HostForge-Systems/wordpress
Template
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Deprecate sanitize_url() and clean_url() in favor of esc_url_raw() and esc_url()

Browse Source 
git-svn-id: http://svn.automattic.com/wordpress/trunk@11383 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
markjaquith
2009-05-18 16:00:33 +00:00
parent 05c7b40a29
commit 3ebf837ced
45 changed files with 159 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
wp-includes/bookmark-template.php
View File

@@ -70,7 +70,7 @@ function _walk_bookmarks($bookmarks, $args = '' ) {
$the_link = '#';
if ( !empty($bookmark->link_url) )
$the_link = clean_url($bookmark->link_url);
$the_link = esc_url($bookmark->link_url);
$desc = esc_attr(sanitize_bookmark_field('link_description', $bookmark->link_description, $bookmark->link_id, 'display'));
$name = esc_attr(sanitize_bookmark_field('link_name', $bookmark->link_name, $bookmark->link_id, 'display'));

2
wp-includes/category-template.php
View File

@@ -659,7 +659,7 @@ function wp_generate_tag_cloud( $tags, $args = '' ) {
foreach ( $tags as $key => $tag ) {
$count = $counts[ $key ];
$tag_link = '#' != $tag->link ? clean_url( $tag->link ) : '#';
$tag_link = '#' != $tag->link ? esc_url( $tag->link ) : '#';
$tag_id = isset($tags[ $key ]->id) ? $tags[ $key ]->id : $key;
$tag_name = $tags[ $key ]->name;
$a[] = "<a href='$tag_link' class='tag-link-$tag_id' title='" . esc_attr( $topic_count_text_callback( $count ) ) . "'$rel style='font-size: " .

2
wp-includes/class.wp-scripts.php
View File

@@ -115,7 +115,7 @@ class WP_Scripts extends WP_Dependencies {
}
$src = add_query_arg('ver', $ver, $src);
$src = clean_url(apply_filters( 'script_loader_src', $src, $handle ));
$src = esc_url(apply_filters( 'script_loader_src', $src, $handle ));
if ( $this->do_concat )
$this->print_html .= "<script type='text/javascript' src='$src'></script>\n";

2
wp-includes/class.wp-styles.php
View File

@@ -102,7 +102,7 @@ class WP_Styles extends WP_Dependencies {
$src = add_query_arg('ver', $ver, $src);
$src = apply_filters( 'style_loader_src', $src, $handle );
return clean_url( $src );
return esc_url( $src );
}
function in_default_dir($src) {

4
wp-includes/comment-template.php
View File

@@ -995,9 +995,9 @@ function get_comment_reply_link($args = array(), $comment = null, $post = null)
$link = '';
if ( get_option('comment_registration') && !$user_ID )
$link = '<a rel="nofollow" class="comment-reply-login" href="' . clean_url( wp_login_url( get_permalink() ) ) . '">' . $login_text . '</a>';
$link = '<a rel="nofollow" class="comment-reply-login" href="' . esc_url( wp_login_url( get_permalink() ) ) . '">' . $login_text . '</a>';
else
$link = "<a rel='nofollow' class='comment-reply-link' href='" . clean_url( add_query_arg( 'replytocom', $comment->comment_ID ) ) . "#" . $respond_id . "' onclick='return addComment.moveForm(\"$add_below-$comment->comment_ID\", \"$comment->comment_ID\", \"$respond_id\", \"$post->ID\")'>$reply_text</a>";
$link = "<a rel='nofollow' class='comment-reply-link' href='" . esc_url( add_query_arg( 'replytocom', $comment->comment_ID ) ) . "#" . $respond_id . "' onclick='return addComment.moveForm(\"$add_below-$comment->comment_ID\", \"$comment->comment_ID\", \"$respond_id\", \"$post->ID\")'>$reply_text</a>";
return apply_filters('comment_reply_link', $before . $link . $after, $args, $comment, $post);
}

