* Introduce wp_kses_allowed_html() which accepts a context string and returns an array of allowed tags.

* Remove explicit declarations of class, id, style, and title from $allowedposttags
 * Dynamicallly add global attributes to every tag for the 'post' context
 * No longer calls wp_kses_array_lc() every time wp_kses() runs. Instead it runs once if CUSTOM_TAGS is true. Plugins directly passing a custom allowed_html array will no longer get the lc treatment. Keep an eye out for problems with this.
 * wp_kses_data() and wp_filter_kses() pass current_filter() for the $allowed_html argument to wp_kses().
 * wp_kses_allowed_html() handles being passed a filter name for a context. If the filter is not a recognized one it defaults to using $allowedtags as was done before for wp_kses_data() and wp_filter_kses().
 * wp_kses_allowed_html() recognizes user_description and pre_user_description out of the box. For these it takes $allowedtags and inserts rel attribute support.
 * wp_kses_allowed_html() allows plugins to override the return values for the default contexts and support arbitrary contexts via a wp_kses_allowed_html filter.
 * wp_kses_hook() can now pass a string context for $allowed_html to the pre_kses filter. We might have to pass the result of wp_kses_allowed_html() instead if it turns out that plugins are digging in $allowed_html.

fixes #17977
see #20210


git-svn-id: http://core.svn.wordpress.org/trunk@21790 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Ryan Boren 2012-09-10 16:19:54 +00:00
parent 67894a3407
commit ffac99eadc
1 changed files with 117 additions and 123 deletions

