aboutsummaryrefslogtreecommitdiff
path: root/srcs/wordpress/wp-includes/kses.php
diff options
context:
space:
mode:
authorCharles Cabergs <me@cacharle.xyz>2020-07-27 10:05:23 +0200
committerCharles Cabergs <me@cacharle.xyz>2020-07-27 10:05:23 +0200
commit5bf66662a9bdd62c5bccab15e607cd95cfb8fcab (patch)
tree39a1a4629749056191c05dfd899f931701b7acf3 /srcs/wordpress/wp-includes/kses.php
parent5afd237bbd22028b85532b8c0b3fcead49a00764 (diff)
downloadft_server-master.tar.gz
ft_server-master.tar.bz2
ft_server-master.zip
Removed wordpress and phpmyadmin, my server doesn't handle it well and it brings shame on my famillyHEADmaster
Diffstat (limited to 'srcs/wordpress/wp-includes/kses.php')
-rw-r--r--srcs/wordpress/wp-includes/kses.php2332
1 files changed, 0 insertions, 2332 deletions
diff --git a/srcs/wordpress/wp-includes/kses.php b/srcs/wordpress/wp-includes/kses.php
deleted file mode 100644
index d2f3cbb..0000000
--- a/srcs/wordpress/wp-includes/kses.php
+++ /dev/null
@@ -1,2332 +0,0 @@
-<?php
-/**
- * kses 0.2.2 - HTML/XHTML filter that only allows some elements and attributes
- * Copyright (C) 2002, 2003, 2005 Ulf Harnhammar
- *
- * This program is free software and open source software; you can redistribute
- * it and/or modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the License,
- * or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- * http://www.gnu.org/licenses/gpl.html
- *
- * [kses strips evil scripts!]
- *
- * Added wp_ prefix to avoid conflicts with existing kses users
- *
- * @version 0.2.2
- * @copyright (C) 2002, 2003, 2005
- * @author Ulf Harnhammar <http://advogato.org/person/metaur/>
- *
- * @package External
- * @subpackage KSES
- */
-
-/**
- * Specifies the default allowable HTML tags.
- *
- * Using `CUSTOM_TAGS` is not recommended and should be considered deprecated. The
- * {@see 'wp_kses_allowed_html'} filter is more powerful and supplies context.
- *
- * @see wp_kses_allowed_html()
- * @since 1.2.0
- *
- * @var array[]|bool Array of default allowable HTML tags, or false to use the defaults.
- */
-if ( ! defined( 'CUSTOM_TAGS' ) ) {
- define( 'CUSTOM_TAGS', false );
-}
-
-// Ensure that these variables are added to the global namespace
-// (e.g. if using namespaces / autoload in the current PHP environment).
-global $allowedposttags, $allowedtags, $allowedentitynames;
-
-if ( ! CUSTOM_TAGS ) {
- /**
- * KSES global for default allowable HTML tags.
- *
- * Can be overridden with the `CUSTOM_TAGS` constant.
- *
- * @var array[] $allowedposttags Array of default allowable HTML tags.
