[ Index ]

PHP Cross Reference of WordPress Trunk (Updated Daily)

title

Body

[close]

/wp-includes/ -> kses.php (summary)

kses 0.2.2 - HTML/XHTML filter that only allows some elements and attributes Copyright (C) 2002, 2003, 2005  Ulf Harnhammar This program is free software and open source software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

Author: Ulf Harnhammar <http://advogato.org/person/metaur/>
Copyright: (C) 2002, 2003, 2005
Version: 0.2.2
File Size: 2278 lines (57 kb)
Included or required: 1 time
Referenced: 0 times
Includes or requires: 0 files

Defines 41 functions

  wp_kses()
  wp_kses_one_attr()
  wp_kses_allowed_html()
  wp_kses_hook()
  wp_kses_version()
  wp_kses_split()
  wp_kses_uri_attributes()
  _wp_kses_split_callback()
  wp_kses_split2()
  wp_kses_attr()
  wp_kses_attr_check()
  wp_kses_hair()
  wp_kses_attr_parse()
  wp_kses_hair_parse()
  wp_kses_check_attr_val()
  wp_kses_bad_protocol()
  wp_kses_no_null()
  wp_kses_stripslashes()
  wp_kses_array_lc()
  wp_kses_html_error()
  wp_kses_bad_protocol_once()
  wp_kses_bad_protocol_once2()
  wp_kses_normalize_entities()
  wp_kses_named_entities()
  wp_kses_normalize_entities2()
  wp_kses_normalize_entities3()
  valid_unicode()
  wp_kses_decode_entities()
  _wp_kses_decode_entities_chr()
  _wp_kses_decode_entities_chr_hexdec()
  wp_filter_kses()
  wp_kses_data()
  wp_filter_post_kses()
  wp_kses_post()
  wp_kses_post_deep()
  wp_filter_nohtml_kses()
  kses_init_filters()
  kses_remove_filters()
  kses_init()
  safecss_filter_attr()
  _wp_add_global_attributes()

Functions
Functions that are not part of a class:

wp_kses( $string, $allowed_html, $allowed_protocols = array()   X-Ref
Filters text content and strips out disallowed HTML.

This function makes sure that only the allowed HTML element names, attribute
names, attribute values, and HTML entities will occur in the given text string.

This function expects unslashed data.

return: string Filtered content containing only the allowed HTML.
param: string         $string            Text content to filter.
param: array[]|string $allowed_html      An array of allowed HTML elements and attributes, or a
param: string[]       $allowed_protocols Array of allowed URL protocols.

wp_kses_one_attr( $string, $element )   X-Ref
Filters one HTML attribute and ensures its value is allowed.

This function can escape data in some situations where `wp_kses()` must strip the whole attribute.

return: string Filtered attribute.
param: string $string  The 'whole' attribute, including name and value.
param: string $element The HTML element name to which the attribute belongs.

wp_kses_allowed_html( $context = '' )   X-Ref
Returns an array of allowed HTML tags and attributes for a given context.

return: array Array of allowed HTML tags and their allowed attributes.
param: string|array $context The context for which to retrieve tags. Allowed values are 'post',

wp_kses_hook( $string, $allowed_html, $allowed_protocols )   X-Ref
You add any KSES hooks here.

There is currently only one KSES WordPress hook, {@see 'pre_kses'}, and it is called here.
All parameters are passed to the hooks and expected to receive a string.

return: string Filtered content through {@see 'pre_kses'} hook.
param: string          $string            Content to filter through KSES.
param: array[]|string  $allowed_html      List of allowed HTML elements.
param: string[]        $allowed_protocols Array of allowed URL protocols.

wp_kses_version()   X-Ref
Returns the version number of KSES.

return: string KSES version number.

wp_kses_split( $string, $allowed_html, $allowed_protocols )   X-Ref
Searches for HTML tags, no matter how malformed.

