Add some security hardening to passed playlist attributes.
Props xknown. See #26631. Built from https://develop.svn.wordpress.org/trunk@27311 git-svn-id: http://core.svn.wordpress.org/trunk@27164 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
parent
af4f68b410
commit
7d57ca6c2c
|
@ -1013,6 +1013,10 @@ function wp_get_playlist( $attr, $type ) {
|
||||||
$orderby = 'none';
|
$orderby = 'none';
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if ( ! in_array( $style, array( 'light', 'dark' ), true ) ) {
|
||||||
|
$style = 'light';
|
||||||
|
}
|
||||||
|
|
||||||
$args = array(
|
$args = array(
|
||||||
'post_status' => 'inherit',
|
'post_status' => 'inherit',
|
||||||
'post_type' => 'attachment',
|
'post_type' => 'attachment',
|
||||||
|
@ -1113,13 +1117,16 @@ function wp_get_playlist( $attr, $type ) {
|
||||||
}
|
}
|
||||||
$data['tracks'] = $tracks;
|
$data['tracks'] = $tracks;
|
||||||
|
|
||||||
|
$safe_type = esc_attr( $safe_type );
|
||||||
|
$safe_style = esc_attr( $style );
|
||||||
|
|
||||||
ob_start();
|
ob_start();
|
||||||
|
|
||||||
if ( 1 === $instance ):
|
if ( 1 === $instance ):
|
||||||
wp_enqueue_style( 'wp-mediaelement' );
|
wp_enqueue_style( 'wp-mediaelement' );
|
||||||
wp_enqueue_script( 'wp-playlist' );
|
wp_enqueue_script( 'wp-playlist' );
|
||||||
?>
|
?>
|
||||||
<!--[if lt IE 9]><script>document.createElement('<?php echo $type ?>');</script><![endif]-->
|
<!--[if lt IE 9]><script>document.createElement('<?php echo esc_js( $type ) ?>');</script><![endif]-->
|
||||||
<script type="text/html" id="tmpl-wp-playlist-current-item">
|
<script type="text/html" id="tmpl-wp-playlist-current-item">
|
||||||
<# if ( data.image ) { #>
|
<# if ( data.image ) { #>
|
||||||
<img src="{{{ data.thumb.src }}}"/>
|
<img src="{{{ data.thumb.src }}}"/>
|
||||||
|
@ -1154,11 +1161,11 @@ function wp_get_playlist( $attr, $type ) {
|
||||||
</div>
|
</div>
|
||||||
</script>
|
</script>
|
||||||
<?php endif ?>
|
<?php endif ?>
|
||||||
<div class="wp-playlist wp-<?php echo $type ?>-playlist wp-playlist-<?php echo $style ?>">
|
<div class="wp-playlist wp-<?php echo $safe_type ?>-playlist wp-playlist-<?php echo $safe_style ?>">
|
||||||
<?php if ( 'audio' === $type ): ?>
|
<?php if ( 'audio' === $type ): ?>
|
||||||
<div class="wp-playlist-current-item"></div>
|
<div class="wp-playlist-current-item"></div>
|
||||||
<?php endif ?>
|
<?php endif ?>
|
||||||
<<?php echo $type ?> controls="controls" preload="metadata" width="<?php echo $theme_width ?>"></<?php echo $type ?>>
|
<<?php echo $safe_type ?> controls="controls" preload="metadata" width="<?php echo (int) $theme_width ?>"></<?php echo $safe_type ?>>
|
||||||
<div class="wp-playlist-next"></div>
|
<div class="wp-playlist-next"></div>
|
||||||
<div class="wp-playlist-prev"></div>
|
<div class="wp-playlist-prev"></div>
|
||||||
<noscript>
|
<noscript>
|
||||||
|
|
Loading…
Reference in New Issue