From eb3b3fec1d96f3694079e6ee1915a8903963905a Mon Sep 17 00:00:00 2001 From: Adam Silverstein Date: Wed, 4 Oct 2017 18:58:47 +0000 Subject: [PATCH] Security: Rename new `wp.sanitize.sanitizeText` to `stripTagsAndEncodeText`.' Improve function naming: this function strips tags from a string and also encodes any HTML entities. Props ocean90. Fixes #40635. Built from https://develop.svn.wordpress.org/trunk@41745 git-svn-id: http://core.svn.wordpress.org/trunk@41579 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/js/wp-sanitize.js | 2 +- wp-includes/js/wp-sanitize.min.js | 2 +- wp-includes/version.php | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/wp-includes/js/wp-sanitize.js b/wp-includes/js/wp-sanitize.js index 8063c6b3f6..312dab2719 100644 --- a/wp-includes/js/wp-sanitize.js +++ b/wp-includes/js/wp-sanitize.js @@ -32,7 +32,7 @@ * * @return Sanitized text. False on failure. */ - sanitizeText: function( text ) { + stripTagsAndEncodeText: function( text ) { var _text = wp.sanitize.stripTags( text ), textarea = document.createElement( 'textarea' ); diff --git a/wp-includes/js/wp-sanitize.min.js b/wp-includes/js/wp-sanitize.min.js index 410b2ef66c..5e03657d9c 100644 --- a/wp-includes/js/wp-sanitize.min.js +++ b/wp-includes/js/wp-sanitize.min.js @@ -1 +1 @@ -!function(){window.wp=window.wp||{},wp.sanitize={stripTags:function(a){return a=a||"",a.replace(/|$)/g,"").replace(/<(script|style)[^>]*>[\s\S]*?(<\/\1>|$)/gi,"").replace(/<\/?[a-z][\s\S]*?(>|$)/gi,"")},sanitizeText:function(a){var b=wp.sanitize.stripTags(a),c=document.createElement("textarea");try{c.innerHTML=b,b=wp.sanitize.stripTags(c.value)}catch(d){}return b}}}(); \ No newline at end of file +!function(){window.wp=window.wp||{},wp.sanitize={stripTags:function(a){return a=a||"",a.replace(/|$)/g,"").replace(/<(script|style)[^>]*>[\s\S]*?(<\/\1>|$)/gi,"").replace(/<\/?[a-z][\s\S]*?(>|$)/gi,"")},stripTagsAndEncodeText:function(a){var b=wp.sanitize.stripTags(a),c=document.createElement("textarea");try{c.innerHTML=b,b=wp.sanitize.stripTags(c.value)}catch(d){}return b}}}(); \ No newline at end of file diff --git a/wp-includes/version.php b/wp-includes/version.php index 77514acbc3..bdfbc30e5d 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.9-alpha-41744'; +$wp_version = '4.9-alpha-41745'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.