link_name = attribute_escape(apply_filters('link_title', $link->link_name));
- $link->link_description = wp_specialchars(apply_filters('link_description', $link->link_description));
- $link->link_url = clean_url($link->link_url);
+ $link = sanitize_bookmark($link);
+ $link->link_name = attribute_escape($link->link_name);
$link->link_category = wp_get_link_cats($link->link_id);
$short_url = str_replace('http://', '', $link->link_url);
$short_url = str_replace('www.', '', $short_url);
@@ -159,8 +158,8 @@ if ( $links ) {
?>link_category as $category) {
- $cat = get_term($category, 'link_category');
- $cat_name = wp_specialchars(apply_filters('link_category', $cat->name));
+ $cat = get_term($category, 'link_category', OBJECT, 'display');
+ $cat_name = $cat->name;
if ( $cat_id != $category )
$cat_name = "$cat_name";
$cat_names[] = $cat_name;
diff --git a/wp-includes/bookmark.php b/wp-includes/bookmark.php
index d04cad3b5e..bb851cfb89 100644
--- a/wp-includes/bookmark.php
+++ b/wp-includes/bookmark.php
@@ -1,12 +1,14 @@
get_row("SELECT * FROM $wpdb->links WHERE link_id = '$bookmark_id'");
$link->link_category = wp_get_link_cats($bookmark_id);
+ $link = sanitize_bookmark($link, $filter);
+
if ( $output == OBJECT ) {
return $link;
} elseif ( $output == ARRAY_A ) {
@@ -18,6 +20,22 @@ function get_bookmark($bookmark_id, $output = OBJECT) {
}
}
+function get_bookmark_field( $field, $bookmark, $context = 'display' ) {
+ $bookmark = (int) $bookmark;
+ $bookmark = get_bookmark( $bookmark );
+
+ if ( is_wp_error($bookmark) )
+ return $bookmark;
+
+ if ( !is_object($bookmark) )
+ return '';
+
+ if ( !isset($bookmark->$field) )
+ return '';
+
+ return sanitize_bookmark_field($field, $bookmark->$field, $bookmark->link_id, $context);
+}
+
// Deprecate
function get_link($bookmark_id, $output = OBJECT) {
return get_bookmark($bookmark_id, $output);
@@ -142,6 +160,67 @@ function get_bookmarks($args = '') {
return apply_filters('get_bookmarks', $results, $r);
}
+function sanitize_bookmark($bookmark, $context = 'display') {
+ $fields = array('link_id', 'link_url', 'link_name', 'link_image', 'link_target', 'link_category',
+ 'link_description', 'link_visible', 'link_owner', 'link_rating', 'link_updated',
+ 'link_rel', 'link_notes', 'link_rss', );
+
+ $do_object = false;
+ if ( is_object($bookmark) )
+ $do_object = true;
+
+ foreach ( $fields as $field ) {
+ if ( $do_object )
+ $bookmark->$field = sanitize_bookmark_field($field, $bookmark->$field, $bookmark->link_id, $context);
+ else
+ $bookmark[$field] = sanitize_bookmark_field($field, $bookmark[$field], $bookmark['link_id'], $context);
+ }
+
+ return $bookmark;
+}
+
+function sanitize_bookmark_field($field, $value, $bookmark_id, $context) {
+ $int_fields = array('link_id', 'link_rating');
+ if ( in_array($field, $int_fields) )
+ $value = (int) $value;
+
+ $yesno = array('link_visible');
+ if ( in_array($field, $yesno) )
+ $value = preg_replace('/[^YNyn]/', '', $value);
+
+ if ( 'link_target' == $field ) {
+ $targets = array('_top', '_blank');
+ if ( ! in_array($value, $targets) )
+ $value = '';
+ }
+
+ if ( 'raw' == $context )
+ return $value;
+
+ if ( 'edit' == $context ) {
+ $format_to_edit = array('link_notes');
+ $value = apply_filters("edit_$field", $value, $bookmark_id);
+
+ if ( in_array($field, $format_to_edit) ) {
+ $value = format_to_edit($value);
+ } else {
+ $value = attribute_escape($value);
+ }
+ } else if ( 'db' == $context ) {
+ $value = apply_filters("pre_$field", $value);
+ } else {
+ // Use display filters by default.
+ $value = apply_filters($field, $value, $bookmark_id, $context);
+ }
+
+ if ( 'attribute' == $context )
+ $value = attribute_escape($value);
+ else if ( 'js' == $context )
+ $value = js_escape($value);
+
+ return $value;
+}
+
function delete_get_bookmark_cache() {
wp_cache_delete( 'get_bookmarks', 'bookmark' );
}
diff --git a/wp-includes/default-filters.php b/wp-includes/default-filters.php
index 59892793d7..380669ef8f 100644
--- a/wp-includes/default-filters.php
+++ b/wp-includes/default-filters.php
@@ -1,142 +1,82 @@
\ No newline at end of file
diff --git a/wp-includes/post.php b/wp-includes/post.php
index 0e4070d715..cf5d228ccb 100644
--- a/wp-includes/post.php
+++ b/wp-includes/post.php
@@ -477,7 +477,10 @@ function sanitize_post_field($field, $value, $post_id, $context) {
}
} else {
// Use display filters by default.
- $value = apply_filters("post_$field", $value, $post_id, $context);
+ if ( $prefixed )
+ $value = apply_filters($field, $value, $post_id, $context);
+ else
+ $value = apply_filters("post_$field", $value, $post_id, $context);
}
if ( 'attribute' == $context )
diff --git a/wp-includes/taxonomy.php b/wp-includes/taxonomy.php
index 07805d7bda..b12708e37f 100644
--- a/wp-includes/taxonomy.php
+++ b/wp-includes/taxonomy.php
@@ -229,7 +229,7 @@ function get_objects_in_term( $terms, $taxonomies, $args = array() ) {
* This won't appear but just a note to say that this is all conjecture and parts or whole
* might be inaccurate or wrong.
*/
-function &get_term(&$term, $taxonomy, $output = OBJECT) {
+function &get_term(&$term, $taxonomy, $output = OBJECT, $filter = 'raw') {
global $wpdb;
if ( empty($term) )
@@ -251,6 +251,7 @@ function &get_term(&$term, $taxonomy, $output = OBJECT) {
$_term = apply_filters('get_term', $_term, $taxonomy);
$_term = apply_filters("get_$taxonomy", $_term, $taxonomy);
+ $_term = sanitize_term($_term, $taxonomy, $filter);
if ( $output == OBJECT ) {
return $_term;
@@ -559,7 +560,7 @@ function is_term($term, $taxonomy = '') {
}
function sanitize_term($term, $taxonomy, $context = 'display') {
- $fields = array('term_id', 'name', 'description', 'slug', 'count', 'term_group');
+ $fields = array('term_id', 'name', 'description', 'slug', 'count', 'parent', 'term_group');
$do_object = false;
if ( is_object($term) )
|