| [ Index ] |
PHP Cross Reference of WordPress Trunk (Updated Daily) |
[Source view] [Print] [Project Stats]
kses 0.2.2 - HTML/XHTML filter that only allows some elements and attributes Copyright (C) 2002, 2003, 2005 Ulf Harnhammar This program is free software and open source software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
| Author: | Ulf Harnhammar |
| Copyright: | (C) 2002, 2003, 2005 |
| Version: | 0.2.2 |
| File Size: | 2780 lines (74 kb) |
| Included or required: | 1 time |
| Referenced: | 0 times |
| Includes or requires: | 0 files |
| wp_kses( $content, $allowed_html, $allowed_protocols = array() X-Ref |
| Filters text content and strips out disallowed HTML. This function makes sure that only the allowed HTML element names, attribute names, attribute values, and HTML entities will occur in the given text string. This function expects unslashed data. param: string $content Text content to filter. param: array[]|string $allowed_html An array of allowed HTML elements and attributes, param: string[] $allowed_protocols Optional. Array of allowed URL protocols. return: string Filtered content containing only the allowed HTML. |
| wp_kses_one_attr( $attr, $element ) X-Ref |
| Filters one HTML attribute and ensures its value is allowed. This function can escape data in some situations where `wp_kses()` must strip the whole attribute. param: string $attr The 'whole' attribute, including name and value. param: string $element The HTML element name to which the attribute belongs. return: string Filtered attribute. |
| wp_kses_allowed_html( $context = '' ) X-Ref |
| Returns an array of allowed HTML tags and attributes for a given context. param: string|array $context The context for which to retrieve tags. Allowed values are 'post', return: array Array of allowed HTML tags and their allowed attributes. |
| wp_kses_hook( $content, $allowed_html, $allowed_protocols ) X-Ref |
| You add any KSES hooks here. There is currently only one KSES WordPress hook, {@see 'pre_kses'}, and it is called here. All parameters are passed to the hooks and expected to receive a string. param: string $content Content to filter through KSES. param: array[]|string $allowed_html An array of allowed HTML elements and attributes, param: string[] $allowed_protocols Array of allowed URL protocols. return: string Filtered content through {@see 'pre_kses'} hook. |
| wp_kses_version() X-Ref |
| Returns the version number of KSES. return: string KSES version number. |
| wp_kses_split( $content, $allowed_html, $allowed_protocols ) X-Ref |
| Searches for HTML tags, no matter how malformed. It also matches stray `>` characters. param: string $content Content to filter. param: array[]|string $allowed_html An array of allowed HTML elements and attributes, param: string[] $allowed_protocols Array of allowed URL protocols. return: string Content with fixed HTML tags |
| wp_kses_uri_attributes() X-Ref |
| Returns an array of HTML attribute names whose value contains a URL. This function returns a list of all HTML attributes that must contain a URL according to the HTML specification. This list includes URI attributes both allowed and disallowed by KSES. return: string[] HTML attribute names whose value contains a URL. |
| _wp_kses_split_callback( $matches ) X-Ref |
| Callback for `wp_kses_split()`. param: array $matches preg_replace regexp matches return: string |
| wp_kses_split2( $content, $allowed_html, $allowed_protocols ) X-Ref |
| Callback for `wp_kses_split()` for fixing malformed HTML tags. This function does a lot of work. It rejects some very malformed things like `<:::>`. It returns an empty string, if the element isn't allowed (look ma, no `strip_tags()`!). Otherwise it splits the tag into an element and an attribute list. After the tag is split into an element and an attribute list, it is run through another filter which will remove illegal attributes and once that is completed, will be returned. param: string $content Content to filter. param: array[]|string $allowed_html An array of allowed HTML elements and attributes, param: string[] $allowed_protocols Array of allowed URL protocols. return: string Fixed HTML element |
| wp_kses_attr( $element, $attr, $allowed_html, $allowed_protocols ) X-Ref |
| Removes all attributes, if none are allowed for this element. If some are allowed it calls `wp_kses_hair()` to split them further, and then it builds up new HTML code from the data that `wp_kses_hair()` returns. It also removes `<` and `>` characters, if there are any left. One more thing it does is to check if the tag has a closing XHTML slash, and if it does, it puts one in the returned code as well. An array of allowed values can be defined for attributes. If the attribute value doesn't fall into the list, the attribute will be removed from the tag. Attributes can be marked as required. If a required attribute is not present, KSES will remove all attributes from the tag. As KSES doesn't match opening and closing tags, it's not possible to safely remove the tag itself, the safest fallback is to strip all attributes from the tag, instead. param: string $element HTML element/tag. param: string $attr HTML attributes from HTML element to closing HTML element tag. param: array[]|string $allowed_html An array of allowed HTML elements and attributes, param: string[] $allowed_protocols Array of allowed URL protocols. return: string Sanitized HTML element. |
| wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) X-Ref |
| No description |
| wp_kses_hair( $attr, $allowed_protocols ) X-Ref |