4
wp-includes/default-filters.php
View File

@@ -43,7 +43,7 @@ $filters = array('pre_comment_author_url', 'pre_user_url', 'pre_link_url', 'pre_
foreach ( $filters as $filter ) {
add_filter($filter, 'strip_tags');
add_filter($filter, 'trim');
add_filter($filter, 'sanitize_url');
add_filter($filter, 'esc_url_raw');
add_filter($filter, 'wp_filter_kses');
}
@@ -52,7 +52,7 @@ $filters = array('user_url', 'link_url', 'link_image', 'link_rss', 'comment_url'
foreach ( $filters as $filter ) {
add_filter($filter, 'strip_tags');
add_filter($filter, 'trim');
add_filter($filter, 'clean_url');
add_filter($filter, 'esc_url');
add_filter($filter, 'wp_filter_kses');
}

14
wp-includes/default-widgets.php
View File

@@ -659,7 +659,7 @@ class WP_Widget_Recent_Comments extends WP_Widget {
<?php if ( $title ) echo $before_title . $title . $after_title; ?>
<ul id="recentcomments"><?php
if ( $comments ) : foreach ( (array) $comments as $comment) :
echo '<li class="recentcomments">' . /* translators: comments widget: 1: comment author, 2: post link */ sprintf(_x('%1$s on %2$s', 'widgets'), get_comment_author_link(), '<a href="' . clean_url( get_comment_link($comment->comment_ID) ) . '">' . get_the_title($comment->comment_post_ID) . '</a>') . '</li>';
echo '<li class="recentcomments">' . /* translators: comments widget: 1: comment author, 2: post link */ sprintf(_x('%1$s on %2$s', 'widgets'), get_comment_author_link(), '<a href="' . esc_url( get_comment_link($comment->comment_ID) ) . '">' . get_the_title($comment->comment_post_ID) . '</a>') . '</li>';
endforeach; endif;?></ul>
<?php echo $after_widget; ?>
<?php
@@ -730,7 +730,7 @@ class WP_Widget_RSS extends WP_Widget {
$desc = esc_attr(strip_tags(@html_entity_decode($rss->get_description(), ENT_QUOTES, get_option('blog_charset'))));
if ( empty($title) )
$title = htmlentities(strip_tags($rss->get_title()));
$link = clean_url(strip_tags($rss->get_permalink()));
$link = esc_url(strip_tags($rss->get_permalink()));
while ( stristr($link, 'http') != $link )
$link = substr($link, 1);
}
@@ -739,7 +739,7 @@ class WP_Widget_RSS extends WP_Widget {
$title = empty($desc) ? __('Unknown Feed') : $desc;
$title = apply_filters('widget_title', $title );
$url = clean_url(strip_tags($url));
$url = esc_url(strip_tags($url));
$icon = includes_url('images/rss.png');
if ( $title )
$title = "<a class='rsswidget' href='$url' title='" . esc_attr(__('Syndicate this content')) ."'><img style='background:orange;color:white;border:none;' width='14' height='14' src='$icon' alt='RSS' /></a> <a class='rsswidget' href='$link' title='$desc'>$title</a>";
@@ -813,7 +813,7 @@ function wp_widget_rss_output( $rss, $args = array() ) {
$link = $item->get_link();
while ( stristr($link, 'http') != $link )
$link = substr($link, 1);
$link = clean_url(strip_tags($link));
$link = esc_url(strip_tags($link));
$title = esc_attr(strip_tags($item->get_title()));
if ( empty($title) )
$title = __('Untitled');
@@ -879,7 +879,7 @@ function wp_widget_rss_form( $args, $inputs = null ) {
$number = esc_attr( $number );
$title = esc_attr( $title );
$url = clean_url( $url );
$url = esc_url( $url );
$items = (int) $items;
if ( $items < 1 || 20 < $items )
$items = 10;
@@ -958,7 +958,7 @@ function wp_widget_rss_process( $widget_rss, $check_feed = true ) {
$items = (int) $widget_rss['items'];
if ( $items < 1 || 20 < $items )
$items = 10;
$url = sanitize_url(strip_tags( $widget_rss['url'] ));
$url = esc_url_raw(strip_tags( $widget_rss['url'] ));
$title = trim(strip_tags( $widget_rss['title'] ));
$show_summary = (int) $widget_rss['show_summary'];
$show_author = (int) $widget_rss['show_author'];
@@ -971,7 +971,7 @@ function wp_widget_rss_process( $widget_rss, $check_feed = true ) {
if ( is_wp_error($rss) ) {
$error = $rss->get_error_message();
} else {
$link = clean_url(strip_tags($rss->get_permalink()));
$link = esc_url(strip_tags($rss->get_permalink()));
while ( stristr($link, 'http') != $link )
$link = substr($link, 1);
}

