WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* Introduce wp_kses_allowed_html() which accepts a context string and returns an array of allowed tags. 

* Remove explicit declarations of class, id, style, and title from $allowedposttags
 * Dynamicallly add global attributes to every tag for the 'post' context
 * No longer calls wp_kses_array_lc() every time wp_kses() runs. Instead it runs once if CUSTOM_TAGS is true. Plugins directly passing a custom allowed_html array will no longer get the lc treatment. Keep an eye out for problems with this.
 * wp_kses_data() and wp_filter_kses() pass current_filter() for the $allowed_html argument to wp_kses().
 * wp_kses_allowed_html() handles being passed a filter name for a context. If the filter is not a recognized one it defaults to using $allowedtags as was done before for wp_kses_data() and wp_filter_kses().
 * wp_kses_allowed_html() recognizes user_description and pre_user_description out of the box. For these it takes $allowedtags and inserts rel attribute support.
 * wp_kses_allowed_html() allows plugins to override the return values for the default contexts and support arbitrary contexts via a wp_kses_allowed_html filter.
 * wp_kses_hook() can now pass a string context for $allowed_html to the pre_kses filter. We might have to pass the result of wp_kses_allowed_html() instead if it turns out that plugins are digging in $allowed_html.

fixes #17977
see #20210


git-svn-id: http://core.svn.wordpress.org/trunk@21790 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Ryan Boren 2012-09-10 16:19:54 +00:00
parent 67894a3407
commit ffac99eadc
1 changed files with 117 additions and 123 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

240
wp-includes/kses.php
View File

@ -51,50 +51,42 @@ if ( ! CUSTOM_TAGS ) {
$allowedposttags = array( $allowedposttags = array(
'address' => array(), 'address' => array(),
'a' => array( 'a' => array(
'class' => true,
'href' => true, 'href' => true,
'id' => true,
'title' => true,
'rel' => true, 'rel' => true,
'rev' => true, 'rev' => true,
'name' => true, 'name' => true,
'target' => true, 'target' => true,
), ),
'abbr' => array( 'abbr' => array(),
'class' => true, 'acronym' => array(),
'title' => true, 'area' => array(
), 'alt' => true,
'acronym' => array( 'coords' => true,
'title' => true, 'href' => true,
'nohref' => true,
'shape' => true,
'target' => true,
), ),
'article' => array( 'article' => array(
'align' => true, 'align' => true,
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'aside' => array( 'aside' => array(
'align' => true, 'align' => true,
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'b' => array(), 'b' => array(),
'big' => array(), 'big' => array(),
'blockquote' => array( 'blockquote' => array(
'id' => true,
'cite' => true, 'cite' => true,
'class' => true,
'lang' => true, 'lang' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'br' => array ( 'br' => array(),
'class' => true,
),
'button' => array( 'button' => array(
'disabled' => true, 'disabled' => true,
'name' => true, 'name' => true,
@ -103,24 +95,18 @@ if ( ! CUSTOM_TAGS ) {
), ),
'caption' => array( 'caption' => array(
'align' => true, 'align' => true,
'class' => true,
), ),
'cite' => array ( 'cite' => array(
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'title' => true,
),
'code' => array (
'style' => true,
), ),
'code' => array(),
'col' => array( 'col' => array(
'align' => true, 'align' => true,
'char' => true, 'char' => true,
'charoff' => true, 'charoff' => true,
'span' => true, 'span' => true,
'dir' => true, 'dir' => true,
'style' => true,
'valign' => true, 'valign' => true,
'width' => true, 'width' => true,
), ),
@ -130,19 +116,15 @@ if ( ! CUSTOM_TAGS ) {
