IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Escape links by default. Props alexkingorg. see #13051

Browse Source 
git-svn-id: http://svn.automattic.com/wordpress/trunk@14347 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
ryan
2010-05-02 22:53:59 +00:00
parent 3213eab0f8
commit 91354eefee
36 changed files with 186 additions and 140 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-includes/comment-template.php
+1 -1
View File
@@ -1032,7 +1032,7 @@ function get_comment_reply_link($args = array(), $comment = null, $post = null)
$link = '';
if ( get_option('comment_registration') && !$user_ID )
$link = '<a rel="nofollow" class="comment-reply-login" href="' . esc_url( wp_login_url( get_permalink() ) ) . '">' . $login_text . '</a>';
$link = '<a rel="nofollow" class="comment-reply-login" href="' . wp_login_url( get_permalink() ) . '">' . $login_text . '</a>';
else
$link = "<a rel='nofollow' class='comment-reply-link' href='" . esc_url( add_query_arg( 'replytocom', $comment->comment_ID ) ) . "#" . $respond_id . "' onclick='return addComment.moveForm(\"$add_below-$comment->comment_ID\", \"$comment->comment_ID\", \"$respond_id\", \"$post->ID\")'>$reply_text</a>";
return apply_filters('comment_reply_link', $before . $link . $after, $args, $comment, $post);
wp-includes/default-widgets.php
+1 -1
View File
@@ -644,7 +644,7 @@ class WP_Widget_Recent_Comments extends WP_Widget {
<?php if ( $title ) echo $before_title . $title . $after_title; ?>
<ul id="recentcomments"><?php
if ( $comments ) : foreach ( (array) $comments as $comment) :
echo '<li class="recentcomments">' . /* translators: comments widget: 1: comment author, 2: post link */ sprintf(_x('%1$s on %2$s', 'widgets'), get_comment_author_link(), '<a href="' . esc_url( get_comment_link($comment->comment_ID) ) . '">' . get_the_title($comment->comment_post_ID) . '</a>') . '</li>';
echo '<li class="recentcomments">' . /* translators: comments widget: 1: comment author, 2: post link */ sprintf(_x('%1$s on %2$s', 'widgets'), get_comment_author_link(), '<a href="' . get_comment_link($comment->comment_ID) . '">' . get_the_title($comment->comment_post_ID) . '</a>') . '</li>';
endforeach; endif;?></ul>
<?php echo $after_widget; ?>
<?php
wp-includes/general-template.php
+4 -4
View File
@@ -184,9 +184,9 @@ function get_search_form($echo = true) {
*/
function wp_loginout($redirect = '', $echo = true) {
if ( ! is_user_logged_in() )
$link = '<a href="' . esc_url( wp_login_url($redirect) ) . '">' . __('Log in') . '</a>';
$link = '<a href="' . wp_login_url($redirect) . '">' . __('Log in') . '</a>';
else
$link = '<a href="' . esc_url( wp_logout_url($redirect) ) . '">' . __('Log out') . '</a>';
$link = '<a href="' . wp_logout_url($redirect) . '">' . __('Log out') . '</a>';
if ( $echo )
echo apply_filters('loginout', $link);
@@ -2111,9 +2111,9 @@ function wp_admin_css( $file = 'wp-admin', $force_echo = false ) {
return;
}
echo apply_filters( 'wp_admin_css', "<link rel='stylesheet' href='" . esc_url( wp_admin_css_uri( $file ) ) . "' type='text/css' />\n", $file );
echo apply_filters( 'wp_admin_css', "<link rel='stylesheet' href='" . wp_admin_css_uri( $file ) . "' type='text/css' />\n", $file );
if ( 'rtl' == get_bloginfo( 'text_direction' ) )
echo apply_filters( 'wp_admin_css', "<link rel='stylesheet' href='" . esc_url( wp_admin_css_uri( "$file-rtl" ) ) . "' type='text/css' />\n", "$file-rtl" );
echo apply_filters( 'wp_admin_css', "<link rel='stylesheet' href='" . wp_admin_css_uri( "$file-rtl" ) . "' type='text/css' />\n", "$file-rtl" );
}
/**
wp-includes/link-template.php
+70 -24
View File
@@ -1824,8 +1824,8 @@ function get_shortcut_link() {
* @param string $scheme (optional) Scheme to give the home url context. Currently 'http','https'
* @return string Home url link with optional path appended.