View File

@ -51,50 +51,42 @@ if ( ! CUSTOM_TAGS ) {
$allowedposttags = array(
'address' => array(),
'a' => array(
'class' => true,
'href' => true,
'id' => true,
'title' => true,
'rel' => true,
'rev' => true,
'name' => true,
'target' => true,
),
'abbr' => array(
'class' => true,
'title' => true,
),
'acronym' => array(
'title' => true,
'abbr' => array(),
'acronym' => array(),
'area' => array(
'alt' => true,
'coords' => true,
'href' => true,
'nohref' => true,
'shape' => true,
'target' => true,
),
'article' => array(
'align' => true,
'class' => true,
'dir' => true,
'lang' => true,
'style' => true,
'xml:lang' => true,
),
'aside' => array(
'align' => true,
'class' => true,
'dir' => true,
'lang' => true,
'style' => true,
'xml:lang' => true,
),
'b' => array(),
'big' => array(),
'blockquote' => array(
'id' => true,
'cite' => true,
'class' => true,
'lang' => true,
'xml:lang' => true,
),
'br' => array (
'class' => true,
),
'br' => array(),
'button' => array(
'disabled' => true,
'name' => true,
@ -103,24 +95,18 @@ if ( ! CUSTOM_TAGS ) {
),
'caption' => array(
'align' => true,
'class' => true,
),
'cite' => array(
'class' => true,
'dir' => true,
'lang' => true,
'title' => true,
),
'code' => array (
'style' => true,
),
'code' => array(),
'col' => array(
'align' => true,
'char' => true,
'charoff' => true,
'span' => true,
'dir' => true,
'style' => true,
'valign' => true,
'width' => true,
),
@ -130,19 +116,15 @@ if ( ! CUSTOM_TAGS ) {
'dd' => array(),
'details' => array(
'align' => true,
'class' => true,
'dir' => true,
'lang' => true,
'open' => true,
'style' => true,
'xml:lang' => true,
),
'div' => array(
'align' => true,
'class' => true,
'dir' => true,
'lang' => true,
'style' => true,
'xml:lang' => true,
),
'dl' => array(),
@ -151,18 +133,14 @@ if ( ! CUSTOM_TAGS ) {
'fieldset' => array(),
'figure' => array(
'align' => true,
'class' => true,
'dir' => true,
'lang' => true,
'style' => true,
'xml:lang' => true,
),
'figcaption' => array(
'align' => true,
'class' => true,
'dir' => true,
'lang' => true,
'style' => true,
'xml:lang' => true,
),
'font' => array(
@ -172,10 +150,8 @@ if ( ! CUSTOM_TAGS ) {
),
'footer' => array(
'align' => true,
'class' => true,
'dir' => true,
'lang' => true,
'style' => true,
'xml:lang' => true,
),
'form' => array(
@ -189,59 +165,36 @@ if ( ! CUSTOM_TAGS ) {
),
'h1' => array(
'align' => true,
'class' => true,
'id' => true,
'style' => true,
),
'h2' => array(
'align' => true,
'class' => true,
'id' => true,
'style' => true,
),
'h3' => array(
'align' => true,
'class' => true,
'id' => true,
'style' => true,
),
'h4' => array(
'align' => true,
'class' => true,
'id' => true,
'style' => true,
),
'h5' => array(
'align' => true,
'class' => true,
'id' => true,
'style' => true,
),
'h6' => array(
'align' => true,
'class' => true,
'id' => true,
'style' => true,
),
'header' => array(
'align' => true,
'class' => true,
'dir' => true,
'lang' => true,
'style' => true,
'xml:lang' => true,
),
'hgroup' => array(
'align' => true,
'class' => true,
'dir' => true,
'lang' => true,
'style' => true,
'xml:lang' => true,
),
'hr' => array(
'align' => true,
'class' => true,
'noshade' => true,
'size' => true,
'width' => true,
@ -251,13 +204,12 @@ if ( ! CUSTOM_TAGS ) {
'alt' => true,
'align' => true,
'border' => true,
'class' => true,
'height' => true,
'hspace' => true,
'longdesc' => true,
'vspace' => true,
'src' => true,
'style' => true,
'usemap' => true,
'width' => true,
),
'ins' => array(
@ -273,31 +225,26 @@ if ( ! CUSTOM_TAGS ) {
),
'li' => array(
'align' => true,
'class' => true,
),
'map' => array(
'name' => true,
),
'menu' => array(
'class' => true,
'style' => true,
'type' => true,
),
'nav' => array(
'align' => true,
'class' => true,
'dir' => true,
'lang' => true,
'style' => true,
'xml:lang' => true,
),
'p' => array(
'class' => true,
'align' => true,
'dir' => true,
'lang' => true,
'style' => true,
'xml:lang' => true,
),
'pre' => array(
'style' => true,
'width' => true,
),
'q' => array(
@ -305,20 +252,15 @@ if ( ! CUSTOM_TAGS ) {
),
's' => array(),
'span' => array(
'class' => true,
'dir' => true,
'align' => true,
'lang' => true,
'style' => true,
'title' => true,
'xml:lang' => true,
),
'section' => array(
'align' => true,
'class' => true,
'dir' => true,
'lang' => true,
'style' => true,
'xml:lang' => true,
),
'small' => array(),
@ -327,10 +269,8 @@ if ( ! CUSTOM_TAGS ) {
'sub' => array(),
'summary' => array(
'align' => true,
'class' => true,
'dir' => true,
'lang' => true,
'style' => true,
'xml:lang' => true,
),
'sup' => array(),
@ -340,11 +280,8 @@ if ( ! CUSTOM_TAGS ) {
'border' => true,
'cellpadding' => true,
'cellspacing' => true,
'class' => true,
'dir' => true,
'id' => true,
'rules' => true,
'style' => true,
'summary' => true,
'width' => true,
),
@ -361,7 +298,6 @@ if ( ! CUSTOM_TAGS ) {
'bgcolor' => true,
'char' => true,
'charoff' => true,
'class' => true,
'colspan' => true,
'dir' => true,
'headers' => true,
@ -369,7 +305,6 @@ if ( ! CUSTOM_TAGS ) {
'nowrap' => true,
'rowspan' => true,
'scope' => true,
'style' => true,
'valign' => true,
'width' => true,
),
@ -383,7 +318,6 @@ if ( ! CUSTOM_TAGS ) {
'tfoot' => array(
'align' => true,
'char' => true,
'class' => true,
'charoff' => true,
'valign' => true,
),
@ -394,7 +328,6 @@ if ( ! CUSTOM_TAGS ) {
'bgcolor' => true,
'char' => true,
'charoff' => true,
'class' => true,
'colspan' => true,
'headers' => true,
'height' => true,
@ -408,7 +341,6 @@ if ( ! CUSTOM_TAGS ) {
'align' => true,
'char' => true,
'charoff' => true,
'class' => true,
'valign' => true,
),
'title' => array(),
@ -417,21 +349,15 @@ if ( ! CUSTOM_TAGS ) {
'bgcolor' => true,
'char' => true,
'charoff' => true,
'class' => true,
'style' => true,
'valign' => true,