2
wp-includes/deprecated.php
View File

@@ -1001,7 +1001,7 @@ function get_links($category = -1, $before = '', $after = '<br />', $between = '
$output .= get_option('links_recently_updated_prepend');
$the_link = '#';
if ( !empty($row->link_url) )
$the_link = clean_url($row->link_url);
$the_link = esc_url($row->link_url);
$rel = $row->link_rel;
if ( '' != $rel )
$rel = ' rel="' . $rel . '"';

4
wp-includes/feed.php
View File

@@ -255,7 +255,7 @@ function get_comment_guid($comment_id = null) {
* @since 1.5.0
*/
function comment_link() {
echo clean_url( get_comment_link() );
echo esc_url( get_comment_link() );
}
/**
@@ -503,7 +503,7 @@ function prep_atom_text_construct($data) {
function self_link() {
$host = @parse_url(get_option('home'));
$host = $host['host'];
echo clean_url(
echo esc_url(
'http'
. ( (isset($_SERVER['https']) && $_SERVER['https'] == 'on') ? 's' : '' ) . '://'
. $host

50
wp-includes/formatting.php
View File

@@ -1149,7 +1149,7 @@ function antispambot($emailaddy, $mailto=0) {
*/
function _make_url_clickable_cb($matches) {
$url = $matches[2];
$url = clean_url($url);
$url = esc_url($url);
if ( empty($url) )
return $matches[0];
return $matches[1] . "<a href=\"$url\" rel=\"nofollow\">$url</a>";
@@ -1171,7 +1171,7 @@ function _make_web_ftp_clickable_cb($matches) {
$ret = '';
$dest = $matches[2];
$dest = 'http://' . $dest;
$dest = clean_url($dest);
$dest = esc_url($dest);
if ( empty($dest) )
return $matches[0];
// removed trailing [,;:] from URL
@@ -1988,7 +1988,7 @@ function wp_htmledit_pre($output) {
* Checks and cleans a URL.
*
* A number of characters are removed from the URL. If the URL is for displaying
* (the default behaviour) amperstands are also replaced. The 'clean_url' filter
* (the default behaviour) amperstands are also replaced. The 'esc_url' filter
* is applied to the returned cleaned URL.
*
* @since 1.2.0
@@ -2032,9 +2032,47 @@ function clean_url( $url, $protocols = null, $context = 'display' ) {
}
/**
* Performs clean_url() for database usage.
* Checks and cleans a URL.
*
* @see clean_url()
* A number of characters are removed from the URL. If the URL is for displaying
* (the default behaviour) amperstands are also replaced. The 'esc_url' filter
* is applied to the returned cleaned URL.
*
* @since 2.8.0
* @uses esc_url()
* @uses wp_kses_bad_protocol() To only permit protocols in the URL set
* via $protocols or the common ones set in the function.
*
* @param string $url The URL to be cleaned.
* @param array $protocols Optional. An array of acceptable protocols.
* Defaults to 'http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet' if not set.
* @return string The cleaned $url after the 'cleaned_url' filter is applied.
*/
function esc_url( $url, $protocols = null ) {
return clean_url( $url, $protocols, 'display' );
}
/**
* Performs esc_url() for database usage.
*
* @see esc_url()
* @see esc_url()
*
* @since 2.8.0
*
* @param string $url The URL to be cleaned.
* @param array $protocols An array of acceptable protocols.
* @return string The cleaned URL.
*/
function esc_url_raw( $url, $protocols = null ) {
return clean_url( $url, $protocols, 'db' );
}
/**
* Performs esc_url() for database or redirect usage.
*
* @see esc_url()
* @deprecated 2.8.0
*
* @since 2.3.1
*
@@ -2280,7 +2318,7 @@ function sanitize_option($option, $value) {
case 'siteurl':
case 'home':
$value = stripslashes($value);
$value = clean_url($value);
$value = esc_url($value);
break;
default :
$value = apply_filters("sanitize_option_{$option}", $value, $option);