*/
function home_url( $path = '', $scheme = null ) {
return get_home_url(null, $path, $scheme);
function home_url( $path = '', $scheme = null, $esc_url = true ) {
return get_home_url(null, $path, $scheme, $esc_url);
}
/**
@@ -1843,7 +1843,7 @@ function home_url( $path = '', $scheme = null ) {
* @param string $scheme (optional) Scheme to give the home url context. Currently 'http','https'
* @return string Home url link with optional path appended.
*/
function get_home_url( $blog_id = null, $path = '', $scheme = null ) {
function get_home_url( $blog_id = null, $path = '', $scheme = null, $esc_url = true ) {
$orig_scheme = $scheme;
if ( !in_array($scheme, array('http', 'https')) )
@@ -1859,7 +1859,12 @@ function get_home_url( $blog_id = null, $path = '', $scheme = null ) {
if ( !empty( $path ) && is_string( $path ) && strpos( $path, '..' ) === false )
$url .= '/' . ltrim( $path, '/' );
return apply_filters( 'home_url', $url, $path, $orig_scheme, $blog_id );
$url = apply_filters( 'home_url', $url, $path, $orig_scheme, $blog_id );
if ( $esc_url )
$url = esc_url($url);
return $url;
}
/**
@@ -1878,8 +1883,8 @@ function get_home_url( $blog_id = null, $path = '', $scheme = null ) {
* @param string $scheme Optional. Scheme to give the site url context. Currently 'http','https', 'login', 'login_post', or 'admin'.
* @return string Site url link with optional path appended.
*/
function site_url( $path = '', $scheme = null ) {
return get_site_url(null, $path, $scheme);
function site_url( $path = '', $scheme = null, $esc_url = true ) {
return get_site_url(null, $path, $scheme, $esc_url);
}
/**
@@ -1897,7 +1902,7 @@ function site_url( $path = '', $scheme = null ) {
* @param string $scheme Optional. Scheme to give the site url context. Currently 'http','https', 'login', 'login_post', or 'admin'.
* @return string Site url link with optional path appended.
*/
function get_site_url( $blog_id = null, $path = '', $scheme = null ) {
function get_site_url( $blog_id = null, $path = '', $scheme = null, $esc_url = true ) {
// should the list of allowed schemes be maintained elsewhere?
$orig_scheme = $scheme;
if ( !in_array($scheme, array('http', 'https')) ) {
@@ -1921,7 +1926,12 @@ function get_site_url( $blog_id = null, $path = '', $scheme = null ) {
if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
$url .= '/' . ltrim($path, '/');
return apply_filters('site_url', $url, $path, $orig_scheme, $blog_id);
$url = apply_filters('site_url', $url, $path, $orig_scheme, $blog_id);
if ( $esc_url )
$url = esc_url($url);
return $url;
}
/**
@@ -1934,8 +1944,8 @@ function get_site_url( $blog_id = null, $path = '', $scheme = null ) {
* @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl(). 'http' or 'https' can be passed to force those schemes.
* @return string Admin url link with optional path appended
*/
function admin_url( $path = '', $scheme = 'admin' ) {
return get_admin_url(null, $path, $scheme);
function admin_url( $path = '', $scheme = 'admin', $esc_url = true ) {
return get_admin_url(null, $path, $scheme, $esc_url);
}
/**
@@ -1949,13 +1959,18 @@ function admin_url( $path = '', $scheme = 'admin' ) {
* @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl(). 'http' or 'https' can be passed to force those schemes.
* @return string Admin url link with optional path appended
*/
function get_admin_url( $blog_id = null, $path = '', $scheme = 'admin' ) {
function get_admin_url( $blog_id = null, $path = '', $scheme = 'admin', $esc_url = true ) {
$url = get_site_url($blog_id, 'wp-admin/', $scheme);
if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
$url .= ltrim($path, '/');
return apply_filters('admin_url', $url, $path, $blog_id);
$url = apply_filters('admin_url', $url, $path, $blog_id);
if ( $esc_url )
$url = esc_url($url);
return $url;
}
/**
@@ -1967,13 +1982,18 @@ function get_admin_url( $blog_id = null, $path = '', $scheme = 'admin' ) {
* @param string $path Optional. Path relative to the includes url.
* @return string Includes url link with optional path appended.
*/
function includes_url($path = '') {
function includes_url($path = '', $esc_url = true) {
$url = site_url() . '/' . WPINC . '/';
if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
$url .= ltrim($path, '/');
return apply_filters('includes_url', $url, $path);
$url = apply_filters('includes_url', $url, $path);
if ( $esc_url )
$url = esc_url($url);
return $url;
}
/**
@@ -1985,7 +2005,7 @@ function includes_url($path = '') {
* @param string $path Optional. Path relative to the content url.