| Builds an attribute list from string containing attributes. This function does a lot of work. It parses an attribute list into an array with attribute data, and tries to do the right thing even if it gets weird input. It will add quotes around attribute values that don't have any quotes or apostrophes around them, to make it easier to produce HTML code that will conform to W3C's HTML specification. It will also remove bad URL protocols from attribute values. It also reduces duplicate attributes by using the attribute defined first (`foo='bar' foo='baz'` will result in `foo='bar'`). param: string $attr Attribute list from HTML element to closing HTML element tag. param: string[] $allowed_protocols Array of allowed URL protocols. return: array[] Array of attribute information after parsing. |
| wp_kses_attr_parse( $element ) X-Ref |
| Finds all attributes of an HTML element. Does not modify input. May return "evil" output. Based on `wp_kses_split2()` and `wp_kses_attr()`. param: string $element HTML element. return: array|false List of attributes found in the element. Returns false on failure. |
| wp_kses_hair_parse( $attr ) X-Ref |
| Builds an attribute list from string containing attributes. Does not modify input. May return "evil" output. In case of unexpected input, returns false instead of stripping things. Based on `wp_kses_hair()` but does not return a multi-dimensional array. param: string $attr Attribute list from HTML element to closing HTML element tag. return: array|false List of attributes found in $attr. Returns false on failure. |
| wp_kses_check_attr_val( $value, $vless, $checkname, $checkvalue ) X-Ref |
| Performs different checks for attribute values. The currently implemented checks are "maxlen", "minlen", "maxval", "minval", and "valueless". param: string $value Attribute value. param: string $vless Whether the attribute is valueless. Use 'y' or 'n'. param: string $checkname What $checkvalue is checking for. param: mixed $checkvalue What constraint the value should pass. return: bool Whether check passes. |
| wp_kses_bad_protocol( $content, $allowed_protocols ) X-Ref |
| Sanitizes a string and removed disallowed URL protocols. This function removes all non-allowed protocols from the beginning of the string. It ignores whitespace and the case of the letters, and it does understand HTML entities. It does its work recursively, so it won't be fooled by a string like `javascript:javascript:alert(57)`. param: string $content Content to filter bad protocols from. param: string[] $allowed_protocols Array of allowed URL protocols. return: string Filtered content. |
| wp_kses_no_null( $content, $options = null ) X-Ref |
| Removes any invalid control characters in a text string. Also removes any instance of the `\0` string. param: string $content Content to filter null characters from. param: array $options Set 'slash_zero' => 'keep' when '\0' is allowed. Default is 'remove'. return: string Filtered content. |
| wp_kses_stripslashes( $content ) X-Ref |
| Strips slashes from in front of quotes. This function changes the character sequence `\"` to just `"`. It leaves all other slashes alone. The quoting from `preg_replace(//e)` requires this. param: string $content String to strip slashes from. return: string Fixed string with quoted slashes. |
| wp_kses_array_lc( $inarray ) X-Ref |
| Converts the keys of an array to lowercase. param: array $inarray Unfiltered array. return: array Fixed array with all lowercase keys. |
| wp_kses_html_error( $attr ) X-Ref |
| Handles parsing errors in `wp_kses_hair()`. The general plan is to remove everything to and including some whitespace, but it deals with quotes and apostrophes as well. param: string $attr return: string |
| wp_kses_bad_protocol_once( $content, $allowed_protocols, $count = 1 ) X-Ref |
| Sanitizes content from bad protocols and other characters. This function searches for URL protocols at the beginning of the string, while handling whitespace and HTML entities. param: string $content Content to check for bad protocols. param: string[] $allowed_protocols Array of allowed URL protocols. param: int $count Depth of call recursion to this function. return: string Sanitized content. |
| wp_kses_bad_protocol_once2( $scheme, $allowed_protocols ) X-Ref |
| Callback for `wp_kses_bad_protocol_once()` regular expression. This function processes URL protocols, checks to see if they're in the list of allowed protocols or not, and returns different data depending on the answer. param: string $scheme URI scheme to check against the list of allowed protocols. param: string[] $allowed_protocols Array of allowed URL protocols. return: string Sanitized content. |
| wp_kses_normalize_entities( $content, $context = 'html' ) X-Ref |
| Converts and fixes HTML entities. This function normalizes HTML entities. It will convert `AT&T` to the correct `AT&T`, `:` to `:`, `&#XYZZY;` to `&#XYZZY;` and so on. When `$context` is set to 'xml', HTML entities are converted to their code points. For example, `AT&T…&#XYZZY;` is converted to `AT&T…&#XYZZY;`. param: string $content Content to normalize entities. param: string $context Context for normalization. Can be either 'html' or 'xml'. return: string Content with normalized entities. |
| wp_kses_named_entities( $matches ) X-Ref |
| Callback for `wp_kses_normalize_entities()` regular expression. This function only accepts valid named entity references, which are finite, case-sensitive, and highly scrutinized by HTML and XML validators. param: array $matches preg_replace_callback() matches array. return: string Correctly encoded entity. |