'dd' => array(), 'dd' => array(),
'details' => array( 'details' => array(
'align' => true, 'align' => true,
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'open' => true, 'open' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'div' => array( 'div' => array(
'align' => true, 'align' => true,
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'dl' => array(), 'dl' => array(),
@ -151,18 +133,14 @@ if ( ! CUSTOM_TAGS ) {
'fieldset' => array(), 'fieldset' => array(),
'figure' => array( 'figure' => array(
'align' => true, 'align' => true,
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'figcaption' => array( 'figcaption' => array(
'align' => true, 'align' => true,
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'font' => array( 'font' => array(
@ -172,10 +150,8 @@ if ( ! CUSTOM_TAGS ) {
), ),
'footer' => array( 'footer' => array(
'align' => true, 'align' => true,
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'form' => array( 'form' => array(
@ -189,59 +165,36 @@ if ( ! CUSTOM_TAGS ) {
), ),
'h1' => array( 'h1' => array(
'align' => true, 'align' => true,
'class' => true,
'id' => true,
'style' => true,
), ),
'h2' => array ( 'h2' => array(
'align' => true, 'align' => true,
'class' => true,
'id' => true,
'style' => true,
), ),
'h3' => array ( 'h3' => array(
'align' => true, 'align' => true,
'class' => true,
'id' => true,
'style' => true,
), ),
'h4' => array ( 'h4' => array(
'align' => true, 'align' => true,
'class' => true,
'id' => true,
'style' => true,
), ),
'h5' => array ( 'h5' => array(
'align' => true, 'align' => true,
'class' => true,
'id' => true,
'style' => true,
), ),
'h6' => array ( 'h6' => array(
'align' => true, 'align' => true,
'class' => true,
'id' => true,
'style' => true,
), ),
'header' => array( 'header' => array(
'align' => true, 'align' => true,
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'hgroup' => array( 'hgroup' => array(
'align' => true, 'align' => true,
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'hr' => array ( 'hr' => array(
'align' => true, 'align' => true,
'class' => true,
'noshade' => true, 'noshade' => true,
'size' => true, 'size' => true,
'width' => true, 'width' => true,
@ -251,13 +204,12 @@ if ( ! CUSTOM_TAGS ) {
'alt' => true, 'alt' => true,
'align' => true, 'align' => true,
'border' => true, 'border' => true,
'class' => true,
'height' => true, 'height' => true,
'hspace' => true, 'hspace' => true,
'longdesc' => true, 'longdesc' => true,
'vspace' => true, 'vspace' => true,
'src' => true, 'src' => true,
'style' => true, 'usemap' => true,
'width' => true, 'width' => true,
), ),
'ins' => array( 'ins' => array(
@ -271,54 +223,44 @@ if ( ! CUSTOM_TAGS ) {
'legend' => array( 'legend' => array(
'align' => true, 'align' => true,
), ),
'li' => array ( 'li' => array(
'align' => true, 'align' => true,
'class' => true,
), ),
'menu' => array ( 'map' => array(
'class' => true, 'name' => true,
'style' => true, ),
'menu' => array(
'type' => true, 'type' => true,
), ),
'nav' => array( 'nav' => array(
'align' => true, 'align' => true,
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'p' => array( 'p' => array(
'class' => true,
'align' => true, 'align' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'pre' => array( 'pre' => array(
'style' => true,
'width' => true, 'width' => true,
), ),
'q' => array( 'q' => array(
'cite' => true, 'cite' => true,
), ),
's' => array(), 's' => array(),
'span' => array ( 'span' => array(
'class' => true,
'dir' => true, 'dir' => true,
'align' => true, 'align' => true,
'lang' => true, 'lang' => true,
'style' => true,
'title' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'section' => array( 'section' => array(
'align' => true, 'align' => true,