2
wp-includes/functions.php
View File

@@ -2336,7 +2336,7 @@ function wp_nonce_ays( $action ) {
$title = __( 'WordPress Failure Notice' );
$html = esc_html( wp_explain_nonce( $action ) );
if ( wp_get_referer() )
$html .= "</p><p><a href='" . clean_url( remove_query_arg( 'updated', wp_get_referer() ) ) . "'>" . __( 'Please try again.' ) . "</a>";
$html .= "</p><p><a href='" . esc_url( remove_query_arg( 'updated', wp_get_referer() ) ) . "'>" . __( 'Please try again.' ) . "</a>";
elseif ( 'log-out' == $action )
$html .= "</p><p>" . sprintf( __( "Do you really want to <a href='%s'>log out</a>?"), wp_logout_url() );

16
wp-includes/general-template.php
View File

@@ -141,9 +141,9 @@ function get_search_form() {
*/
function wp_loginout($redirect = '') {
if ( ! is_user_logged_in() )
$link = '<a href="' . clean_url( wp_login_url($redirect) ) . '">' . __('Log in') . '</a>';
$link = '<a href="' . esc_url( wp_login_url($redirect) ) . '">' . __('Log in') . '</a>';
else
$link = '<a href="' . clean_url( wp_logout_url($redirect) ) . '">' . __('Log out') . '</a>';
$link = '<a href="' . esc_url( wp_logout_url($redirect) ) . '">' . __('Log out') . '</a>';
echo apply_filters('loginout', $link);
}
@@ -689,7 +689,7 @@ function single_month_title($prefix = '', $display = true ) {
function get_archives_link($url, $text, $format = 'html', $before = '', $after = '') {
$text = wptexturize($text);
$title_text = esc_attr($text);
$url = clean_url($url);
$url = esc_url($url);
if ('link' == $format)
$link_html = "\t<link rel='archives' title='$title_text' href='$url' />\n";
@@ -1807,7 +1807,7 @@ function paginate_links( $args = '' ) {
if ( $add_args )
$link = add_query_arg( $add_args, $link );
$link .= $add_fragment;
$page_links[] = "<a class='prev page-numbers' href='" . clean_url($link) . "'>$prev_text</a>";
$page_links[] = "<a class='prev page-numbers' href='" . esc_url($link) . "'>$prev_text</a>";
endif;
for ( $n = 1; $n <= $total; $n++ ) :
$n_display = number_format_i18n($n);
@@ -1821,7 +1821,7 @@ function paginate_links( $args = '' ) {
if ( $add_args )
$link = add_query_arg( $add_args, $link );
$link .= $add_fragment;
$page_links[] = "<a class='page-numbers' href='" . clean_url($link) . "'>$n_display</a>";
$page_links[] = "<a class='page-numbers' href='" . esc_url($link) . "'>$n_display</a>";
$dots = true;
elseif ( $dots && !$show_all ) :
$page_links[] = "<span class='page-numbers dots'>...</span>";
@@ -1835,7 +1835,7 @@ function paginate_links( $args = '' ) {
if ( $add_args )
$link = add_query_arg( $add_args, $link );
$link .= $add_fragment;
$page_links[] = "<a class='next page-numbers' href='" . clean_url($link) . "'>$next_text</a>";
$page_links[] = "<a class='next page-numbers' href='" . esc_url($link) . "'>$next_text</a>";
endif;
switch ( $type ) :
case 'array' :
@@ -1935,9 +1935,9 @@ function wp_admin_css( $file = 'wp-admin', $force_echo = false ) {
return;
}
echo apply_filters( 'wp_admin_css', "<link rel='stylesheet' href='" . clean_url( wp_admin_css_uri( $file ) ) . "' type='text/css' />\n", $file );
echo apply_filters( 'wp_admin_css', "<link rel='stylesheet' href='" . esc_url( wp_admin_css_uri( $file ) ) . "' type='text/css' />\n", $file );
if ( 'rtl' == get_bloginfo( 'text_direction' ) )
echo apply_filters( 'wp_admin_css', "<link rel='stylesheet' href='" . clean_url( wp_admin_css_uri( "$file-rtl" ) ) . "' type='text/css' />\n", "$file-rtl" );
echo apply_filters( 'wp_admin_css', "<link rel='stylesheet' href='" . esc_url( wp_admin_css_uri( "$file-rtl" ) ) . "' type='text/css' />\n", "$file-rtl" );
}
/**

