IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Filter fields through kses upon display. Introduce sanitize_user_object() and sanitize_user_field(). see #10751

Browse Source 
git-svn-id: http://svn.automattic.com/wordpress/trunk@11929 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
ryan
2009-09-14 13:57:48 +00:00
parent 3709397168
commit aa1e377ede
9 changed files with 260 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-includes/capabilities.php
+9
View File
@@ -448,6 +448,15 @@ class WP_User {
*/
var $last_name = '';
/**
* The filter context applied to user data fields.
*
* @since 2.9.0
* @access private
* @var string
*/
var $filter = null;
/**
* PHP4 Constructor - Sets up the object properties.
*
wp-includes/default-filters.php
+21 -9
View File
@@ -17,19 +17,26 @@ $filters = array('pre_term_name', 'pre_comment_author_name', 'pre_link_name', 'p
'pre_link_rel', 'pre_user_display_name', 'pre_user_first_name', 'pre_user_last_name',
'pre_user_nickname');
foreach ( $filters as $filter ) {
add_filter($filter, 'strip_tags');
add_filter($filter, 'trim');
add_filter($filter, 'sanitize_text_field');
add_filter($filter, 'wp_filter_kses');
add_filter($filter, '_wp_specialchars', 30);
}
// Kses only for textarea saves
$filters = array('pre_term_description', 'pre_link_description', 'pre_link_notes', 'pre_user_description');
// Strip, kses, special chars for string display
$filters = array('term_name', 'comment_author_name', 'link_name', 'link_target', 'link_rel', 'user_display_name', 'user_first_name', 'user_last_name', 'user_nickname');
foreach ( $filters as $filter ) {
add_filter($filter, 'sanitize_text_field');
add_filter($filter, 'wp_filter_kses');
add_filter($filter, '_wp_specialchars', 30);
}
// Kses only for textarea saves and displays
$filters = array('pre_term_description', 'term_description', 'pre_link_description', 'link_description', 'pre_link_notes', 'link_notes', 'pre_user_description', 'user_description');
foreach ( $filters as $filter ) {
add_filter($filter, 'wp_filter_kses');
}
// Email
// Email saves
$filters = array('pre_comment_author_email', 'pre_user_email');
foreach ( $filters as $filter ) {
add_filter($filter, 'trim');
@@ -37,12 +44,18 @@ foreach ( $filters as $filter ) {
add_filter($filter, 'wp_filter_kses');
}
// Email display
$filters = array('comment_author_email', 'user_email');
foreach ( $filters as $filter ) {
add_filter($filter, 'sanitize_email');
add_filter($filter, 'wp_filter_kses');
}
// Save URL
$filters = array('pre_comment_author_url', 'pre_user_url', 'pre_link_url', 'pre_link_image',
'pre_link_rss');
foreach ( $filters as $filter ) {
add_filter($filter, 'strip_tags');
add_filter($filter, 'trim');
add_filter($filter, 'wp_strip_all_tags');
add_filter($filter, 'esc_url_raw');
add_filter($filter, 'wp_filter_kses');
}
@@ -50,8 +63,7 @@ foreach ( $filters as $filter ) {
// Display URL
$filters = array('user_url', 'link_url', 'link_image', 'link_rss', 'comment_url');
foreach ( $filters as $filter ) {
add_filter($filter, 'strip_tags');
add_filter($filter, 'trim');
add_filter($filter, 'wp_strip_all_tags');
add_filter($filter, 'esc_url');
add_filter($filter, 'wp_filter_kses');
}
wp-includes/formatting.php
+53 -3
View File
@@ -628,7 +628,7 @@ function sanitize_file_name( $filename ) {
*/
function sanitize_user( $username, $strict = false ) {
$raw_username = $username;
$username = strip_tags($username);
$username = wp_strip_all_tags($username);
// Kill octets
$username = preg_replace('|%([a-fA-F0-9][a-fA-F0-9])|', '', $username);
$username = preg_replace('/&.+?;/', '', $username); // Kill entities
@@ -2245,7 +2245,6 @@ function esc_html( $text ) {
$safe_text = wp_check_invalid_utf8( $text );
$safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );
return apply_filters( 'esc_html', $safe_text, $text );
return $text;
}
/**
@@ -2601,7 +2600,7 @@ function wp_sprintf_l($pattern, $args) {
* @return string The excerpt.
*/
function wp_html_excerpt( $str, $count ) {
$str = strip_tags( $str );
$str = wp_strip_all_tags( $str, true );
$str = mb_substr( $str, 0, $count );
// remove part of an entity at the end
$str = preg_replace( '/&[^;\s]{0,6}$/', '', $str );
@@ -2668,6 +2667,7 @@ function links_add_target( $content, $target = '_blank', $tags = array('a') ) {
create_function('$m', 'return _links_add_target($m, "' . $target . '");'),
$content);
}
/**
* Callback to add a target attribute to all links in passed content.
*
@@ -2692,4 +2692,54 @@ function normalize_whitespace( $str ) {
return $str;
}
/**
* Properly strip all HTML tags including script and style
*
* @since 2.9.0
*
* @param string $string String containing HTML tags
* @param bool $remove_breaks optional Whether to remove left over line breaks and white space chars
* @return string The processed string.
*/
function wp_strip_all_tags($string, $remove_breaks = false) {
$string = preg_replace( '@<(script|style)[^>]*?>.*?</\\1>@si', '', $string );
$string = strip_tags($string);
if ( $remove_breaks )
$string = preg_replace('/\s+/', ' ', $string);
return trim($string);
}
/**
* Sanitize a string from user input or from the db
*
* check for invalid UTF-8,
* Convert single < characters to entity,
* strip all tags,
* remove line breaks, tabs and extra whitre space,
* strip octets.