* @return string Content url link with optional path appended.
*/
function content_url($path = '') {
function content_url($path = '', $esc_url = true) {
$url = WP_CONTENT_URL;
if ( 0 === strpos($url, 'http') && is_ssl() )
$url = str_replace( 'http://', 'https://', $url );
@@ -1993,7 +2013,12 @@ function content_url($path = '') {
if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
$url .= '/' . ltrim($path, '/');
return apply_filters('content_url', $url, $path);
$url = apply_filters('content_url', $url, $path);
if ( $esc_url )
$url = esc_url($url);
return $url;
}
/**
@@ -2007,7 +2032,7 @@ function content_url($path = '') {
* @param string $plugin Optional. The plugin file that you want to be relative to - i.e. pass in __FILE__
* @return string Plugins url link with optional path appended.
*/
function plugins_url($path = '', $plugin = '') {
function plugins_url($path = '', $plugin = '', $esc_url = true) {
$mu_plugin_dir = WPMU_PLUGIN_DIR;
foreach ( array('path', 'plugin', 'mu_plugin_dir') as $var ) {
@@ -2032,7 +2057,13 @@ function plugins_url($path = '', $plugin = '') {
if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
$url .= '/' . ltrim($path, '/');
return apply_filters('plugins_url', $url, $path, $plugin);
$url = apply_filters('plugins_url', $url, $path, $plugin);
if ( $esc_url )
$url = esc_url($url);
return $url;
}
/**
@@ -2049,7 +2080,7 @@ function plugins_url($path = '', $plugin = '') {
* @param string $scheme Optional. Scheme to give the site url context. Currently 'http','https', 'login', 'login_post', or 'admin'.
* @return string Site url link with optional path appended.
*/
function network_site_url( $path = '', $scheme = null ) {
function network_site_url( $path = '', $scheme = null, $esc_url = true ) {
global $current_site;
if ( !is_multisite() )
@@ -2074,7 +2105,12 @@ function network_site_url( $path = '', $scheme = null ) {
if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
$url .= ltrim($path, '/');
return apply_filters('network_site_url', $url, $path, $orig_scheme);
$url = apply_filters('network_site_url', $url, $path, $orig_scheme);
if ( $esc_url )
$url = esc_url($url);
return $url;
}
/**
@@ -2091,7 +2127,7 @@ function network_site_url( $path = '', $scheme = null ) {
* @param string $scheme (optional) Scheme to give the home url context. Currently 'http','https'
* @return string Home url link with optional path appended.
*/
function network_home_url( $path = '', $scheme = null ) {
function network_home_url( $path = '', $scheme = null, $esc_url = true ) {
global $current_site;
if ( !is_multisite() )
@@ -2109,7 +2145,12 @@ function network_home_url( $path = '', $scheme = null ) {
if ( !empty( $path ) && is_string( $path ) && strpos( $path, '..' ) === false )
$url .= ltrim( $path, '/' );
return apply_filters( 'network_home_url', $url, $path, $orig_scheme);
$url = apply_filters( 'network_home_url', $url, $path, $orig_scheme);
if ( $esc_url )
$url = esc_url($url);
return $url;
}
/**
@@ -2122,13 +2163,18 @@ function network_home_url( $path = '', $scheme = null ) {
* @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl(). 'http' or 'https' can be passed to force those schemes.
* @return string Admin url link with optional path appended
*/
function network_admin_url( $path = '', $scheme = 'admin' ) {
function network_admin_url( $path = '', $scheme = 'admin', $esc_url = true ) {
$url = network_site_url('wp-admin/', $scheme);
if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
$url .= ltrim($path, '/');
return apply_filters('network_admin_url', $url, $path);
$url = apply_filters('network_admin_url', $url, $path);
if ( $esc_url )
$url = esc_url($url);
return $url;
}
/**
wp-includes/ms-functions.php
+2 -2
View File
@@ -852,7 +852,7 @@ function newblog_notify_siteadmin( $blog_id, $deprecated = '' ) {
if ( is_email($email) == false )
return false;
$options_site_url = esc_url(network_admin_url('ms-options.php'));
$options_site_url = network_admin_url('ms-options.php');
switch_to_blog( $blog_id );
$blogname = get_option( 'blogname' );
@@ -881,7 +881,7 @@ function newuser_notify_siteadmin( $user_id ) {
$user = new WP_User($user_id);
$options_site_url = esc_url(network_admin_url('ms-options.php'));
$options_site_url = network_admin_url('ms-options.php');
$msg = sprintf(__('New User: %1s
Remote IP: %2s