- * @since 2.0.0
- */
- $allowedposttags = array(
- 'address' => array(),
- 'a' => array(
- 'href' => true,
- 'rel' => true,
- 'rev' => true,
- 'name' => true,
- 'target' => true,
- 'download' => array(
- 'valueless' => 'y',
- ),
- ),
- 'abbr' => array(),
- 'acronym' => array(),
- 'area' => array(
- 'alt' => true,
- 'coords' => true,
- 'href' => true,
- 'nohref' => true,
- 'shape' => true,
- 'target' => true,
- ),
- 'article' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'aside' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'audio' => array(
- 'autoplay' => true,
- 'controls' => true,
- 'loop' => true,
- 'muted' => true,
- 'preload' => true,
- 'src' => true,
- ),
- 'b' => array(),
- 'bdo' => array(
- 'dir' => true,
- ),
- 'big' => array(),
- 'blockquote' => array(
- 'cite' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'br' => array(),
- 'button' => array(
- 'disabled' => true,
- 'name' => true,
- 'type' => true,
- 'value' => true,
- ),
- 'caption' => array(
- 'align' => true,
- ),
- 'cite' => array(
- 'dir' => true,
- 'lang' => true,
- ),
- 'code' => array(),
- 'col' => array(
- 'align' => true,
- 'char' => true,
- 'charoff' => true,
- 'span' => true,
- 'dir' => true,
- 'valign' => true,
- 'width' => true,
- ),
- 'colgroup' => array(
- 'align' => true,
- 'char' => true,
- 'charoff' => true,
- 'span' => true,
- 'valign' => true,
- 'width' => true,
- ),
- 'del' => array(
- 'datetime' => true,
- ),
- 'dd' => array(),
- 'dfn' => array(),
- 'details' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'open' => true,
- 'xml:lang' => true,
- ),
- 'div' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'dl' => array(),
- 'dt' => array(),
- 'em' => array(),
- 'fieldset' => array(),
- 'figure' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'figcaption' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'font' => array(
- 'color' => true,
- 'face' => true,
- 'size' => true,
- ),
- 'footer' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'h1' => array(
- 'align' => true,
- ),
- 'h2' => array(
- 'align' => true,
- ),
- 'h3' => array(
- 'align' => true,
- ),
- 'h4' => array(
- 'align' => true,
- ),
- 'h5' => array(
- 'align' => true,
- ),
- 'h6' => array(
- 'align' => true,
- ),
- 'header' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'hgroup' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'hr' => array(
- 'align' => true,
- 'noshade' => true,
- 'size' => true,
- 'width' => true,
- ),
- 'i' => array(),
- 'img' => array(
- 'alt' => true,
- 'align' => true,
- 'border' => true,
- 'height' => true,
- 'hspace' => true,
- 'longdesc' => true,
- 'vspace' => true,
- 'src' => true,
- 'usemap' => true,
- 'width' => true,
- ),
- 'ins' => array(
- 'datetime' => true,
- 'cite' => true,
- ),
- 'kbd' => array(),
- 'label' => array(
- 'for' => true,
- ),
- 'legend' => array(
- 'align' => true,
- ),
- 'li' => array(
- 'align' => true,
- 'value' => true,
- ),
- 'map' => array(
- 'name' => true,
- ),
- 'mark' => array(),
- 'menu' => array(
- 'type' => true,
- ),
- 'nav' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'p' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'pre' => array(
- 'width' => true,
- ),
- 'q' => array(
- 'cite' => true,
- ),
- 's' => array(),
- 'samp' => array(),
- 'span' => array(
- 'dir' => true,
- 'align' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'section' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'small' => array(),
- 'strike' => array(),
- 'strong' => array(),
- 'sub' => array(),
- 'summary' => array(
- 'align' => true,
- 'dir' => true,
- 'lang' => true,
- 'xml:lang' => true,
- ),
- 'sup' => array(),
- 'table' => array(
- 'align' => true,
- 'bgcolor' => true,
- 'border' => true,
- 'cellpadding' => true,
- 'cellspacing' => true,
- 'dir' => true,
- 'rules' => true,
- 'summary' => true,
- 'width' => true,
- ),
- 'tbody' => array(
- 'align' => true,
- 'char' => true,
- 'charoff' => true,
- 'valign' => true,
- ),
- 'td' => array(
- 'abbr' => true,
- 'align' => true,
- 'axis' => true,
- 'bgcolor' => true,
- 'char' => true,
- 'charoff' => true,
- 'colspan' => true,
- 'dir' => true,
- 'headers' => true,
- 'height' => true,
- 'nowrap' => true,
- 'rowspan' => true,
- 'scope' => true,
- 'valign' => true,
- 'width' => true,
- ),
- 'textarea' => array(
- 'cols' => true,
- 'rows' => true,
- 'disabled' => true,
- 'name' => true,
- 'readonly' => true,
- ),
- 'tfoot' => array(
- 'align' => true,
- 'char' => true,
- 'charoff' => true,
- 'valign' => true,
- ),
- 'th' => array(
- 'abbr' => true,
- 'align' => true,
- 'axis' => true,
- 'bgcolor' => true,
- 'char' => true,
- 'charoff' => true,
- 'colspan' => true,
- 'headers' => true,
- 'height' => true,
- 'nowrap' => true,
- 'rowspan' => true,
- 'scope' => true,
- 'valign' => true,
- 'width' => true,
- ),
- 'thead' => array(
- 'align' => true,
- 'char' => true,
- 'charoff' => true,
- 'valign' => true,
- ),
- 'title' => array(),
- 'tr' => array(
- 'align' => true,
- 'bgcolor' => true,
- 'char' => true,
- 'charoff' => true,
- 'valign' => true,
- ),
- 'track' => array(
- 'default' => true,
- 'kind' => true,
- 'label' => true,
- 'src' => true,
- 'srclang' => true,
- ),
- 'tt' => array(),
- 'u' => array(),
- 'ul' => array(
- 'type' => true,
- ),
- 'ol' => array(
- 'start' => true,
- 'type' => true,
- 'reversed' => true,
- ),
- 'var' => array(),
- 'video' => array(
- 'autoplay' => true,
- 'controls' => true,
- 'height' => true,
- 'loop' => true,
- 'muted' => true,
- 'poster' => true,
- 'preload' => true,
- 'src' => true,
- 'width' => true,
- ),
- );
-
- /**
- * @var array[] $allowedtags Array of KSES allowed HTML elements.