| wp_kses_xml_named_entities( $matches ) X-Ref |
| Callback for `wp_kses_normalize_entities()` regular expression. This function only accepts valid named entity references, which are finite, case-sensitive, and highly scrutinized by XML validators. HTML named entity references are converted to their code points. param: array $matches preg_replace_callback() matches array. return: string Correctly encoded entity. |
| wp_kses_normalize_entities2( $matches ) X-Ref |
| Callback for `wp_kses_normalize_entities()` regular expression. This function helps `wp_kses_normalize_entities()` to only accept 16-bit values and nothing more for `&#number;` entities. param: array $matches `preg_replace_callback()` matches array. return: string Correctly encoded entity. |
| wp_kses_normalize_entities3( $matches ) X-Ref |
| Callback for `wp_kses_normalize_entities()` for regular expression. This function helps `wp_kses_normalize_entities()` to only accept valid Unicode numeric entities in hex form. param: array $matches `preg_replace_callback()` matches array. return: string Correctly encoded entity. |
| valid_unicode( $i ) X-Ref |
| Determines if a Unicode codepoint is valid. param: int $i Unicode codepoint. return: bool Whether or not the codepoint is a valid Unicode codepoint. |
| wp_kses_decode_entities( $content ) X-Ref |
| Converts all numeric HTML entities to their named counterparts. This function decodes numeric HTML entities (`A` and `A`). It doesn't do anything with named entities like `ä`, but we don't need them in the allowed URL protocols system anyway. param: string $content Content to change entities. return: string Content after decoded entities. |
| _wp_kses_decode_entities_chr( $matches ) X-Ref |
| Regex callback for `wp_kses_decode_entities()`. param: array $matches preg match return: string |
| _wp_kses_decode_entities_chr_hexdec( $matches ) X-Ref |
| Regex callback for `wp_kses_decode_entities()`. param: array $matches preg match return: string |
| wp_filter_kses( $data ) X-Ref |
| Sanitize content with allowed HTML KSES rules. This function expects slashed data. param: string $data Content to filter, expected to be escaped with slashes. return: string Filtered content. |
| wp_kses_data( $data ) X-Ref |
| Sanitize content with allowed HTML KSES rules. This function expects unslashed data. param: string $data Content to filter, expected to not be escaped. return: string Filtered content. |
| wp_filter_post_kses( $data ) X-Ref |
| Sanitizes content for allowed HTML tags for post content. Post content refers to the page contents of the 'post' type and not `$_POST` data from forms. This function expects slashed data. param: string $data Post content to filter, expected to be escaped with slashes. return: string Filtered post content with allowed HTML tags and attributes intact. |
| wp_filter_global_styles_post( $data ) X-Ref |
| Sanitizes global styles user content removing unsafe rules. param: string $data Post content to filter. return: string Filtered post content with unsafe rules removed. |
| wp_kses_post( $data ) X-Ref |
| Sanitizes content for allowed HTML tags for post content. Post content refers to the page contents of the 'post' type and not `$_POST` data from forms. This function expects unslashed data. param: string $data Post content to filter. return: string Filtered post content with allowed HTML tags and attributes intact. |
| wp_kses_post_deep( $data ) X-Ref |
| Navigates through an array, object, or scalar, and sanitizes content for allowed HTML tags for post content. param: mixed $data The array, object, or scalar value to inspect. return: mixed The filtered content. |
| wp_filter_nohtml_kses( $data ) X-Ref |
| Strips all HTML from a text string. This function expects slashed data. param: string $data Content to strip all HTML from. return: string Filtered content without any HTML. |
| kses_init_filters() X-Ref |
| Adds all KSES input form content filters. All hooks have default priority. The `wp_filter_kses()` function is added to the 'pre_comment_content' and 'title_save_pre' hooks. The `wp_filter_post_kses()` function is added to the 'content_save_pre', 'excerpt_save_pre', and 'content_filtered_save_pre' hooks. |
| kses_remove_filters() X-Ref |
| Removes all KSES input form content filters. A quick procedural method to removing all of the filters that KSES uses for content in WordPress Loop. Does not remove the `kses_init()` function from {@see 'init'} hook (priority is default). Also does not remove `kses_init()` function from {@see 'set_current_user'} hook (priority is also default). |
| kses_init() X-Ref |
| Sets up most of the KSES filters for input form content. First removes all of the KSES filters in case the current user does not need to have KSES filter the content. If the user does not have `unfiltered_html` capability, then KSES filters are added. |
| safecss_filter_attr( $css, $deprecated = '' ) X-Ref |
| Filters an inline style attribute and removes disallowed rules. param: string $css A string of CSS rules. param: string $deprecated Not used. return: string Filtered string of CSS rules. |
| _wp_add_global_attributes( $value ) X-Ref |
| Helper function to add global attributes to a tag in the allowed HTML list. param: array $value An array of attributes. return: array The array of attributes with global attributes added. |
| _wp_kses_allow_pdf_objects( $url ) X-Ref |
| Helper function to check if this is a safe PDF URL. param: string $url The URL to check. return: bool True if the URL is safe, false otherwise. |
| Generated : Thu Nov 21 08:20:01 2024 | Cross-referenced by PHPXref |