* @license GPL-2.0+ * @link http://wptheming.com * @copyright 2010-2014 WP Theming */ /** * Sanitization for text input * * @link http://developer.wordpress.org/reference/functions/sanitize_text_field/ */ add_filter( 'of_sanitize_text', 'sanitize_text_field' ); /** * Sanitization for password input * * @link http://developer.wordpress.org/reference/functions/sanitize_text_field/ */ add_filter( 'of_sanitize_password', 'sanitize_text_field' ); /** * Sanitization for select input * * Validates that the selected option is a valid option. */ add_filter( 'of_sanitize_select', 'of_sanitize_enum', 10, 2 ); /** * Sanitization for radio input * * Validates that the selected option is a valid option. */ add_filter( 'of_sanitize_radio', 'of_sanitize_enum', 10, 2 ); /** * Sanitization for image selector * * Validates that the selected option is a valid option. */ add_filter( 'of_sanitize_images', 'of_sanitize_enum', 10, 2 ); /** * Sanitization for textarea field * * @param $input string * @return $output sanitized string */ function of_sanitize_textarea( $input ) { global $allowedposttags; $output = wp_kses( $input, $allowedposttags ); return $output; } add_filter( 'of_sanitize_textarea', 'of_sanitize_textarea' ); /** * Sanitization for raw code fields (theme's own and user's CSS / JS). * * 为什么不能复用 textarea：textarea 走 wp_kses()，CSS 里的子选择器 * `>`、`+`、`~` 以及 JS 里的比较运算符 `<`、`>` 都会被当成 HTML 标签 * 剥掉。例：`a > b { }` 存进库会变成 `a b { }`，样式静默失效。 * 所以这里只做三件必要的事： * 1. 去掉 PHP 标签，避免这段文本将来被 eval / include 时执行代码； * 2. 把 ``、`` 打断，避免提前闭合输出标签； * 3. 其余内容原样返回（含反斜杠转义，如 CSS 的 `\f101`）。 * * @param $input string * @return $output sanitized string */ function of_sanitize_code( $input ) { if ( ! is_string( $input ) ) { return ''; } $output = str_replace( array( '' ), '', $input ); $output = preg_replace( '# '', 'image' => '', 'repeat' => 'repeat', 'position' => 'top center', 'attachment' => 'scroll' ) ); $output['color'] = apply_filters( 'of_sanitize_hex', $input['color'] ); $output['image'] = apply_filters( 'of_sanitize_upload', $input['image'] ); return $output; } add_filter( 'of_sanitize_background', 'of_sanitize_background' ); /** * Sanitize a color represented in hexidecimal notation. * * @param string Color in hexidecimal notation. "#" may or may not be prepended to the string. * @param string The value that this function should return if it cannot be recognized as a color. * @return string */ function of_sanitize_hex( $hex, $default = '' ) { if ( of_validate_hex( $hex ) ) { return $hex; } return $default; } add_filter( 'of_sanitize_color', 'of_sanitize_hex' ); /** * Is a given string a color formatted in hexidecimal notation? * * @param string Color in hexidecimal notation. "#" may or may not be prepended to the string. * @return bool */ function of_validate_hex( $hex ) { $hex = trim( $hex ); /* Strip recognized prefixes. */ if ( 0 === strpos( $hex, '#' ) ) { $hex = substr( $hex, 1 ); } elseif ( 0 === strpos( $hex, '%23' ) ) { $hex = substr( $hex, 3 ); } /* Regex match. */ if ( 0 === preg_match( '/^[0-9a-fA-F]{6}$/', $hex ) ) { return false; } else { return true; } }