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'small' => array(), 'small' => array(),
@ -327,10 +269,8 @@ if ( ! CUSTOM_TAGS ) {
'sub' => array(), 'sub' => array(),
'summary' => array( 'summary' => array(
'align' => true, 'align' => true,
'class' => true,
'dir' => true, 'dir' => true,
'lang' => true, 'lang' => true,
'style' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'sup' => array(), 'sup' => array(),
@ -340,11 +280,8 @@ if ( ! CUSTOM_TAGS ) {
'border' => true, 'border' => true,
'cellpadding' => true, 'cellpadding' => true,
'cellspacing' => true, 'cellspacing' => true,
'class' => true,
'dir' => true, 'dir' => true,
'id' => true,
'rules' => true, 'rules' => true,
'style' => true,
'summary' => true, 'summary' => true,
'width' => true, 'width' => true,
), ),
@ -361,7 +298,6 @@ if ( ! CUSTOM_TAGS ) {
'bgcolor' => true, 'bgcolor' => true,
'char' => true, 'char' => true,
'charoff' => true, 'charoff' => true,
'class' => true,
'colspan' => true, 'colspan' => true,
'dir' => true, 'dir' => true,
'headers' => true, 'headers' => true,
@ -369,7 +305,6 @@ if ( ! CUSTOM_TAGS ) {
'nowrap' => true, 'nowrap' => true,
'rowspan' => true, 'rowspan' => true,
'scope' => true, 'scope' => true,
'style' => true,
'valign' => true, 'valign' => true,
'width' => true, 'width' => true,
), ),
@ -383,7 +318,6 @@ if ( ! CUSTOM_TAGS ) {
'tfoot' => array( 'tfoot' => array(
'align' => true, 'align' => true,
'char' => true, 'char' => true,
'class' => true,
'charoff' => true, 'charoff' => true,
'valign' => true, 'valign' => true,
), ),
@ -394,7 +328,6 @@ if ( ! CUSTOM_TAGS ) {
'bgcolor' => true, 'bgcolor' => true,
'char' => true, 'char' => true,
'charoff' => true, 'charoff' => true,
'class' => true,
'colspan' => true, 'colspan' => true,
'headers' => true, 'headers' => true,
'height' => true, 'height' => true,
@ -408,7 +341,6 @@ if ( ! CUSTOM_TAGS ) {
'align' => true, 'align' => true,
'char' => true, 'char' => true,
'charoff' => true, 'charoff' => true,
'class' => true,
'valign' => true, 'valign' => true,
), ),
'title' => array(), 'title' => array(),
@ -417,21 +349,15 @@ if ( ! CUSTOM_TAGS ) {
'bgcolor' => true, 'bgcolor' => true,
'char' => true, 'char' => true,
'charoff' => true, 'charoff' => true,
'class' => true,
'style' => true,
'valign' => true, 'valign' => true,
), ),
'tt' => array(), 'tt' => array(),
'u' => array(), 'u' => array(),
'ul' => array ( 'ul' => array(
'class' => true,
'style' => true,
'type' => true, 'type' => true,
), ),
'ol' => array ( 'ol' => array(
'class' => true,
'start' => true, 'start' => true,
'style' => true,
'type' => true, 'type' => true,
), ),
'var' => array(), 'var' => array(),
@ -467,7 +393,8 @@ if ( ! CUSTOM_TAGS ) {
// 'dd' => array(), // 'dd' => array(),
// 'dl' => array(), // 'dl' => array(),
// 'dt' => array(), // 'dt' => array(),
'em' => array (), 'i' => array (), 'em' => array(),
'i' => array(),
// 'ins' => array('datetime' => array(), 'cite' => array()), // 'ins' => array('datetime' => array(), 'cite' => array()),
// 'li' => array(), // 'li' => array(),
// 'ol' => array(), // 'ol' => array(),
@ -526,6 +453,11 @@ if ( ! CUSTOM_TAGS ) {
'sdot', 'lceil', 'rceil', 'lfloor', 'rfloor', 'lang', 'sdot', 'lceil', 'rceil', 'lfloor', 'rfloor', 'lang',
'rang', 'loz', 'spades', 'clubs', 'hearts', 'diams', 'rang', 'loz', 'spades', 'clubs', 'hearts', 'diams',
); );
$allowedposttags = array_map( '_wp_add_global_attributes', $allowedposttags );
} else {
$allowedtags = wp_kses_array_lc( $allowedtags );
$allowedposttags = wp_kses_array_lc( $allowedposttags );
} }
/** /**
@ -548,15 +480,51 @@ if ( ! CUSTOM_TAGS ) {
* @param array $allowed_protocols Optional. Allowed protocol in links. * @param array $allowed_protocols Optional. Allowed protocol in links.