- * @since 1.0.0
- */
- $allowedtags = array(
- 'a' => array(
- 'href' => true,
- 'title' => true,
- ),
- 'abbr' => array(
- 'title' => true,
- ),
- 'acronym' => array(
- 'title' => true,
- ),
- 'b' => array(),
- 'blockquote' => array(
- 'cite' => true,
- ),
- 'cite' => array(),
- 'code' => array(),
- 'del' => array(
- 'datetime' => true,
- ),
- 'em' => array(),
- 'i' => array(),
- 'q' => array(
- 'cite' => true,
- ),
- 's' => array(),
- 'strike' => array(),
- 'strong' => array(),
- );
-
- /**
- * @var string[] $allowedentitynames Array of KSES allowed HTML entitity names.
- * @since 1.0.0
- */
- $allowedentitynames = array(
- 'nbsp',
- 'iexcl',
- 'cent',
- 'pound',
- 'curren',
- 'yen',
- 'brvbar',
- 'sect',
- 'uml',
- 'copy',
- 'ordf',
- 'laquo',
- 'not',
- 'shy',
- 'reg',
- 'macr',
- 'deg',
- 'plusmn',
- 'acute',
- 'micro',
- 'para',
- 'middot',
- 'cedil',
- 'ordm',
- 'raquo',
- 'iquest',
- 'Agrave',
- 'Aacute',
- 'Acirc',
- 'Atilde',
- 'Auml',
- 'Aring',
- 'AElig',
- 'Ccedil',
- 'Egrave',
- 'Eacute',
- 'Ecirc',
- 'Euml',
- 'Igrave',
- 'Iacute',
- 'Icirc',
- 'Iuml',
- 'ETH',
- 'Ntilde',
- 'Ograve',
- 'Oacute',
- 'Ocirc',
- 'Otilde',
- 'Ouml',
- 'times',
- 'Oslash',
- 'Ugrave',
- 'Uacute',
- 'Ucirc',
- 'Uuml',
- 'Yacute',
- 'THORN',
- 'szlig',
- 'agrave',
- 'aacute',
- 'acirc',
- 'atilde',
- 'auml',
- 'aring',
- 'aelig',
- 'ccedil',
- 'egrave',
- 'eacute',
- 'ecirc',
- 'euml',
- 'igrave',
- 'iacute',
- 'icirc',
- 'iuml',
- 'eth',
- 'ntilde',
- 'ograve',
- 'oacute',
- 'ocirc',
- 'otilde',
- 'ouml',
- 'divide',
- 'oslash',
- 'ugrave',
- 'uacute',
- 'ucirc',
- 'uuml',
- 'yacute',
- 'thorn',
- 'yuml',
- 'quot',
- 'amp',
- 'lt',
- 'gt',
- 'apos',
- 'OElig',
- 'oelig',
- 'Scaron',
- 'scaron',
- 'Yuml',
- 'circ',
- 'tilde',
- 'ensp',
- 'emsp',
- 'thinsp',
- 'zwnj',
- 'zwj',
- 'lrm',
- 'rlm',
- 'ndash',
- 'mdash',
- 'lsquo',
- 'rsquo',
- 'sbquo',
- 'ldquo',
- 'rdquo',
- 'bdquo',
- 'dagger',
- 'Dagger',
- 'permil',
- 'lsaquo',
- 'rsaquo',
- 'euro',
- 'fnof',
- 'Alpha',
- 'Beta',
- 'Gamma',
- 'Delta',
- 'Epsilon',
- 'Zeta',
- 'Eta',
- 'Theta',
- 'Iota',
- 'Kappa',
- 'Lambda',
- 'Mu',
- 'Nu',
- 'Xi',
- 'Omicron',
- 'Pi',
- 'Rho',