It also matches stray `>` characters.

return: string Content with fixed HTML tags
param: string   $string            Content to filter.
param: array    $allowed_html      Allowed HTML elements.
param: string[] $allowed_protocols Array of allowed URL protocols.

wp_kses_uri_attributes()   X-Ref
Helper function listing HTML attributes containing a URL.

This function returns a list of all HTML attributes that must contain
a URL according to the HTML specification.

This list includes URI attributes both allowed and disallowed by KSES.

return: array HTML attributes that must include a URL.

_wp_kses_split_callback( $match )   X-Ref
Callback for `wp_kses_split()`.

return: string

wp_kses_split2( $string, $allowed_html, $allowed_protocols )   X-Ref
Callback for `wp_kses_split()` for fixing malformed HTML tags.

This function does a lot of work. It rejects some very malformed things like
`<:::>`. It returns an empty string, if the element isn't allowed (look ma, no
`strip_tags()`!). Otherwise it splits the tag into an element and an attribute
list.

After the tag is split into an element and an attribute list, it is run
through another filter which will remove illegal attributes and once that is
completed, will be returned.

return: string Fixed HTML element
param: string   $string            Content to filter.
param: array    $allowed_html      Allowed HTML elements.
param: string[] $allowed_protocols Array of allowed URL protocols.

wp_kses_attr( $element, $attr, $allowed_html, $allowed_protocols )   X-Ref
Removes all attributes, if none are allowed for this element.

If some are allowed it calls `wp_kses_hair()` to split them further, and then
it builds up new HTML code from the data that `kses_hair()` returns. It also
removes `<` and `>` characters, if there are any left. One more thing it does
is to check if the tag has a closing XHTML slash, and if it does, it puts one
in the returned code as well.

return: string Sanitized HTML element.
param: string   $element           HTML element/tag.
param: string   $attr              HTML attributes from HTML element to closing HTML element tag.
param: array    $allowed_html      Allowed HTML elements.
param: string[] $allowed_protocols Array of allowed URL protocols.

wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html )   X-Ref
Determines whether an attribute is allowed.

return: bool Whether or not the attribute is allowed.
param: string $name         The attribute name. Passed by reference. Returns empty string when not allowed.
param: string $value        The attribute value. Passed by reference. Returns a filtered value.
param: string $whole        The `name=value` input. Passed by reference. Returns filtered input.
param: string $vless        Whether the attribute is valueless. Use 'y' or 'n'.
param: string $element      The name of the element to which this attribute belongs.
param: array  $allowed_html The full list of allowed elements and attributes.

wp_kses_hair( $attr, $allowed_protocols )   X-Ref
Builds an attribute list from string containing attributes.

This function does a lot of work. It parses an attribute list into an array
with attribute data, and tries to do the right thing even if it gets weird
input. It will add quotes around attribute values that don't have any quotes
or apostrophes around them, to make it easier to produce HTML code that will
conform to W3C's HTML specification. It will also remove bad URL protocols
from attribute values. It also reduces duplicate attributes by using the
attribute defined first (`foo='bar' foo='baz'` will result in `foo='bar'`).

return: array[] Array of attribute information after parsing.
param: string   $attr              Attribute list from HTML element to closing HTML element tag.
param: string[] $allowed_protocols Array of allowed URL protocols.

wp_kses_attr_parse( $element )   X-Ref
Finds all attributes of an HTML element.

Does not modify input.  May return "evil" output.

Based on `wp_kses_split2()` and `wp_kses_attr()`.

return: array|bool List of attributes found in the element. Returns false on failure.
param: string $element HTML element.

wp_kses_hair_parse( $attr )   X-Ref
Builds an attribute list from string containing attributes.

Does not modify input.  May return "evil" output.
In case of unexpected input, returns false instead of stripping things.

Based on `wp_kses_hair()` but does not return a multi-dimensional array.

return: array|bool List of attributes found in $attr. Returns false on failure.
param: string $attr Attribute list from HTML element to closing HTML element tag.

wp_kses_check_attr_val( $value, $vless, $checkname, $checkvalue )   X-Ref
Performs different checks for attribute values.

