Inline CSS filter for kses, for trunk, fixes #10336
git-svn-id: https://develop.svn.wordpress.org/trunk@11689 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
parent
8f795065f6
commit
81c8791b9d
|
@ -521,6 +521,19 @@ function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) {
|
|||
break;
|
||||
}
|
||||
|
||||
if ( $arreach['name'] == 'style' ) {
|
||||
$orig_value = $arreach['value'];
|
||||
|
||||
$value = safecss_filter_attr($orig_value, $element);
|
||||
|
||||
if ( empty($value) )
|
||||
continue;
|
||||
|
||||
$arreach['value'] = $value;
|
||||
|
||||
$arreach['whole'] = str_replace($orig_value, $value, $arreach['whole']);
|
||||
}
|
||||
|
||||
if ($ok)
|
||||
$attr2 .= ' '.$arreach['whole']; # it passed them
|
||||
} # if !is_array($current)
|
||||
|
@ -1122,4 +1135,49 @@ function kses_init() {
|
|||
|
||||
add_action('init', 'kses_init');
|
||||
add_action('set_current_user', 'kses_init');
|
||||
?>
|
||||
|
||||
function safecss_filter_attr( $css, $element ) {
|
||||
$css = wp_kses_no_null($css);
|
||||
$css = str_replace(array("\n","\r","\t"), '', $css);
|
||||
|
||||
if ( preg_match( '%[\\(&]|/\*%', $css ) ) // remove any inline css containing \ ( & or comments
|
||||
return '';
|
||||
|
||||
$css_array = split( ';', trim( $css ) );
|
||||
$allowed_attr = apply_filters( 'safe_style_css', array( 'text-align', 'margin', 'color', 'float',
|
||||
'border', 'background', 'background-color', 'border-bottom', 'border-bottom-color',
|
||||
'border-bottom-style', 'border-bottom-width', 'border-collapse', 'border-color', 'border-left',
|
||||
'border-left-color', 'border-left-style', 'border-left-width', 'border-right', 'border-right-color',
|
||||
'border-right-style', 'border-right-width', 'border-spacing', 'border-style', 'border-top',
|
||||
'border-top-color', 'border-top-style', 'border-top-width', 'border-width', 'caption-side',
|
||||
'clear', 'cursor', 'direction', 'font', 'font-family', 'font-size', 'font-style',
|
||||
'font-variant', 'font-weight', 'height', 'letter-spacing', 'line-height', 'margin-bottom',
|
||||
'margin-left', 'margin-right', 'margin-top', 'overflow', 'padding', 'padding-bottom',
|
||||
'padding-left', 'padding-right', 'padding-top', 'text-decoration', 'text-indent', 'vertical-align',
|
||||
'width' ) );
|
||||
|
||||
if ( empty($allowed_attr) )
|
||||
return $css;
|
||||
|
||||
$css = '';
|
||||
foreach ( $css_array as $css_item ) {
|
||||
if ( $css_item == '' )
|
||||
continue;
|
||||
$css_item = trim( $css_item );
|
||||
$found = false;
|
||||
if ( strpos( $css_item, ':' ) === false ) {
|
||||
$found = true;
|
||||
} else {
|
||||
$parts = split( ':', $css_item );
|
||||
if ( in_array( trim( $parts[0] ), $allowed_attr ) )
|
||||
$found = true;
|
||||
}
|
||||
if ( $found ) {
|
||||
if( $css != '' )
|
||||
$css .= ';';
|
||||
$css .= $css_item;
|
||||
}
|
||||
}
|
||||
|
||||
return $css;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue