| [ Index ] |
PHP Cross Reference of YOURLS |
[Summary view] [Print] [Text view]
1 <?php 2 /* 3 * YOURLS 4 * Function library for anything related to formatting / validating / sanitizing 5 */ 6 7 /** 8 * Convert an integer (1337) to a string (3jk). 9 * 10 * @param int $num Number to convert 11 * @param string $chars Characters to use for conversion 12 * @return string Converted number 13 */ 14 function yourls_int2string($num, $chars = null) { 15 if( $chars == null ) 16 $chars = yourls_get_shorturl_charset(); 17 $string = ''; 18 $len = strlen( $chars ); 19 while( $num >= $len ) { 20 $mod = bcmod( (string)$num, (string)$len ); 21 $num = bcdiv( (string)$num, (string)$len ); 22 $string = $chars[ $mod ] . $string; 23 } 24 $string = $chars[ intval( $num ) ] . $string; 25 26 return yourls_apply_filter( 'int2string', $string, $num, $chars ); 27 } 28 29 /** 30 * Convert a string (3jk) to an integer (1337) 31 * 32 * @param string $string String to convert 33 * @param string $chars Characters to use for conversion 34 * @return string Number (as a string) 35 */ 36 function yourls_string2int($string, $chars = null) { 37 if( $chars == null ) 38 $chars = yourls_get_shorturl_charset(); 39 $integer = 0; 40 $string = strrev( $string ); 41 $baselen = strlen( $chars ); 42 $inputlen = strlen( $string ); 43 for ($i = 0; $i < $inputlen; $i++) { 44 $index = strpos( $chars, $string[$i] ); 45 $integer = bcadd( (string)$integer, bcmul( (string)$index, bcpow( (string)$baselen, (string)$i ) ) ); 46 } 47 48 return yourls_apply_filter( 'string2int', $integer, $string, $chars ); 49 } 50 51 /** 52 * Return a unique string to be used as a valid HTML id 53 * 54 * @since 1.8.3 55 * @param string $prefix Optional prefix 56 * @param int $initial_val The initial counter value (defaults to one) 57 * @return string The unique string 58 */ 59 function yourls_unique_element_id($prefix = 'yid', $initial_val = 1) { 60 static $id_counter = 1; 61 if ($initial_val > 1) { 62 $id_counter = (int) $initial_val; 63 } 64 return yourls_apply_filter( 'unique_element_id', $prefix . (string) $id_counter++ ); 65 } 66 67 /** 68 * Make sure a link keyword (ie "1fv" as in "http://sho.rt/1fv") is acceptable 69 * 70 * If we are ADDING or EDITING a short URL, the keyword must comply to the short URL charset: every 71 * character that doesn't belong to it will be removed. 72 * But otherwise we must have a more conservative approach: we could be checking for a keyword that 73 * was once valid but now the short URL charset has changed. In such a case, we are treating the keyword for what 74 * it is: just a part of a URL, hence sanitize it as a URL. 75 * 76 * @param string $keyword short URL keyword 77 * @param bool $restrict_to_shorturl_charset Optional, default false. True if we want the keyword to comply to short URL charset 78 * @return string The sanitized keyword 79 */ 80 function yourls_sanitize_keyword( $keyword, $restrict_to_shorturl_charset = false ) { 81 if( $restrict_to_shorturl_charset === true ) { 82 // make a regexp pattern with the shorturl charset, and remove everything but this 83 $pattern = yourls_make_regexp_pattern( yourls_get_shorturl_charset() ); 84 $valid = (string) substr( preg_replace( '![^'.$pattern.']!', '', $keyword ), 0, 199 ); 85 } else { 86 $valid = yourls_sanitize_url( $keyword ); 87 } 88 89 return yourls_apply_filter( 'sanitize_string', $valid, $keyword, $restrict_to_shorturl_charset ); 90 } 91 92 /** 93 * Sanitize a page title. No HTML per W3C http://www.w3.org/TR/html401/struct/global.html#h-7.4.2 94 * 95 * 96 * @since 1.5 97 * @param string $unsafe_title Title, potentially unsafe 98 * @param string $fallback Optional fallback if after sanitization nothing remains 99 * @return string Safe title 100 */ 101 function yourls_sanitize_title( $unsafe_title, $fallback = '' ) { 102 $title = $unsafe_title; 103 $title = strip_tags( $title ); 104 $title = preg_replace( "/\s+/", ' ', trim( $title ) ); 105 106 if ( '' === $title || false === $title ) { 107 $title = $fallback; 108 } 109 110 return yourls_apply_filter( 'sanitize_title', $title, $unsafe_title, $fallback ); 111 } 112 113 /** 114 * A few sanity checks on the URL. Used for redirection or DB. 115 * For redirection when you don't trust the URL ($_SERVER variable, query string), see yourls_sanitize_url_safe() 116 * For display purpose, see yourls_esc_url() 117 * 118 * @param string $unsafe_url unsafe URL 119 * @param array $protocols Optional allowed protocols, default to global $yourls_allowedprotocols 120 * @return string Safe URL 121 */ 122 function yourls_sanitize_url( $unsafe_url, $protocols = array() ) { 123 $url = yourls_esc_url( $unsafe_url, 'redirection', $protocols ); 124 return yourls_apply_filter( 'sanitize_url', $url, $unsafe_url ); 125 } 126 127 /** 128 * A few sanity checks on the URL, including CRLF. Used for redirection when URL to be sanitized is critical and cannot be trusted. 