- 'Sigma',
- 'Tau',
- 'Upsilon',
- 'Phi',
- 'Chi',
- 'Psi',
- 'Omega',
- 'alpha',
- 'beta',
- 'gamma',
- 'delta',
- 'epsilon',
- 'zeta',
- 'eta',
- 'theta',
- 'iota',
- 'kappa',
- 'lambda',
- 'mu',
- 'nu',
- 'xi',
- 'omicron',
- 'pi',
- 'rho',
- 'sigmaf',
- 'sigma',
- 'tau',
- 'upsilon',
- 'phi',
- 'chi',
- 'psi',
- 'omega',
- 'thetasym',
- 'upsih',
- 'piv',
- 'bull',
- 'hellip',
- 'prime',
- 'Prime',
- 'oline',
- 'frasl',
- 'weierp',
- 'image',
- 'real',
- 'trade',
- 'alefsym',
- 'larr',
- 'uarr',
- 'rarr',
- 'darr',
- 'harr',
- 'crarr',
- 'lArr',
- 'uArr',
- 'rArr',
- 'dArr',
- 'hArr',
- 'forall',
- 'part',
- 'exist',
- 'empty',
- 'nabla',
- 'isin',
- 'notin',
- 'ni',
- 'prod',
- 'sum',
- 'minus',
- 'lowast',
- 'radic',
- 'prop',
- 'infin',
- 'ang',
- 'and',
- 'or',
- 'cap',
- 'cup',
- 'int',
- 'sim',
- 'cong',
- 'asymp',
- 'ne',
- 'equiv',
- 'le',
- 'ge',
- 'sub',
- 'sup',
- 'nsub',
- 'sube',
- 'supe',
- 'oplus',
- 'otimes',
- 'perp',
- 'sdot',
- 'lceil',
- 'rceil',
- 'lfloor',
- 'rfloor',
- 'lang',
- 'rang',
- 'loz',
- 'spades',
- 'clubs',
- 'hearts',
- 'diams',
- 'sup1',
- 'sup2',
- 'sup3',
- 'frac14',
- 'frac12',
- 'frac34',
- 'there4',
- );
-
- $allowedposttags = array_map( '_wp_add_global_attributes', $allowedposttags );
-} else {
- $allowedtags = wp_kses_array_lc( $allowedtags );
- $allowedposttags = wp_kses_array_lc( $allowedposttags );
-}
-
-/**
- * Filters text content and strips out disallowed HTML.
- *
- * This function makes sure that only the allowed HTML element names, attribute
- * names, attribute values, and HTML entities will occur in the given text string.
- *
- * This function expects unslashed data.
- *
- * @see wp_kses_post() for specifically filtering post content and fields.
- * @see wp_allowed_protocols() for the default allowed protocols in link URLs.
- *
- * @since 1.0.0
- *
- * @param string $string Text content to filter.
- * @param array[]|string $allowed_html An array of allowed HTML elements and attributes, or a
- * context name such as 'post'.
- * @param string[] $allowed_protocols Array of allowed URL protocols.
- * @return string Filtered content containing only the allowed HTML.
