← All changes | library/core-functions.php +36 -36 20230914 → 20260916 View file →

		@@ -79,44 +79,44 @@
79	79	$patterns[9] = "/%%author%%/";
80	80	$patterns[10] = "/%%url%%/";
81	81
82	82	$replacements = array();
83		- $replacements[0] = $title;
84		- $replacements[1] = $thumb[0];
85		- $replacements[2] = $medium[0];
86		- $replacements[3] = $large[0];
87		- $replacements[4] = $full[0];
88		- $replacements[5] = $custom[0];
	83	+ $replacements[0] = esc_attr($title);
	84	+ $replacements[1] = esc_url($thumb[0]);
	85	+ $replacements[2] = esc_url($medium[0]);
	86	+ $replacements[3] = esc_url($large[0]);
	87	+ $replacements[4] = esc_url($full[0]);
	88	+ $replacements[5] = esc_url($custom[0]);
89	89
90	90	if (stripos($markup, '%%thumb%%')) {
91	91
92		- $replacements[6] = $thumb[1];
93		- $replacements[7] = $thumb[2];
	92	+ $replacements[6] = esc_attr($thumb[1]);
	93	+ $replacements[7] = esc_attr($thumb[2]);
94	94
95	95	} elseif (stripos($markup, '%%medium%%')) {
96	96
97		- $replacements[6] = $medium[1];
98		- $replacements[7] = $medium[2];
	97	+ $replacements[6] = esc_attr($medium[1]);
	98	+ $replacements[7] = esc_attr($medium[2]);
99	99
100	100	} elseif (stripos($markup, '%%large%%')) {
101	101
102		- $replacements[6] = $large[1];
103		- $replacements[7] = $large[2];
	102	+ $replacements[6] = esc_attr($large[1]);
	103	+ $replacements[7] = esc_attr($large[2]);
104	104
105	105	} elseif (stripos($markup, '%%full%%')) {
106	106
107		- $replacements[6] = $full[1];
108		- $replacements[7] = $full[2];
	107	+ $replacements[6] = esc_attr($full[1]);
	108	+ $replacements[7] = esc_attr($full[2]);
109	109
110	110	} elseif (stripos($markup, '%%custom%%')) {
111	111
112		- $replacements[6] = $custom[1];
113		- $replacements[7] = $custom[2];
	112	+ $replacements[6] = esc_attr($custom[1]);
	113	+ $replacements[7] = esc_attr($custom[2]);
114	114	}
115	115
116		- $replacements[8] = $parent_title;
117		- $replacements[9] = $author;
118		- $replacements[10] = $url;
	116	+ $replacements[8] = esc_attr($parent_title);
	117	+ $replacements[9] = esc_attr($author);
	118	+ $replacements[10] = esc_url($url);
119	119
120	120	$image = preg_replace($patterns, $replacements, $markup);
121	121
122	122	return $image;
		@@ -145,11 +145,11 @@
145	145	$patterns[1] = "/%%email%%/";
146	146	$patterns[2] = "/%%title%%/";
147	147
148	148	$replacements = array();
149		- $replacements[0] = $author;
150		- $replacements[1] = $email;
151		- $replacements[2] = $title;
	149	+ $replacements[0] = esc_attr($author);
	150	+ $replacements[1] = esc_attr($email);
	151	+ $replacements[2] = esc_attr($title);
152	152
153	153	$markup = preg_replace($patterns, $replacements, $markup);
154	154
155	155	if ($enable === 'before') $content = $markup . $content;
		@@ -183,9 +183,9 @@
183	183	$patterns = array();
184	184	$patterns[0] = "/%%author%%/";
185	185
186	186	$replacements = array();
187		- $replacements[0] = $author;
	187	+ $replacements[0] = esc_attr($author);
188	188
189	189	$markup = preg_replace($patterns, $replacements, $markup);
190	190
191	191	if ($enable === 'before') $content = $markup . $content;
		@@ -222,11 +222,11 @@
222	222	$patterns[1] = "/%%url%%/";
223	223	$patterns[2] = "/%%title%%/";
224	224
225	225	$replacements = array();
226		- $replacements[0] = $author;
227		- $replacements[1] = $url;
228		- $replacements[2] = $title;
	226	+ $replacements[0] = esc_attr($author);
	227	+ $replacements[1] = esc_url($url);
	228	+ $replacements[2] = esc_attr($title);
229	229
230	230	$markup = preg_replace($patterns, $replacements, $markup);
231	231
232	232	if ($enable === 'before') $content = $markup . $content;
		@@ -271,13 +271,13 @@
271	271	$patterns[3] = "/%%custom_value_2%%/";
272	272	$patterns[4] = "/%%title%%/";
273	273
274	274	$replacements = array();
275		- $replacements[0] = $author;
276		- $replacements[1] = $label;
277		- $replacements[2] = $name;
278		- $replacements[3] = $value;
279		- $replacements[4] = $title;
	275	+ $replacements[0] = esc_attr(wp_kses_post($author));
	276	+ $replacements[1] = esc_attr(wp_kses_post($label));
	277	+ $replacements[2] = esc_attr(wp_kses_post($name));
	278	+ $replacements[3] = esc_attr(wp_kses_post($value));
	279	+ $replacements[4] = esc_attr(wp_kses_post($title));
280	280
281	281	$markup = preg_replace($patterns, $replacements, $markup);
282	282
283	283	if ($enable === 'before') $content = $markup . $content;
		@@ -322,13 +322,13 @@
322	322	$patterns[3] = "/%%custom_value%%/";
323	323	$patterns[4] = "/%%title%%/";
324	324
325	325	$replacements = array();
326		- $replacements[0] = $author;
327		- $replacements[1] = $label;
328		- $replacements[2] = $name;
329		- $replacements[3] = $value;
330		- $replacements[4] = $title;
	326	+ $replacements[0] = esc_attr(wp_kses_post($author));
	327	+ $replacements[1] = esc_attr(wp_kses_post($label));
	328	+ $replacements[2] = esc_attr(wp_kses_post($name));
	329	+ $replacements[3] = esc_attr(wp_kses_post($value));
	330	+ $replacements[4] = esc_attr(wp_kses_post($title));
331	331
332	332	$markup = preg_replace($patterns, $replacements, $markup);
333	333
334	334	if ($enable === 'before') $content = $markup . $content;