129 * 130 * Use when critical URL comes from user input or environment variable. In such a case, this function will sanitize 131 * it like yourls_sanitize_url() but will also remove %0A and %0D to prevent CRLF injection. 132 * Still, some legit URLs contain %0A or %0D (see issue 2056, and for extra fun 1694, 1707, 2030, and maybe others) 133 * so we're not using this function unless it's used for internal redirection when the target location isn't 134 * hardcoded, to avoid XSS via CRLF 135 * 136 * @since 1.7.2 137 * @param string $unsafe_url unsafe URL 138 * @param array $protocols Optional allowed protocols, default to global $yourls_allowedprotocols 139 * @return string Safe URL 140 */ 141 function yourls_sanitize_url_safe( $unsafe_url, $protocols = array() ) { 142 $url = yourls_esc_url( $unsafe_url, 'safe', $protocols ); 143 return yourls_apply_filter( 'sanitize_url_safe', $url, $unsafe_url ); 144 } 145 146 /** 147 * Perform a replacement while a string is found, eg $subject = '%0%0%0DDD', $search ='%0D' -> $result ='' 148 * 149 * Stolen from WP's _deep_replace 150 * 151 * @param string|array $search Needle, or array of needles. 152 * @param string $subject Haystack. 153 * @return string The string with the replaced values. 154 */ 155 function yourls_deep_replace($search, $subject ){ 156 $found = true; 157 while($found) { 158 $found = false; 159 foreach( (array) $search as $val ) { 160 while( strpos( $subject, $val ) !== false ) { 161 $found = true; 162 $subject = str_replace( $val, '', $subject ); 163 } 164 } 165 } 166 167 return $subject; 168 } 169 170 /** 171 * Make sure an integer is a valid integer (PHP's intval() limits to too small numbers) 172 * 173 * @param int $int Integer to check 174 * @return string Integer as a string 175 */ 176 function yourls_sanitize_int($int ) { 177 return ( substr( preg_replace( '/[^0-9]/', '', strval( $int ) ), 0, 20 ) ); 178 } 179 180 /** 181 * Sanitize an IP address 182 * No check on validity, just return a sanitized string 183 * 184 * @param string $ip IP address 185 * @return string IP address 186 */ 187 function yourls_sanitize_ip($ip ) { 188 return preg_replace( '/[^0-9a-fA-F:., ]/', '', $ip ); 189 } 190 191 /** 192 * Make sure a date is m(m)/d(d)/yyyy, return false otherwise 193 * 194 * @param string $date Date to check 195 * @return false|mixed Date in format m(m)/d(d)/yyyy or false if invalid 196 */ 197 function yourls_sanitize_date($date ) { 198 if( !preg_match( '!^\d{1,2}/\d{1,2}/\d{4}$!' , $date ) ) { 199 return false; 200 } 201 return $date; 202 } 203 204 /** 205 * Sanitize a date for SQL search. Return false if malformed input. 206 * 207 * @param string $date Date 208 * @return false|string String in Y-m-d format for SQL search or false if malformed input 209 */ 210 function yourls_sanitize_date_for_sql($date) { 211 if( !yourls_sanitize_date( $date ) ) 212 return false; 213 return date( 'Y-m-d', strtotime( $date ) ); 214 } 215 216 /** 217 * Return trimmed string, optionally append '[...]' if string is too long 218 * 219 * @param string $string String to trim 220 * @param int $length Maximum length of string 221 * @param string $append String to append if trimmed 222 * @return string Trimmed string 223 */ 224 function yourls_trim_long_string($string, $length = 60, $append = '[...]') { 225 $newstring = $string; 226 if ( mb_strlen( $newstring ) > $length ) { 227 $newstring = mb_substr( $newstring, 0, $length - mb_strlen( $append ), 'UTF-8' ) . $append; 228 } 229 return yourls_apply_filter( 'trim_long_string', $newstring, $string, $length, $append ); 230 } 231 232 /** 233 * Sanitize a version number (1.4.1-whatever-RC1 -> 1.4.1) 234 * 235 * The regexp searches for the first digits, then a period, then more digits and periods, and discards 236 * all the rest. 237 * Examples: 238 * 'omgmysql-5.5-ubuntu-4.20' => '5.5' 239 * 'mysql5.5-ubuntu-4.20' => '5.5' 240 * '5.5-ubuntu-4.20' => '5.5' 241 * '5.5-beta2' => '5.5' 242 * '5.5' => '5.5' 243 * 244 * @since 1.4.1 245 * @param string $version Version number 246 * @return string Sanitized version number 247 */ 248 function yourls_sanitize_version( $version ) { 249 preg_match( '/([0-9]+\.