vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-12 12:50:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Filter fields through kses upon display. Introduce sanitize_user_object() and sanitize_user_field(). see #10751

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@11929 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Ryan Boren
2009-09-14 13:57:48 +00:00
parent e4045df0ab
commit b7f82a38b5
9 changed files with 260 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-includes/user.php
+117
View File
@@ -617,4 +617,121 @@ function _fill_user( &$user ) {
wp_cache_add($user->user_nicename, $user->ID, 'userslugs');
}
/**
* Sanitize every user field.
*
* If the context is 'raw', then the user object or array will get minimal santization of the int fields.
*
* @since 2.3.0
* @uses sanitize_user_field() Used to sanitize the fields.
*
* @param object|array $user The User Object or Array
* @param string $context Optional, default is 'display'. How to sanitize user fields.
* @return object|array The now sanitized User Object or Array (will be the same type as $user)
*/
function sanitize_user_object($user, $context = 'display') {
if ( is_object($user) ) {
if ( !isset($user->ID) )
$user->ID = 0;
if ( isset($user->data) )
$vars = get_object_vars( $user->data );
else
$vars = get_object_vars($user);
foreach ( array_keys($vars) as $field ) {
if ( is_array($user->$field) )
continue;
$user->$field = sanitize_user_field($field, $user->$field, $user->ID, $context);
}
$user->filter = $context;
} else {
if ( !isset($user['ID']) )
$user['ID'] = 0;
foreach ( array_keys($user) as $field )
$user[$field] = sanitize_user_field($field, $user[$field], $user['ID'], $context);
$user['filter'] = $context;
}
return $user;
}
/**
* Sanitize user field based on context.
*
* Possible context values are: 'raw', 'edit', 'db', 'display', 'attribute' and 'js'. The
* 'display' context is used by default. 'attribute' and 'js' contexts are treated like 'display'
* when calling filters.
*
* @since 2.3.0
* @uses apply_filters() Calls 'edit_$field' and '${field_no_prefix}_edit_pre' passing $value and
* $user_id if $context == 'edit' and field name prefix == 'user_'.
*
* @uses apply_filters() Calls 'edit_user_$field' passing $value and $user_id if $context == 'db'.
* @uses apply_filters() Calls 'pre_$field' passing $value if $context == 'db' and field name prefix == 'user_'.
* @uses apply_filters() Calls '${field}_pre' passing $value if $context == 'db' and field name prefix != 'user_'.
*
* @uses apply_filters() Calls '$field' passing $value, $user_id and $context if $context == anything
* other than 'raw', 'edit' and 'db' and field name prefix == 'user_'.
* @uses apply_filters() Calls 'user_$field' passing $value if $context == anything other than 'raw',
* 'edit' and 'db' and field name prefix != 'user_'.
*
* @param string $field The user Object field name.
* @param mixed $value The user Object value.
* @param int $user_id user ID.
* @param string $context How to sanitize user fields. Looks for 'raw', 'edit', 'db', 'display',
* 'attribute' and 'js'.
* @return mixed Sanitized value.
*/
function sanitize_user_field($field, $value, $user_id, $context) {
$int_fields = array('ID');
if ( in_array($field, $int_fields) )
$value = (int) $value;
if ( 'raw' == $context )
return $value;
if ( is_array($value) )
return $value;
$prefixed = false;
if ( false !== strpos($field, 'user_') ) {
$prefixed = true;
$field_no_prefix = str_replace('user_', '', $field);
}
if ( 'edit' == $context ) {
if ( $prefixed ) {
$value = apply_filters("edit_$field", $value, $user_id);
} else {
$value = apply_filters("edit_user_$field", $value, $user_id);
}
if ( 'description' == $field )
$value = esc_html($value);
else
$value = esc_attr($value);
} else if ( 'db' == $context ) {
if ( $prefixed ) {
$value = apply_filters("pre_$field", $value);
} else {
$value = apply_filters("pre_user_$field", $value);
}
} else {
// Use display filters by default.
if ( $prefixed )
$value = apply_filters($field, $value, $user_id, $context);
else
$value = apply_filters("user_$field", $value, $user_id, $context);
}
if ( 'user_url' == $field )
$value = esc_url($value);
if ( 'attribute' == $context )
$value = esc_attr($value);
else if ( 'js' == $context )
$value = esc_js($value);
return $value;
}
?>