The currently implemented checks are "maxlen", "minlen", "maxval", "minval",
and "valueless".

return: bool Whether check passes.
param: string $value      Attribute value.
param: string $vless      Whether the attribute is valueless. Use 'y' or 'n'.
param: string $checkname  What $checkvalue is checking for.
param: mixed  $checkvalue What constraint the value should pass.

wp_kses_bad_protocol( $string, $allowed_protocols )   X-Ref
Sanitizes a string and removed disallowed URL protocols.

This function removes all non-allowed protocols from the beginning of the
string. It ignores whitespace and the case of the letters, and it does
understand HTML entities. It does its work recursively, so it won't be
fooled by a string like `javascript:javascript:alert(57)`.

return: string Filtered content.
param: string   $string            Content to filter bad protocols from.
param: string[] $allowed_protocols Array of allowed URL protocols.

wp_kses_no_null( $string, $options = null )   X-Ref
Removes any invalid control characters in a text string.

Also removes any instance of the `\0` string.

return: string Filtered content.
param: string $string  Content to filter null characters from.
param: array  $options Set 'slash_zero' => 'keep' when '\0' is allowed. Default is 'remove'.

wp_kses_stripslashes( $string )   X-Ref
Strips slashes from in front of quotes.

This function changes the character sequence `\"` to just `"`. It leaves all other
slashes alone. The quoting from `preg_replace(//e)` requires this.

return: string Fixed string with quoted slashes.
param: string $string String to strip slashes from.

wp_kses_array_lc( $inarray )   X-Ref
Converts the keys of an array to lowercase.

return: array Fixed array with all lowercase keys.
param: array $inarray Unfiltered array.

wp_kses_html_error( $string )   X-Ref
Handles parsing errors in `wp_kses_hair()`.

The general plan is to remove everything to and including some whitespace,
but it deals with quotes and apostrophes as well.

return: string
param: string $string

wp_kses_bad_protocol_once( $string, $allowed_protocols, $count = 1 )   X-Ref
Sanitizes content from bad protocols and other characters.

This function searches for URL protocols at the beginning of the string, while
handling whitespace and HTML entities.

return: string Sanitized content.
param: string   $string            Content to check for bad protocols.
param: string[] $allowed_protocols Array of allowed URL protocols.

wp_kses_bad_protocol_once2( $string, $allowed_protocols )   X-Ref
Callback for `wp_kses_bad_protocol_once()` regular expression.

This function processes URL protocols, checks to see if they're in the
whitelist or not, and returns different data depending on the answer.

return: string Sanitized content.
param: string   $string            URI scheme to check against the whitelist.
param: string[] $allowed_protocols Array of allowed URL protocols.

wp_kses_normalize_entities( $string )   X-Ref
Converts and fixes HTML entities.

This function normalizes HTML entities. It will convert `AT&T` to the correct
`AT&amp;T`, `&#00058;` to `&#58;`, `&#XYZZY;` to `&amp;#XYZZY;` and so on.

return: string Content with normalized entities.
param: string $string Content to normalize entities.

wp_kses_named_entities( $matches )   X-Ref
Callback for `wp_kses_normalize_entities()` regular expression.

This function only accepts valid named entity references, which are finite,
case-sensitive, and highly scrutinized by HTML and XML validators.

return: string Correctly encoded entity.
param: array $matches preg_replace_callback() matches array.

wp_kses_normalize_entities2( $matches )   X-Ref
Callback for `wp_kses_normalize_entities()` regular expression.

This function helps `wp_kses_normalize_entities()` to only accept 16-bit
values and nothing more for `&#number;` entities.

return: string Correctly encoded entity.
param: array $matches `preg_replace_callback()` matches array.

wp_kses_normalize_entities3( $matches )   X-Ref
Callback for `wp_kses_normalize_entities()` for regular expression.

