From 9ff54f214f045ae9f4b003347f32940ae3094bfa Mon Sep 17 00:00:00 2001 From: Gary Pendergast Date: Wed, 26 Oct 2016 05:17:35 +0000 Subject: [PATCH] General: Add a `sanitize_textarea_field()` function. Like its predecessor (`sanitize_text_field()`), `sanitize_textarea_field()` is a helper function to sanitise user input. As the name suggests, this function is for sanitising input from `textarea` fields - it strips tags and invalid UTF-8 characters, like `sanitize_text_field()`, but retains newlines and extra inline whitespace. Props ottok, nbachiyski, chriscct7, pento. Fixes #32257. Built from https://develop.svn.wordpress.org/trunk@38944 git-svn-id: http://core.svn.wordpress.org/trunk@38887 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/formatting.php | 76 ++++++++++++++++++++++++++++++++------ wp-includes/version.php | 2 +- 2 files changed, 65 insertions(+), 13 deletions(-) diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php index e10051861e..165cb19f2a 100644 --- a/wp-includes/formatting.php +++ b/wp-includes/formatting.php @@ -4653,6 +4653,7 @@ function wp_strip_all_tags($string, $remove_breaks = false) { * * @since 2.9.0 * + * @see sanitize_textarea_field() * @see wp_check_invalid_utf8() * @see wp_strip_all_tags() * @@ -4660,16 +4661,75 @@ function wp_strip_all_tags($string, $remove_breaks = false) { * @return string Sanitized string. */ function sanitize_text_field( $str ) { + $filtered = _sanitize_text_fields( $str, false ); + + /** + * Filters a sanitized text field string. + * + * @since 2.9.0 + * + * @param string $filtered The sanitized string. + * @param string $str The string prior to being sanitized. + */ + return apply_filters( 'sanitize_text_field', $filtered, $str ); +} + +/** + * Sanitizes a multiline string from user input or from the database. + * + * The function is like sanitize_text_field(), but preserves + * new lines (\n) and other whitespace, which are legitimate + * input in textarea elements. + * + * @see sanitize_text_field() + * + * @since 4.7.0 + * + * @param string $str String to sanitize. + * @return string Sanitized string. + */ +function sanitize_textarea_field( $str ) { + $filtered = _sanitize_text_fields( $str, true ); + + /** + * Filters a sanitized textarea field string. + * + * @since 4.7.0 + * + * @param string $filtered The sanitized string. + * @param string $str The string prior to being sanitized. + */ + return apply_filters( 'sanitize_textarea_field', $filtered, $str ); +} + +/** + * Internal helper function to sanitize a string from user input or from the db + * + * @since 4.7.0 + * @access private + * + * @param string $str String to sanitize. + * @param bool $keep_newlines optional Whether to keep newlines. Default: false. + * @return string Sanitized string. + */ +function _sanitize_text_fields( $str, $keep_newlines = false ) { $filtered = wp_check_invalid_utf8( $str ); if ( strpos($filtered, '<') !== false ) { $filtered = wp_pre_kses_less_than( $filtered ); // This will strip extra whitespace for us. - $filtered = wp_strip_all_tags( $filtered, true ); - } else { - $filtered = trim( preg_replace('/[\r\n\t ]+/', ' ', $filtered) ); + $filtered = wp_strip_all_tags( $filtered, false ); + + // Use html entities in a special case to make sure no later + // newline stripping stage could lead to a functional tag + $filtered = str_replace("<\n", "<\n", $filtered); } + if ( ! $keep_newlines ) { + $filtered = preg_replace( '/[\r\n\t ]+/', ' ', $filtered ); + } + $filtered = trim( $filtered ); + $found = false; while ( preg_match('/%[a-f0-9]{2}/i', $filtered, $match) ) { $filtered = str_replace($match[0], '', $filtered); @@ -4681,15 +4741,7 @@ function sanitize_text_field( $str ) { $filtered = trim( preg_replace('/ +/', ' ', $filtered) ); } - /** - * Filters a sanitized text field string. - * - * @since 2.9.0 - * - * @param string $filtered The sanitized string. - * @param string $str The string prior to being sanitized. - */ - return apply_filters( 'sanitize_text_field', $filtered, $str ); + return $filtered; } /** diff --git a/wp-includes/version.php b/wp-includes/version.php index d67ecd238a..a6efb52303 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.7-alpha-38943'; +$wp_version = '4.7-alpha-38944'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.