- */
-function wp_kses( $string, $allowed_html, $allowed_protocols = array() ) {
- if ( empty( $allowed_protocols ) ) {
- $allowed_protocols = wp_allowed_protocols();
- }
- $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
- $string = wp_kses_normalize_entities( $string );
- $string = wp_kses_hook( $string, $allowed_html, $allowed_protocols );
- return wp_kses_split( $string, $allowed_html, $allowed_protocols );
-}
-
-/**
- * Filters one HTML attribute and ensures its value is allowed.
- *
- * This function can escape data in some situations where `wp_kses()` must strip the whole attribute.
- *
- * @since 4.2.3
- *
- * @param string $string The 'whole' attribute, including name and value.
- * @param string $element The HTML element name to which the attribute belongs.
- * @return string Filtered attribute.
- */
-function wp_kses_one_attr( $string, $element ) {
- $uris = wp_kses_uri_attributes();
- $allowed_html = wp_kses_allowed_html( 'post' );
- $allowed_protocols = wp_allowed_protocols();
- $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
-
- // Preserve leading and trailing whitespace.
- $matches = array();
- preg_match( '/^\s*/', $string, $matches );
- $lead = $matches[0];
- preg_match( '/\s*$/', $string, $matches );
- $trail = $matches[0];
- if ( empty( $trail ) ) {
- $string = substr( $string, strlen( $lead ) );
- } else {
- $string = substr( $string, strlen( $lead ), -strlen( $trail ) );
- }
-
- // Parse attribute name and value from input.
- $split = preg_split( '/\s*=\s*/', $string, 2 );
- $name = $split[0];
- if ( count( $split ) == 2 ) {
- $value = $split[1];
-
- // Remove quotes surrounding $value.
- // Also guarantee correct quoting in $string for this one attribute.
- if ( '' == $value ) {
- $quote = '';
- } else {
- $quote = $value[0];
- }
- if ( '"' == $quote || "'" == $quote ) {
- if ( substr( $value, -1 ) != $quote ) {
- return '';
- }
- $value = substr( $value, 1, -1 );
- } else {
- $quote = '"';
- }
-
- // Sanitize quotes, angle braces, and entities.
- $value = esc_attr( $value );
-
- // Sanitize URI values.
- if ( in_array( strtolower( $name ), $uris ) ) {
- $value = wp_kses_bad_protocol( $value, $allowed_protocols );
- }
-
- $string = "$name=$quote$value$quote";
- $vless = 'n';
- } else {
- $value = '';
- $vless = 'y';
- }
-
- // Sanitize attribute by name.
- wp_kses_attr_check( $name, $value, $string, $vless, $element, $allowed_html );
-
- // Restore whitespace.
- return $lead . $string . $trail;
-}
-
-/**
- * Returns an array of allowed HTML tags and attributes for a given context.
- *
- * @since 3.5.0
- * @since 5.0.1 `form` removed as allowable HTML tag.
- *
- * @global array $allowedposttags
- * @global array $allowedtags
- * @global array $allowedentitynames
- *
- * @param string|array $context The context for which to retrieve tags. Allowed values are 'post',
- * 'strip', 'data', 'entities', or the name of a field filter such as
- * 'pre_user_description'.
- * @return array Array of allowed HTML tags and their allowed attributes.
- */
-function wp_kses_allowed_html( $context = '' ) {
- global $allowedposttags, $allowedtags, $allowedentitynames;
-
- if ( is_array( $context ) ) {
- /**
- * Filters the HTML that is allowed for a given context.
- *
- * @since 3.5.0
- *
- * @param array[]|string $context Context to judge allowed tags by.
- * @param string $context_type Context name.
- */
- return apply_filters( 'wp_kses_allowed_html', $context, 'explicit' );
- }
-
- switch ( $context ) {
- case 'post':
- /** This filter is documented in wp-includes/kses.php */
- $tags = apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
-
- // 5.0.1 removed the `<form>` tag, allow it if a filter is allowing it's sub-elements `<input>` or `<select>`.