This function helps `wp_kses_normalize_entities()` to only accept valid Unicode
numeric entities in hex form.

return: string Correctly encoded entity.
param: array $matches `preg_replace_callback()` matches array.

valid_unicode( $i )   X-Ref
Determines if a Unicode codepoint is valid.

return: bool Whether or not the codepoint is a valid Unicode codepoint.
param: int $i Unicode codepoint.

wp_kses_decode_entities( $string )   X-Ref
Converts all numeric HTML entities to their named counterparts.

This function decodes numeric HTML entities (`&#65;` and `&#x41;`).
It doesn't do anything with named entities like `&auml;`, but we don't
need them in the URL protocol whitelisting system anyway.

return: string Content after decoded entities.
param: string $string Content to change entities.

_wp_kses_decode_entities_chr( $match )   X-Ref
Regex callback for `wp_kses_decode_entities()`.

return: string
param: array $match preg match

_wp_kses_decode_entities_chr_hexdec( $match )   X-Ref
Regex callback for `wp_kses_decode_entities()`.

return: string
param: array $match preg match

wp_filter_kses( $data )   X-Ref
Sanitize content with allowed HTML KSES rules.

This function expects slashed data.

return: string Filtered content.
param: string $data Content to filter, expected to be escaped with slashes.

wp_kses_data( $data )   X-Ref
Sanitize content with allowed HTML KSES rules.

This function expects unslashed data.

return: string Filtered content.
param: string $data Content to filter, expected to not be escaped.

wp_filter_post_kses( $data )   X-Ref
Sanitizes content for allowed HTML tags for post content.

Post content refers to the page contents of the 'post' type and not `$_POST`
data from forms.

This function expects slashed data.

return: string Filtered post content with allowed HTML tags and attributes intact.
param: string $data Post content to filter, expected to be escaped with slashes.

wp_kses_post( $data )   X-Ref
Sanitizes content for allowed HTML tags for post content.

Post content refers to the page contents of the 'post' type and not `$_POST`
data from forms.

This function expects unslashed data.

return: string Filtered post content with allowed HTML tags and attributes intact.
param: string $data Post content to filter.

wp_kses_post_deep( $data )   X-Ref
Navigates through an array, object, or scalar, and sanitizes content for
allowed HTML tags for post content.

return: mixed The filtered content.
param: mixed $data The array, object, or scalar value to inspect.

wp_filter_nohtml_kses( $data )   X-Ref
Strips all HTML from a text string.

This function expects slashed data.

return: string Filtered content without any HTML.
param: string $data Content to strip all HTML from.

kses_init_filters()   X-Ref
Adds all KSES input form content filters.

All hooks have default priority. The `wp_filter_kses()` function is added to
the 'pre_comment_content' and 'title_save_pre' hooks.

The `wp_filter_post_kses()` function is added to the 'content_save_pre',
'excerpt_save_pre', and 'content_filtered_save_pre' hooks.


kses_remove_filters()   X-Ref
Removes all KSES input form content filters.

A quick procedural method to removing all of the filters that KSES uses for
content in WordPress Loop.

Does not remove the `kses_init()` function from {@see 'init'} hook (priority is
default). Also does not remove `kses_init()` function from {@see 'set_current_user'}
hook (priority is also default).


kses_init()   X-Ref
Sets up most of the KSES filters for input form content.

First removes all of the KSES filters in case the current user does not need
to have KSES filter the content. If the user does not have `unfiltered_html`
capability, then KSES filters are added.


safecss_filter_attr( $css, $deprecated = '' )   X-Ref
Filters an inline style attribute and removes disallowed rules.

return: string Filtered string of CSS rules.
param: string $css        A string of CSS rules.
param: string $deprecated Not used.

_wp_add_global_attributes( $value )   X-Ref
Helper function to add global attributes to a tag in the allowed html list.

return: array The array of attributes with global attributes added.
param: array $value An array of attributes.



Generated: Tue Jul 23 08:20:01 2019 Cross-referenced by PHPXref 0.7