* @return string Filtered content with only allowed HTML elements * @return string Filtered content with only allowed HTML elements
*/ */
function wp_kses($string, $allowed_html, $allowed_protocols = array ()) { function wp_kses( $string, $allowed_html, $allowed_protocols = array() ) {
if ( empty( $allowed_protocols ) ) if ( empty( $allowed_protocols ) )
$allowed_protocols = wp_allowed_protocols(); $allowed_protocols = wp_allowed_protocols();
$string = wp_kses_no_null($string); $string = wp_kses_no_null($string);
$string = wp_kses_js_entities($string); $string = wp_kses_js_entities($string);
$string = wp_kses_normalize_entities($string); $string = wp_kses_normalize_entities($string);
$allowed_html_fixed = wp_kses_array_lc($allowed_html); $string = wp_kses_hook($string, $allowed_html, $allowed_protocols); // WP changed the order of these funcs and added args to wp_kses_hook
$string = wp_kses_hook($string, $allowed_html_fixed, $allowed_protocols); // WP changed the order of these funcs and added args to wp_kses_hook return wp_kses_split($string, $allowed_html, $allowed_protocols);
return wp_kses_split($string, $allowed_html_fixed, $allowed_protocols); }
/**
* Return a list of allowed tags and attributes for a given context.
*
* @since 3.5.0
*
* @param string $context The context for which to retrieve tags. Allowed values are
* post | strip | data | entities or the name of a field filter such as pre_user_description.
* @return array List of allowed tags and their allowed attributes.
*/
function wp_kses_allowed_html( $context = '' ) {
global $allowedposttags, $allowedtags, $allowedentitynames;
if ( is_array( $context ) )
return apply_filters( 'wp_kses_allowed_html', $context, 'explicit' );
switch ( $context ) {
case 'post':
return apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
break;
case 'user_description':
case 'pre_user_description':
$tags = $allowedtags;
$tags['a']['rel'] = true;
return apply_filters( 'wp_kses_allowed_html', $tags, $context );
break;
case 'strip':
return apply_filters( 'wp_kses_allowed_html', array(), $context );
break;
case 'entities':
return apply_filters( 'wp_kses_allowed_html', $allowedentitynames, $context);
break;
case 'data':
default:
return apply_filters( 'wp_kses_allowed_html', $allowedtags, $context );
}
} }
/** /**
@ -572,7 +540,7 @@ function wp_kses($string, $allowed_html, $allowed_protocols = array ()) {
* @param array $allowed_protocols Allowed protocol in links * @param array $allowed_protocols Allowed protocol in links
* @return string Filtered content through 'pre_kses' hook * @return string Filtered content through 'pre_kses' hook
*/ */
function wp_kses_hook($string, $allowed_html, $allowed_protocols) { function wp_kses_hook( $string, $allowed_html, $allowed_protocols ) {
$string = apply_filters('pre_kses', $string, $allowed_html, $allowed_protocols); $string = apply_filters('pre_kses', $string, $allowed_html, $allowed_protocols);
return $string; return $string;
} }
@ -600,7 +568,7 @@ function wp_kses_version() {
* @param array $allowed_protocols Allowed protocols to keep * @param array $allowed_protocols Allowed protocols to keep
* @return string Content with fixed HTML tags * @return string Content with fixed HTML tags
*/ */
function wp_kses_split($string, $allowed_html, $allowed_protocols) { function wp_kses_split( $string, $allowed_html, $allowed_protocols ) {
global $pass_allowed_html, $pass_allowed_protocols; global $pass_allowed_html, $pass_allowed_protocols;
$pass_allowed_html = $allowed_html; $pass_allowed_html = $allowed_html;
$pass_allowed_protocols = $allowed_protocols; $pass_allowed_protocols = $allowed_protocols;
@ -668,6 +636,9 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) {
$elem = $matches[2]; $elem = $matches[2];
$attrlist = $matches[3]; $attrlist = $matches[3];
if ( ! is_array( $allowed_html ) )
$allowed_html = wp_kses_allowed_html( $allowed_html );
if ( ! isset($allowed_html[strtolower($elem)]) ) if ( ! isset($allowed_html[strtolower($elem)]) )
return ''; return '';
# They are using a not allowed HTML element # They are using a not allowed HTML element
@ -699,6 +670,9 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) {
function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) { function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) {
# Is there a closing XHTML slash at the end of the attributes? # Is there a closing XHTML slash at the end of the attributes?