),
'tt' => array(),
'u' => array(),
'ul' => array(
'class' => true,
'style' => true,
'type' => true,
),
'ol' => array(
'class' => true,
'start' => true,
'style' => true,
'type' => true,
),
'var' => array(),
@ -467,7 +393,8 @@ if ( ! CUSTOM_TAGS ) {
// 'dd' => array(),
// 'dl' => array(),
// 'dt' => array(),
'em' => array (), 'i' => array (),
'em' => array(),
'i' => array(),
// 'ins' => array('datetime' => array(), 'cite' => array()),
// 'li' => array(),
// 'ol' => array(),
@ -526,6 +453,11 @@ if ( ! CUSTOM_TAGS ) {
'sdot', 'lceil', 'rceil', 'lfloor', 'rfloor', 'lang',
'rang', 'loz', 'spades', 'clubs', 'hearts', 'diams',
);
$allowedposttags = array_map( '_wp_add_global_attributes', $allowedposttags );
} else {
$allowedtags = wp_kses_array_lc( $allowedtags );
$allowedposttags = wp_kses_array_lc( $allowedposttags );
}
/**
@ -554,9 +486,45 @@ function wp_kses($string, $allowed_html, $allowed_protocols = array ()) {
$string = wp_kses_no_null($string);
$string = wp_kses_js_entities($string);
$string = wp_kses_normalize_entities($string);
$allowed_html_fixed = wp_kses_array_lc($allowed_html);
$string = wp_kses_hook($string, $allowed_html_fixed, $allowed_protocols); // WP changed the order of these funcs and added args to wp_kses_hook
return wp_kses_split($string, $allowed_html_fixed, $allowed_protocols);
$string = wp_kses_hook($string, $allowed_html, $allowed_protocols); // WP changed the order of these funcs and added args to wp_kses_hook
return wp_kses_split($string, $allowed_html, $allowed_protocols);
}
/**
* Return a list of allowed tags and attributes for a given context.
*
* @since 3.5.0
*
* @param string $context The context for which to retrieve tags. Allowed values are
* post | strip | data | entities or the name of a field filter such as pre_user_description.
* @return array List of allowed tags and their allowed attributes.
*/
function wp_kses_allowed_html( $context = '' ) {
global $allowedposttags, $allowedtags, $allowedentitynames;
if ( is_array( $context ) )
return apply_filters( 'wp_kses_allowed_html', $context, 'explicit' );
switch ( $context ) {
case 'post':
return apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
break;
case 'user_description':
case 'pre_user_description':
$tags = $allowedtags;
$tags['a']['rel'] = true;
return apply_filters( 'wp_kses_allowed_html', $tags, $context );
break;
case 'strip':
return apply_filters( 'wp_kses_allowed_html', array(), $context );
break;
case 'entities':
return apply_filters( 'wp_kses_allowed_html', $allowedentitynames, $context);
break;
case 'data':
default:
return apply_filters( 'wp_kses_allowed_html', $allowedtags, $context );
}
}
/**
@ -668,6 +636,9 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) {
$elem = $matches[2];
$attrlist = $matches[3];
if ( ! is_array( $allowed_html ) )
$allowed_html = wp_kses_allowed_html( $allowed_html );
if ( ! isset($allowed_html[strtolower($elem)]) )
return '';
# They are using a not allowed HTML element
@ -699,6 +670,9 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) {
function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) {
# Is there a closing XHTML slash at the end of the attributes?
if ( ! is_array( $allowed_html ) )
$allowed_html = wp_kses_allowed_html( $allowed_html );
$xhtml_slash = '';
if (preg_match('%\s*/\s*$%', $attr))
$xhtml_slash = ' /';
@ -1287,8 +1261,7 @@ function _wp_kses_decode_entities_chr_hexdec( $match ) {
* @return string Filtered content
*/
function wp_filter_kses( $data ) {
global $allowedtags;
return addslashes( wp_kses(stripslashes( $data ), $allowedtags) );
return addslashes( wp_kses( stripslashes( $data ), current_filter() ) );
}
/**
@ -1301,8 +1274,7 @@ function wp_filter_kses($data) {
* @return string Filtered content
*/
function wp_kses_data( $data ) {
global $allowedtags;
return wp_kses( $data , $allowedtags );
return wp_kses( $data , current_filter() );
}
/**
@ -1312,14 +1284,12 @@ function wp_kses_data($data) {
* data from forms.
*
* @since 2.0.0
* @uses $allowedposttags
*
* @param string $data Post content to filter, expected to be escaped with slashes
* @return string Filtered post content with allowed HTML tags and attributes intact.
*/
function wp_filter_post_kses($data) {
global $allowedposttags;
return addslashes ( wp_kses(stripslashes( $data ), $allowedposttags) );
return addslashes ( wp_kses( stripslashes( $data ), 'post' ) );
}
/**
@ -1329,14 +1299,12 @@ function wp_filter_post_kses($data) {
* data from forms.
*
* @since 2.9.0
* @uses $allowedposttags
*
* @param string $data Post content to filter
* @return string Filtered post content with allowed HTML tags and attributes intact.
*/
function wp_kses_post($data) {
global $allowedposttags;
return wp_kses( $data , $allowedposttags );
return wp_kses( $data , 'post' );
}
/**
@ -1348,7 +1316,7 @@ function wp_kses_post($data) {
* @return string Filtered content without any HTML
*/
function wp_filter_nohtml_kses( $data ) {
return addslashes ( wp_kses(stripslashes( $data ), array()) );
return addslashes ( wp_kses( stripslashes( $data ), 'strip' ) );
}
/**
@ -1484,3 +1452,29 @@ function safecss_filter_attr( $css, $deprecated = '' ) {
return $css;
}
/**
* Helper function to add global attributes to a tag in the allowed html list.
*
* @since 3.5.0
* @access private
*
* @param array $value An array of attributes.
* @return array The array of attributes with global attributes added.
*/
function _wp_add_global_attributes( $value ) {
$global_attributes = array(
'class' => true,
'id' => true,
'style' => true,
'title' => true,
);
if ( true === $value )
$value = array();
if ( is_array( $value ) )
return array_merge( $value, $global_attributes );
return $value;
}