8
wp-includes/link-template.php
View File

@@ -1315,7 +1315,7 @@ function get_next_posts_page_link($max_page = 0) {
* @param boolean $echo Optional. Echo or return;
*/
function next_posts( $max_page = 0, $echo = true ) {
$output = clean_url( get_next_posts_page_link( $max_page ) );
$output = esc_url( get_next_posts_page_link( $max_page ) );
if ( $echo )
echo $output;
@@ -1393,7 +1393,7 @@ function get_previous_posts_page_link() {
* @param boolean $echo Optional. Echo or return;
*/
function previous_posts( $echo = true ) {
$output = clean_url( get_previous_posts_page_link() );
$output = esc_url( get_previous_posts_page_link() );
if ( $echo )
echo $output;
@@ -1550,7 +1550,7 @@ function get_next_comments_link( $label = '', $max_page = 0 ) {
if ( empty($label) )
$label = __('Newer Comments &raquo;');
return '<a href="' . clean_url( get_comments_pagenum_link( $nextpage, $max_page ) ) . '" ' . apply_filters( 'next_comments_link_attributes', '' ) . '>'. preg_replace('/&([^#])(?![a-z]{1,8};)/', '&#038;$1', $label) .'</a>';
return '<a href="' . esc_url( get_comments_pagenum_link( $nextpage, $max_page ) ) . '" ' . apply_filters( 'next_comments_link_attributes', '' ) . '>'. preg_replace('/&([^#])(?![a-z]{1,8};)/', '&#038;$1', $label) .'</a>';
}
/**
@@ -1587,7 +1587,7 @@ function get_previous_comments_link( $label = '' ) {
if ( empty($label) )
$label = __('&laquo; Older Comments');
return '<a href="' . clean_url( get_comments_pagenum_link( $prevpage ) ) . '" ' . apply_filters( 'previous_comments_link_attributes', '' ) . '>' . preg_replace('/&([^#])(?![a-z]{1,8};)/', '&#038;$1', $label) .'</a>';
return '<a href="' . esc_url( get_comments_pagenum_link( $prevpage ) ) . '" ' . apply_filters( 'previous_comments_link_attributes', '' ) . '>' . preg_replace('/&([^#])(?![a-z]{1,8};)/', '&#038;$1', $label) .'</a>';
}
/**

2
wp-includes/rss.php
View File

@@ -872,7 +872,7 @@ function wp_rss( $url, $num_items = -1 ) {
foreach ( (array) $rss->items as $item ) {
printf(
'<li><a href="%1$s" title="%2$s">%3$s</a></li>',
clean_url( $item['link'] ),
esc_url( $item['link'] ),
esc_attr( strip_tags( $item['description'] ) ),
htmlentities( $item['title'] )
);

4
wp-includes/theme.php
View File

@@ -185,7 +185,7 @@ function get_theme_data( $theme_file ) {
$name = $theme = '';
if ( preg_match( '|Theme URI:(.*)$|mi', $theme_data, $theme_uri ) )
$theme_uri = clean_url( _cleanup_header_comment($theme_uri[1]) );
$theme_uri = esc_url( _cleanup_header_comment($theme_uri[1]) );
else
$theme_uri = '';
@@ -195,7 +195,7 @@ function get_theme_data( $theme_file ) {
$description = '';
if ( preg_match( '|Author URI:(.*)$|mi', $theme_data, $author_uri ) )
$author_uri = clean_url( _cleanup_header_comment($author_uri[1]) );
$author_uri = esc_url( _cleanup_header_comment($author_uri[1]) );
else
$author_uri = '';

4
wp-includes/update.php
View File

@@ -67,9 +67,9 @@ function wp_version_check() {
$new_option = new stdClass();
$new_option->response = esc_attr( $returns[0] );
if ( isset( $returns[1] ) )
$new_option->url = clean_url( $returns[1] );
$new_option->url = esc_url( $returns[1] );
if ( isset( $returns[2] ) )
$new_option->package = clean_url( $returns[2] );
$new_option->package = esc_url( $returns[2] );
if ( isset( $returns[3] ) )
$new_option->current = esc_attr( $returns[3] );
if ( isset( $returns[4] ) )

2
wp-includes/version.php
View File

@@ -15,6 +15,6 @@ $wp_version = '2.8-beta1-11380';
*
* @global int $wp_db_version
*/
$wp_db_version = 10850;
$wp_db_version = 10851;
?>