if ( ! is_array( $allowed_html ) )
$allowed_html = wp_kses_allowed_html( $allowed_html );
$xhtml_slash = ''; $xhtml_slash = '';
if (preg_match('%\s*/\s*$%', $attr)) if (preg_match('%\s*/\s*$%', $attr))
$xhtml_slash = ' /'; $xhtml_slash = ' /';
@ -777,7 +751,7 @@ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) {
* @return array List of attributes after parsing * @return array List of attributes after parsing
*/ */
function wp_kses_hair($attr, $allowed_protocols) { function wp_kses_hair($attr, $allowed_protocols) {
$attrarr = array (); $attrarr = array();
$mode = 0; $mode = 0;
$attrname = ''; $attrname = '';
$uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action'); $uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
@ -1286,9 +1260,8 @@ function _wp_kses_decode_entities_chr_hexdec( $match ) {
* @param string $data Content to filter, expected to be escaped with slashes * @param string $data Content to filter, expected to be escaped with slashes
* @return string Filtered content * @return string Filtered content
*/ */
function wp_filter_kses($data) { function wp_filter_kses( $data ) {
global $allowedtags; return addslashes( wp_kses( stripslashes( $data ), current_filter() ) );
return addslashes( wp_kses(stripslashes( $data ), $allowedtags) );
} }
/** /**
@ -1300,9 +1273,8 @@ function wp_filter_kses($data) {
* @param string $data Content to filter, expected to not be escaped * @param string $data Content to filter, expected to not be escaped
* @return string Filtered content * @return string Filtered content
*/ */
function wp_kses_data($data) { function wp_kses_data( $data ) {
global $allowedtags; return wp_kses( $data , current_filter() );
return wp_kses( $data , $allowedtags );
} }
/** /**
@ -1312,14 +1284,12 @@ function wp_kses_data($data) {
* data from forms. * data from forms.
* *
* @since 2.0.0 * @since 2.0.0
* @uses $allowedposttags
* *
* @param string $data Post content to filter, expected to be escaped with slashes * @param string $data Post content to filter, expected to be escaped with slashes
* @return string Filtered post content with allowed HTML tags and attributes intact. * @return string Filtered post content with allowed HTML tags and attributes intact.
*/ */
function wp_filter_post_kses($data) { function wp_filter_post_kses($data) {
global $allowedposttags; return addslashes ( wp_kses( stripslashes( $data ), 'post' ) );
return addslashes ( wp_kses(stripslashes( $data ), $allowedposttags) );
} }
/** /**
@ -1329,14 +1299,12 @@ function wp_filter_post_kses($data) {
* data from forms. * data from forms.
* *
* @since 2.9.0 * @since 2.9.0
* @uses $allowedposttags
* *
* @param string $data Post content to filter * @param string $data Post content to filter
* @return string Filtered post content with allowed HTML tags and attributes intact. * @return string Filtered post content with allowed HTML tags and attributes intact.
*/ */
function wp_kses_post($data) { function wp_kses_post($data) {
global $allowedposttags; return wp_kses( $data , 'post' );
return wp_kses( $data , $allowedposttags );
} }
/** /**
@ -1347,8 +1315,8 @@ function wp_kses_post($data) {
* @param string $data Content to strip all HTML from * @param string $data Content to strip all HTML from
* @return string Filtered content without any HTML * @return string Filtered content without any HTML
*/ */
function wp_filter_nohtml_kses($data) { function wp_filter_nohtml_kses( $data ) {
return addslashes ( wp_kses(stripslashes( $data ), array()) ); return addslashes ( wp_kses( stripslashes( $data ), 'strip' ) );
} }
/** /**
@ -1484,3 +1452,29 @@ function safecss_filter_attr( $css, $deprecated = '' ) {
return $css; return $css;
} }
/**
* Helper function to add global attributes to a tag in the allowed html list.
*
* @since 3.5.0
* @access private
*
* @param array $value An array of attributes.
* @return array The array of attributes with global attributes added.
*/
function _wp_add_global_attributes( $value ) {
$global_attributes = array(
'class' => true,
'id' => true,
'style' => true,
'title' => true,
);
if ( true === $value )
$value = array();
if ( is_array( $value ) )
return array_merge( $value, $global_attributes );
return $value;
}