wp_kses_attr()`. |
1410 * |
1416 * |
1411 * @since 4.2.3 |
1417 * @since 4.2.3 |
1412 * |
1418 * |
1413 * @param string $element HTML element. |
1419 * @param string $element HTML element. |
1414 * @return array|bool List of attributes found in the element. Returns false on failure. |
1420 * @return array|false List of attributes found in the element. Returns false on failure. |
1415 */ |
1421 */ |
1416 function wp_kses_attr_parse( $element ) { |
1422 function wp_kses_attr_parse( $element ) { |
1417 $valid = preg_match( '%^(<\s*)(/\s*)?([a-zA-Z0-9]+\s*)([^>]*)(>?)$%', $element, $matches ); |
1423 $valid = preg_match( '%^(<\s*)(/\s*)?([a-zA-Z0-9]+\s*)([^>]*)(>?)$%', $element, $matches ); |
1418 if ( 1 !== $valid ) { |
1424 if ( 1 !== $valid ) { |
1419 return false; |
1425 return false; |
1460 * Based on `wp_kses_hair()` but does not return a multi-dimensional array. |
1466 * Based on `wp_kses_hair()` but does not return a multi-dimensional array. |
1461 * |
1467 * |
1462 * @since 4.2.3 |
1468 * @since 4.2.3 |
1463 * |
1469 * |
1464 * @param string $attr Attribute list from HTML element to closing HTML element tag. |
1470 * @param string $attr Attribute list from HTML element to closing HTML element tag. |
1465 * @return array|bool List of attributes found in $attr. Returns false on failure. |
1471 * @return array|false List of attributes found in $attr. Returns false on failure. |
1466 */ |
1472 */ |
1467 function wp_kses_hair_parse( $attr ) { |
1473 function wp_kses_hair_parse( $attr ) { |
1468 if ( '' === $attr ) { |
1474 if ( '' === $attr ) { |
1469 return array(); |
1475 return array(); |
1470 } |
1476 } |
1775 |
1781 |
1776 /** |
1782 /** |
1777 * Converts and fixes HTML entities. |
1783 * Converts and fixes HTML entities. |
1778 * |
1784 * |
1779 * This function normalizes HTML entities. It will convert `AT&T` to the correct |
1785 * This function normalizes HTML entities. It will convert `AT&T` to the correct |
1780 * `AT&T`, `:` to `:`, `&#XYZZY;` to `&#XYZZY;` and so on. |
1786 * `AT&T`, `:` to `:`, `&#XYZZY;` to `&#XYZZY;` and so on. |
1781 * |
1787 * |
1782 * When `$context` is set to 'xml', HTML entities are converted to their code points. For |
1788 * When `$context` is set to 'xml', HTML entities are converted to their code points. For |
1783 * example, `AT&T…&#XYZZY;` is converted to `AT&T…&#XYZZY;`. |
1789 * example, `AT&T…&#XYZZY;` is converted to `AT&T…&#XYZZY;`. |
1784 * |
1790 * |
1785 * @since 1.0.0 |
1791 * @since 1.0.0 |
2169 * @since 5.1.0 Added support for `text-transform`. |
2175 * @since 5.1.0 Added support for `text-transform`. |
2170 * @since 5.2.0 Added support for `background-position` and `grid-template-columns`. |
2176 * @since 5.2.0 Added support for `background-position` and `grid-template-columns`. |
2171 * @since 5.3.0 Added support for `grid`, `flex` and `column` layout properties. |
2177 * @since 5.3.0 Added support for `grid`, `flex` and `column` layout properties. |
2172 * Extend `background-*` support of individual properties. |
2178 * Extend `background-*` support of individual properties. |
2173 * @since 5.3.1 Added support for gradient backgrounds. |
2179 * @since 5.3.1 Added support for gradient backgrounds. |
|
2180 * @since 5.7.1 Added support for `object-position`. |
|
2181 * @since 5.8.0 Added support for `calc()` and `var()` values. |
2174 * |
2182 * |
2175 * @param string[] $attr Array of allowed CSS attributes. |
2183 * @param string[] $attr Array of allowed CSS attributes. |
2176 */ |
2184 */ |
2177 $allowed_attr = apply_filters( |
2185 $allowed_attr = apply_filters( |
2178 'safe_style_css', |
2186 'safe_style_css', |
2282 'clear', |
2290 'clear', |
2283 'cursor', |
2291 'cursor', |
2284 'direction', |
2292 'direction', |
2285 'float', |
2293 'float', |
2286 'list-style-type', |
2294 'list-style-type', |
|
2295 'object-position', |
2287 'overflow', |
2296 'overflow', |
2288 'vertical-align', |
2297 'vertical-align', |
2289 ) |
2298 ) |
2290 ); |
2299 ); |
2291 |
2300 |
2377 $css_test_string = str_replace( $css_value, '', $css_test_string ); |
2386 $css_test_string = str_replace( $css_value, '', $css_test_string ); |
2378 } |
2387 } |
2379 } |
2388 } |
2380 |
2389 |
2381 if ( $found ) { |
2390 if ( $found ) { |
2382 // Check for any CSS containing \ ( & } = or comments, except for url() usage checked above. |
2391 // Allow CSS calc(). |
|
2392 $css_test_string = preg_replace( '/calc\(((?:\([^()]*\)?|[^()])*)\)/', '', $css_test_string ); |
|
2393 // Allow CSS var(). |
|
2394 $css_test_string = preg_replace( '/\(?var\(--[a-zA-Z0-9_-]*\)/', '', $css_test_string ); |
|
2395 |
|
2396 // Check for any CSS containing \ ( & } = or comments, |
|
2397 // except for url(), calc(), or var() usage checked above. |
2383 $allow_css = ! preg_match( '%[\\\(&=}]|/\*%', $css_test_string ); |
2398 $allow_css = ! preg_match( '%[\\\(&=}]|/\*%', $css_test_string ); |
2384 |
2399 |
2385 /** |
2400 /** |
2386 * Filters the check for unsafe CSS in `safecss_filter_attr`. |
2401 * Filters the check for unsafe CSS in `safecss_filter_attr`. |
2387 * |
2402 * |