- if ( ! CUSTOM_TAGS && ! isset( $tags['form'] ) && ( isset( $tags['input'] ) || isset( $tags['select'] ) ) ) {
- $tags = $allowedposttags;
-
- $tags['form'] = array(
- 'action' => true,
- 'accept' => true,
- 'accept-charset' => true,
- 'enctype' => true,
- 'method' => true,
- 'name' => true,
- 'target' => true,
- );
-
- /** This filter is documented in wp-includes/kses.php */
- $tags = apply_filters( 'wp_kses_allowed_html', $tags, $context );
- }
-
- return $tags;
-
- case 'user_description':
- case 'pre_user_description':
- $tags = $allowedtags;
- $tags['a']['rel'] = true;
- /** This filter is documented in wp-includes/kses.php */
- return apply_filters( 'wp_kses_allowed_html', $tags, $context );
-
- case 'strip':
- /** This filter is documented in wp-includes/kses.php */
- return apply_filters( 'wp_kses_allowed_html', array(), $context );
-
- case 'entities':
- /** This filter is documented in wp-includes/kses.php */
- return apply_filters( 'wp_kses_allowed_html', $allowedentitynames, $context );
-
- case 'data':
- default:
- /** This filter is documented in wp-includes/kses.php */
- return apply_filters( 'wp_kses_allowed_html', $allowedtags, $context );
- }
-}
-
-/**
- * You add any KSES hooks here.
- *
- * There is currently only one KSES WordPress hook, {@see 'pre_kses'}, and it is called here.
- * All parameters are passed to the hooks and expected to receive a string.
- *
- * @since 1.0.0
- *
- * @param string $string Content to filter through KSES.
- * @param array[]|string $allowed_html List of allowed HTML elements.
- * @param string[] $allowed_protocols Array of allowed URL protocols.
- * @return string Filtered content through {@see 'pre_kses'} hook.
- */
-function wp_kses_hook( $string, $allowed_html, $allowed_protocols ) {
- /**
- * Filters content to be run through kses.
- *
- * @since 2.3.0
- *
- * @param string $string Content to run through KSES.
- * @param array[]|string $allowed_html Allowed HTML elements.
- * @param string[] $allowed_protocols Array of allowed URL protocols.
- */
- return apply_filters( 'pre_kses', $string, $allowed_html, $allowed_protocols );
-}
-
-/**
- * Returns the version number of KSES.
- *
- * @since 1.0.0
- *
- * @return string KSES version number.
- */
-function wp_kses_version() {
- return '0.2.2';
-}
-
-/**
- * Searches for HTML tags, no matter how malformed.
- *
- * It also matches stray `>` characters.
- *
- * @since 1.0.0
- *
- * @global array $pass_allowed_html
- * @global array $pass_allowed_protocols
- *
- * @param string $string Content to filter.
- * @param array $allowed_html Allowed HTML elements.
- * @param string[] $allowed_protocols Array of allowed URL protocols.
- * @return string Content with fixed HTML tags
- */
-function wp_kses_split( $string, $allowed_html, $allowed_protocols ) {
- global $pass_allowed_html, $pass_allowed_protocols;
- $pass_allowed_html = $allowed_html;
- $pass_allowed_protocols = $allowed_protocols;
- return preg_replace_callback( '%(<!--.*?(-->|$))|(<[^>]*(>|$)|>)%', '_wp_kses_split_callback', $string );
-}
-
-/**
- * Helper function listing HTML attributes containing a URL.
- *
- * This function returns a list of all HTML attributes that must contain
- * a URL according to the HTML specification.
- *
- * This list includes URI attributes both allowed and disallowed by KSES.
- *
- * @link https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes
- *
- * @since 5.0.1
- *
- * @return array HTML attributes that must include a URL.
- */
-function wp_kses_uri_attributes() {
- $uri_attributes = array(
- 'action',
- 'archive',
- 'background',
- 'cite',
- 'classid',
- 'codebase',
- 'data',
- 'formaction',
- 'href',
- 'icon',
- 'longdesc',
- 'manifest',
- 'poster',
- 'profile',
- 'src',
- 'usemap',
- 'xmlns',
- );
-
- /**
- * Filters the list of attributes that are required to contain a URL.
- *
- * Use this filter to add any `data-` attributes that are required to be
- * validated as a URL.
- *
- * @since 5.0.1
- *
- * @param array $uri_attributes HTML attributes requiring validation as a URL.