*
* @since 2.9
*
* @param string $str
* @return string
*/
function sanitize_text_field($str) {
$filtered = wp_check_invalid_utf8( $str );
if ( strpos($filtered, '<') !== false ) {
$filtered = wp_pre_kses_less_than( $filtered );
$filtered = wp_strip_all_tags( $filtered, true );
} else {
$filtered = trim( preg_replace('/\s+/', ' ', $filtered) );
}
$match = array();
while ( preg_match('/%[a-f0-9]{2}/i', $filtered, $match) )
$filtered = str_replace($match[0], '', $filtered);
return apply_filters('sanitize_text_field', $filtered, $str);
}
?>
wp-includes/registration.php
+4 -3
View File
@@ -169,7 +169,7 @@ function wp_insert_user($userdata) {
$user_nicename_check = $wpdb->get_var( $wpdb->prepare("SELECT ID FROM $wpdb->users WHERE user_nicename = %s AND user_login != %s LIMIT 1" , $user_nicename, $user_login));
if ($user_nicename_check) {
if ( $user_nicename_check ) {
$suffix = 2;
while ($user_nicename_check) {
$alt_user_nicename = $user_nicename . "-$suffix";
@@ -198,10 +198,11 @@ function wp_insert_user($userdata) {
update_usermeta( $user_id, 'comment_shortcuts', $comment_shortcuts);
update_usermeta( $user_id, 'admin_color', $admin_color);
update_usermeta( $user_id, 'use_ssl', $use_ssl);
foreach (_wp_get_user_contactmethods() as $method => $name) {
foreach ( _wp_get_user_contactmethods() as $method => $name ) {
if ( empty($$method) )
$$method = '';
update_usermeta( $user_id, $method, $$method );
}
wp-includes/user.php
+117
View File
@@ -617,4 +617,121 @@ function _fill_user( &$user ) {
wp_cache_add($user->user_nicename, $user->ID, 'userslugs');
}
/**
* Sanitize every user field.
*
* If the context is 'raw', then the user object or array will get minimal santization of the int fields.
*
* @since 2.3.0
* @uses sanitize_user_field() Used to sanitize the fields.
*
* @param object|array $user The User Object or Array
* @param string $context Optional, default is 'display'. How to sanitize user fields.
* @return object|array The now sanitized User Object or Array (will be the same type as $user)
*/
function sanitize_user_object($user, $context = 'display') {
if ( is_object($user) ) {
if ( !isset($user->ID) )
$user->ID = 0;
if ( isset($user->data) )
$vars = get_object_vars( $user->data );
else
$vars = get_object_vars($user);
foreach ( array_keys($vars) as $field ) {
if ( is_array($user->$field) )
continue;
$user->$field = sanitize_user_field($field, $user->$field, $user->ID, $context);
}
$user->filter = $context;
} else {
if ( !isset($user['ID']) )
$user['ID'] = 0;
foreach ( array_keys($user) as $field )
$user[$field] = sanitize_user_field($field, $user[$field], $user['ID'], $context);
$user['filter'] = $context;
}
return $user;
}
/**
* Sanitize user field based on context.
*
* Possible context values are: 'raw', 'edit', 'db', 'display', 'attribute' and 'js'. The
* 'display' context is used by default. 'attribute' and 'js' contexts are treated like 'display'
* when calling filters.
*
* @since 2.3.0
* @uses apply_filters() Calls 'edit_$field' and '${field_no_prefix}_edit_pre' passing $value and
* $user_id if $context == 'edit' and field name prefix == 'user_'.
*
* @uses apply_filters() Calls 'edit_user_$field' passing $value and $user_id if $context == 'db'.
* @uses apply_filters() Calls 'pre_$field' passing $value if $context == 'db' and field name prefix == 'user_'.
* @uses apply_filters() Calls '${field}_pre' passing $value if $context == 'db' and field name prefix != 'user_'.
*
* @uses apply_filters() Calls '$field' passing $value, $user_id and $context if $context == anything
* other than 'raw', 'edit' and 'db' and field name prefix == 'user_'.
* @uses apply_filters() Calls 'user_$field' passing $value if $context == anything other than 'raw',
* 'edit' and 'db' and field name prefix != 'user_'.
*
* @param string $field The user Object field name.
* @param mixed $value The user Object value.
* @param int $user_id user ID.
* @param string $context How to sanitize user fields. Looks for 'raw', 'edit', 'db', 'display',
* 'attribute' and 'js'.
* @return mixed Sanitized value.
*/
function sanitize_user_field($field, $value, $user_id, $context) {
$int_fields = array('ID');
if ( in_array($field, $int_fields) )
$value = (int) $value;
if ( 'raw' == $context )
return $value;
if ( is_array($value) )
return $value;
$prefixed = false;
if ( false !== strpos($field, 'user_') ) {
$prefixed = true;
$field_no_prefix = str_replace('user_', '', $field);
}
if ( 'edit' == $context ) {
if ( $prefixed ) {
$value = apply_filters("edit_$field", $value, $user_id);
} else {
$value = apply_filters("edit_user_$field", $value, $user_id);
}
if ( 'description' == $field )
$value = esc_html($value);
else
$value = esc_attr($value);
} else if ( 'db' == $context ) {
if ( $prefixed ) {
$value = apply_filters("pre_$field", $value);
} else {
$value = apply_filters("pre_user_$field", $value);
}
} else {
// Use display filters by default.
if ( $prefixed )
$value = apply_filters($field, $value, $user_id, $context);
else
$value = apply_filters("user_$field", $value, $user_id, $context);
}
if ( 'user_url' == $field )
$value = esc_url($value);
if ( 'attribute' == $context )
$value = esc_attr($value);
else if ( 'js' == $context )
$value = esc_js($value);
return $value;
}
?>