sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

In WP_oEmbed, only allow __call() to run against a whitelist of methods, $compat_methods.

Browse Source 
See #30891.


git-svn-id: https://develop.svn.wordpress.org/trunk@31148 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Scott Taylor 2015-01-11 22:26:55 +00:00
parent 5b6858eff8
commit cd3fde69bb
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/wp-includes/class-oembed.php
View File

@ -21,6 +21,8 @@ class WP_oEmbed {
public $providers = array();
public static $early_providers = array();
private $compat_methods = array( '_fetch_with_format', '_parse_json', '_parse_xml', '_parse_body' );
/**
* Constructor
*
@ -170,8 +172,11 @@ class WP_oEmbed {
* @return mixed|bool Return value of the callback, false otherwise.
*/
public function __call( $name, $arguments ) {
if ( in_array( $name, $this->compat_methods ) ) {
return call_user_func_array( array( $this, $name ), $arguments );
}
return false;
}
/**
* Takes a URL and returns the corresponding oEmbed provider's URL, if there is one.