Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-06-25 22:35:02 +02:00
Code Issues Projects Releases Wiki Activity

Add kses protocol checking to clean_url. Props Andy. fixes #3515

Browse Source 
git-svn-id: http://svn.automattic.com/wordpress/trunk@4672 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
ryan 2007-01-02 21:22:41 +00:00
parent 716e89b369
commit f5c184f843
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
wp-includes/formatting.php
View File

@ -1056,7 +1056,7 @@ function wp_richedit_pre($text) {
return apply_filters('richedit_pre', $output);
}
function clean_url( $url ) {
function clean_url( $url, $protocols = null ) {
if ('' == $url) return $url;
$url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%]|i', '', $url);
$strip = array('%0d', '%0a');
@ -1064,6 +1064,10 @@ function clean_url( $url ) {
$url = str_replace(';//', '://', $url);
$url = (!strstr($url, '://')) ? 'http://'.$url : $url;
$url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
if ( !is_array($protocols) )
$protocols = array('http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet');
if ( wp_kses_bad_protocol( $url, $protocols ) != $url )
return '';
return $url;
}