- */
- $uri_attributes = apply_filters( 'wp_kses_uri_attributes', $uri_attributes );
-
- return $uri_attributes;
-}
-
-/**
- * Callback for `wp_kses_split()`.
- *
- * @since 3.1.0
- * @access private
- * @ignore
- *
- * @global array $pass_allowed_html
- * @global array $pass_allowed_protocols
- *
- * @return string
- */
-function _wp_kses_split_callback( $match ) {
- global $pass_allowed_html, $pass_allowed_protocols;
- return wp_kses_split2( $match[0], $pass_allowed_html, $pass_allowed_protocols );
-}
-
-/**
- * Callback for `wp_kses_split()` for fixing malformed HTML tags.
- *
- * This function does a lot of work. It rejects some very malformed things like
- * `<:::>`. It returns an empty string, if the element isn't allowed (look ma, no
- * `strip_tags()`!). Otherwise it splits the tag into an element and an attribute
- * list.
- *
- * After the tag is split into an element and an attribute list, it is run
- * through another filter which will remove illegal attributes and once that is
- * completed, will be returned.
- *
- * @access private
- * @ignore
- * @since 1.0.0
- *
- * @param string $string Content to filter.
- * @param array $allowed_html Allowed HTML elements.
- * @param string[] $allowed_protocols Array of allowed URL protocols.
- * @return string Fixed HTML element
- */
-function wp_kses_split2( $string, $allowed_html, $allowed_protocols ) {
- $string = wp_kses_stripslashes( $string );
-
- // It matched a ">" character.
- if ( substr( $string, 0, 1 ) != '<' ) {
- return '&gt;';
- }
-
- // Allow HTML comments.
- if ( '<!--' == substr( $string, 0, 4 ) ) {
- $string = str_replace( array( '<!--', '-->' ), '', $string );
- while ( $string != ( $newstring = wp_kses( $string, $allowed_html, $allowed_protocols ) ) ) {
- $string = $newstring;
- }
- if ( $string == '' ) {
- return '';
- }
- // prevent multiple dashes in comments
- $string = preg_replace( '/--+/', '-', $string );
- // prevent three dashes closing a comment
- $string = preg_replace( '/-$/', '', $string );
- return "<!--{$string}-->";
- }
-
- // It's seriously malformed.
- if ( ! preg_match( '%^<\s*(/\s*)?([a-zA-Z0-9-]+)([^>]*)>?$%', $string, $matches ) ) {
- return '';
- }
-
- $slash = trim( $matches[1] );
- $elem = $matches[2];
- $attrlist = $matches[3];
-
- if ( ! is_array( $allowed_html ) ) {
- $allowed_html = wp_kses_allowed_html( $allowed_html );
- }
-
- // They are using a not allowed HTML element.
- if ( ! isset( $allowed_html[ strtolower( $elem ) ] ) ) {
- return '';
- }
-
- // No attributes are allowed for closing elements.
- if ( $slash != '' ) {
- return "</$elem>";
- }
-
- return wp_kses_attr( $elem, $attrlist, $allowed_html, $allowed_protocols );
-}
-
-/**
- * Removes all attributes, if none are allowed for this element.
- *
- * If some are allowed it calls `wp_kses_hair()` to split them further, and then
- * it builds up new HTML code from the data that `kses_hair()` returns. It also
- * removes `<` and `>` characters, if there are any left. One more thing it does
- * is to check if the tag has a closing XHTML slash, and if it does, it puts one
- * in the returned code as well.
- *
- * @since 1.0.0
- *
- * @param string $element HTML element/tag.
- * @param string $attr HTML attributes from HTML element to closing HTML element tag.
- * @param array $allowed_html Allowed HTML elements.
- * @param string[] $allowed_protocols Array of allowed URL protocols.
- * @return string Sanitized HTML element.
- */
-function wp_kses_attr( $element, $attr, $allowed_html, $allowed_protocols ) {
- if ( ! is_array( $allowed_html ) ) {
- $allowed_html = wp_kses_allowed_html( $allowed_html );
- }
-
- // Is there a closing XHTML slash at the end of the attributes?
- $xhtml_slash = '';
- if ( preg_match( '%\s*/\s*$%', $attr ) ) {
- $xhtml_slash = ' /';
- }
-
- // Are any attributes allowed at all for this element?
