Changeset 1890

Timestamp:

12/31/2008 11:02:40 AM (17 years ago)

Author:

sambauers

Message:

Validate UTF8 via wp_check_invalid_utf8() when running attribute_escape(), introduce wp_entities()

Location:

branches/0.9/bb-includes

Files:

• compat.php (modified) (1 diff)
• wp-functions.php (modified) (2 diffs)

branches/0.9/bb-includes/compat.php

@@ -28 +28 @@
 }
 endif;
+
+if ( !function_exists( 'htmlspecialchars_decode' ) ) {
+    // Added in PHP 5.1.0
+    // from php.net (modified by Sam Bauers to deal with some quirks in HTML_SPECIALCHARS constant)
+    function htmlspecialchars_decode( $str, $quote_style = ENT_COMPAT ) {
+        $table = array_flip( get_html_translation_table( HTML_SPECIALCHARS, $quote_style ) );
+        $table = array_merge( array( ''' => "'" ), $table, array( '&' => "&", '&' => "&" ) );
+        return strtr( $str, $table );
+    }
+}
 ?>

branches/0.9/bb-includes/wp-functions.php

@@ -76 +76 @@
 endif;
 
+if ( !function_exists( 'wp_entities' ) ) :
+/**
+ * Converts all special characters into their HTML entities.
+ *
+ * $quote_style can be set to ENT_COMPAT to encode " to
+ * ", or ENT_QUOTES to do both. Default is ENT_NOQUOTES where no quotes are encoded.
+ *
+ * @since 2.8
+ *
+ * @param string $string The text which is to be encoded.
+ * @param mixed $quote_style Optional. Converts double quotes if set to ENT_COMPAT, both single and double if set to ENT_QUOTES or none if set to ENT_NOQUOTES. Default is ENT_NOQUOTES.
+ * @param string $charset Optional. The character encoding of the string. Default is false.
+ * @param boolean $double_encode Optional. Whether or not to encode existing html entities. Default is false.
+ * @return string The encoded text with HTML entities.
+ */
+function wp_entities( $string, $quote_style = ENT_NOQUOTES, $charset = false, $double_encode = false )
+{
+    if ( 0 === strlen( $string ) ) {
+        return '';
+    }
+
+    if ( !$charset ) {
+        $charset = bb_get_option( 'charset' );
+    }
+    if ( in_array( $charset, array( 'utf8', 'utf-8', 'UTF8' ) ) ) {
+        $charset = 'UTF-8';
+    }
+
+    if ( version_compare( PHP_VERSION, '5.2.3', '>=' ) ) {
+        $string = htmlentities( $string, $quote_style, $charset, $double_encode );
+    } else {
+        // Handle double encoding for PHP versions that don't support it in htmlentities()
+        if ( !$double_encode ) {
+            // Multi-byte charsets are not supported below PHP 5.0.0
+            // 'cp866', 'cp1251', 'KOI8-R' charsets are not supported below PHP 4.3.2
+            $string = html_entity_decode( $string, $quote_style, $charset );
+        }
+        // 'cp866', 'cp1251', 'KOI8-R' charsets are not supported below PHP 4.3.2
+        $string = htmlentities( $string, $quote_style, $charset );
+    }
+
+    return $string;
+}
+endif;
+
+if ( !function_exists( 'wp_check_invalid_utf8' ) ) :
+/**
+ * Checks for invalid UTF8 in a string.
+ *
+ * @since 2.8
+ *
+ * @param string $string The text which is to be checked.
+ * @param boolean $strip Optional. Whether to attempt to strip out invalid UTF8. Default is false.
+ * @return string The checked text.
+ */
+function wp_check_invalid_utf8( $string, $strip = false )
+{
+    if ( 0 === strlen( $string ) ) {
+        return '';
+    }
+
+    if ( !in_array( bb_get_option( 'charset' ), array( 'utf8', 'utf-8', 'UTF8', 'UTF-8' ) ) ) {
+        return $string;
+    }
+
+    // preg_match fails when it encounters invalid UTF8 in $str
+    if ( 1 === @preg_match( '@^.@us', $string ) ) {
+        return $string;
+    }
+
+    if ( $strip && function_exists( 'iconv' ) ) {
+        return iconv( 'utf-8', 'utf-8', $string );
+    } else {
+        return '';
+    }
+}
+endif;
+
 if ( !function_exists('utf8_uri_encode') ) : // [WP6314]
 function utf8_uri_encode( $utf8_string, $length = 0 ) {
@@ -147 +225 @@
 // Escaping for HTML attributes
 if ( !function_exists('attribute_escape') ) :
-function attribute_escape($text) { // [WP4660]
-    $safe_text = wp_specialchars($text, true);
+function attribute_escape($text) { // Not like WordPress - uses wp_check_invalid_utf8() and wp_entities()
+    $safe_text = wp_check_invalid_utf8( $text );
+    $safe_text = wp_entities( $safe_text, ENT_QUOTES );
     return apply_filters('attribute_escape', $safe_text, $text);
 }