- $element_low = strtolower( $element );
- if ( empty( $allowed_html[ $element_low ] ) || true === $allowed_html[ $element_low ] ) {
- return "<$element$xhtml_slash>";
- }
-
- // Split it
- $attrarr = wp_kses_hair( $attr, $allowed_protocols );
-
- // Go through $attrarr, and save the allowed attributes for this element
- // in $attr2
- $attr2 = '';
- foreach ( $attrarr as $arreach ) {
- if ( wp_kses_attr_check( $arreach['name'], $arreach['value'], $arreach['whole'], $arreach['vless'], $element, $allowed_html ) ) {
- $attr2 .= ' ' . $arreach['whole'];
- }
- }
-
- // Remove any "<" or ">" characters
- $attr2 = preg_replace( '/[<>]/', '', $attr2 );
-
- return "<$element$attr2$xhtml_slash>";
-}
-
-/**
- * Determines whether an attribute is allowed.
- *
- * @since 4.2.3
- * @since 5.0.0 Add support for `data-*` wildcard attributes.
- *
- * @param string $name The attribute name. Passed by reference. Returns empty string when not allowed.
- * @param string $value The attribute value. Passed by reference. Returns a filtered value.
- * @param string $whole The `name=value` input. Passed by reference. Returns filtered input.
- * @param string $vless Whether the attribute is valueless. Use 'y' or 'n'.
- * @param string $element The name of the element to which this attribute belongs.
- * @param array $allowed_html The full list of allowed elements and attributes.
- * @return bool Whether or not the attribute is allowed.
- */
-function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) {
- $allowed_attr = $allowed_html[ strtolower( $element ) ];
-
- $name_low = strtolower( $name );
- if ( ! isset( $allowed_attr[ $name_low ] ) || '' == $allowed_attr[ $name_low ] ) {
- /*
- * Allow `data-*` attributes.
- *
- * When specifying `$allowed_html`, the attribute name should be set as
- * `data-*` (not to be mixed with the HTML 4.0 `data` attribute, see
- * https://www.w3.org/TR/html40/struct/objects.html#adef-data).
- *
- * Note: the attribute name should only contain `A-Za-z0-9_-` chars,
- * double hyphens `--` are not accepted by WordPress.
- */
- if ( strpos( $name_low, 'data-' ) === 0 && ! empty( $allowed_attr['data-*'] ) && preg_match( '/^data(?:-[a-z0-9_]+)+$/', $name_low, $match ) ) {
- /*
- * Add the whole attribute name to the allowed attributes and set any restrictions
- * for the `data-*` attribute values for the current element.
- */
- $allowed_attr[ $match[0] ] = $allowed_attr['data-*'];
- } else {
- $name = '';
- $value = '';
- $whole = '';
- return false;
- }
- }
-
- if ( 'style' == $name_low ) {
- $new_value = safecss_filter_attr( $value );
-
- if ( empty( $new_value ) ) {
- $name = '';
- $value = '';
- $whole = '';
- return false;
- }
-
- $whole = str_replace( $value, $new_value, $whole );
- $value = $new_value;
- }
-
- if ( is_array( $allowed_attr[ $name_low ] ) ) {
- // there are some checks
- foreach ( $allowed_attr[ $name_low ] as $currkey => $currval ) {
- if ( ! wp_kses_check_attr_val( $value, $vless, $currkey, $currval ) ) {
- $name = '';
- $value = '';
- $whole = '';
- return false;
- }
- }
- }
-
- return true;
-}
-
-/**
- * Builds an attribute list from string containing attributes.
- *
- * This function does a lot of work. It parses an attribute list into an array
- * with attribute data, and tries to do the right thing even if it gets weird
- * input. It will add quotes around attribute values that don't have any quotes
- * or apostrophes around them, to make it easier to produce HTML code that will
- * conform to W3C's HTML specification. It will also remove bad URL protocols
- * from attribute values. It also reduces duplicate attributes by using the
- * attribute defined first (`foo='bar' foo='baz'` will result in `foo='bar'`).
- *
- * @since 1.0.0
- *
- * @param string $attr