[0-9.]+).*$/', $version, $matches ); 250 $version = isset($matches[1]) ? trim($matches[1], '.') : ''; 251 252 return $version; 253 } 254 255 /** 256 * Sanitize a filename (no Win32 stuff) 257 * 258 * @param string $file File name 259 * @return string|null Sanitized file name (or null if it's just backslashes, ok...) 260 */ 261 function yourls_sanitize_filename($file) { 262 $file = str_replace( '\\', '/', $file ); // sanitize for Win32 installs 263 $file = preg_replace( '|/+|' ,'/', $file ); // remove any duplicate slash 264 return $file; 265 } 266 267 /** 268 * Validate a JSONP callback name 269 * 270 * Check if the callback contains only safe characters: [a-zA-Z0-9_$.] 271 * Returns the original callback if valid, or false if invalid. 272 * 273 * Examples: 274 * - 'myCallback' => 'myCallback' 275 * - 'alert(1)' => false 276 * See tests/tests/format/JsonpCallbackTest.php for various cases covered 277 * 278 * @since 1.10.3 279 * @param string $callback Raw callback value 280 * @return string|false Original callback if valid, false otherwise 281 */ 282 function yourls_validate_jsonp_callback($callback ) { 283 $callback = (string) $callback; 284 285 // First, check for JavaScript unicode escape sequences like \u2028 or u2028 286 // They are sometimes used to smuggle line/paragraph separators. 287 if ( preg_match( '/\\\\?u[0-9a-fA-F]{4}/', $callback ) ) { 288 return yourls_apply_filter( 'validate_jsonp_callback_error', false, $callback ); 289 } 290 291 // Check if callback contains only safe characters [a-zA-Z0-9_$.] 292 if ( !preg_match( '/^[a-zA-Z0-9_$.]+$/', $callback ) ) { 293 return yourls_apply_filter( 'validate_jsonp_callback_error', false, $callback ); 294 } 295 296 // Callback is valid, return original value 297 return yourls_apply_filter( 'validate_jsonp_callback', $callback ); 298 } 299 300 /** 301 * Check if a string seems to be UTF-8. Stolen from WP. 302 * 303 * @param string $str String to check 304 * @return bool Whether string seems valid UTF-8 305 */ 306 function yourls_seems_utf8($str) { 307 $length = strlen( $str ); 308 for ( $i=0; $i < $length; $i++ ) { 309 $c = ord( $str[ $i ] ); 310 if ( $c < 0x80 ) $n = 0; # 0bbbbbbb 311 elseif (($c & 0xE0) == 0xC0) $n=1; # 110bbbbb 312 elseif (($c & 0xF0) == 0xE0) $n=2; # 1110bbbb 313 elseif (($c & 0xF8) == 0xF0) $n=3; # 11110bbb 314 elseif (($c & 0xFC) == 0xF8) $n=4; # 111110bb 315 elseif (($c & 0xFE) == 0xFC) $n=5; # 1111110b 316 else return false; # Does not match any model 317 for ($j=0; $j<$n; $j++) { # n bytes matching 10bbbbbb follow ? 318 if ((++$i == $length) || ((ord($str[$i]) & 0xC0) != 0x80)) 319 return false; 320 } 321 } 322 return true; 323 } 324 325 326 /** 327 * Check for PCRE /u modifier support. Stolen from WP. 328 * 329 * Just in case "PCRE is not compiled with PCRE_UTF8" which seems to happen 330 * on some distros 331 * 332 * @since 1.7.1 333 * 334 * @return bool whether there's /u support or not 335 */ 336 function yourls_supports_pcre_u() { 337 static $utf8_pcre; 338 if( !isset( $utf8_pcre ) ) { 339 $utf8_pcre = (bool) @preg_match( '/^./u', 'a' ); 340 } 341 return $utf8_pcre; 342 } 343 344 /** 345 * Checks for invalid UTF8 in a string. Stolen from WP 346 * 347 * @since 1.6 348 * 349 * @param string $string The text which is to be checked. 350 * @param boolean $strip Optional. Whether to attempt to strip out invalid UTF8. Default is false. 351 * @return string The checked text. 352 */ 353 function yourls_check_invalid_utf8( $string, $strip = false ) { 354 $string = (string) $string; 355 356 if ( 0 === strlen( $string ) ) { 357 return ''; 358 } 359 360 // We can't demand utf8 in the PCRE installation, so just return the string in those cases 361 if ( ! yourls_supports_pcre_u() ) { 362 return $string; 363 } 364 365 // preg_match fails when it encounters invalid UTF8 in $string 366 if ( 1 === @preg_match( '/^./us', $string ) ) { 367 return $string; 368 } 369 370 // Attempt to strip the bad chars if requested (not recommended) 371 if ( $strip && function_exists( 'iconv' ) ) { 372 return iconv( 'utf-8', 'utf-8', $string ); 373 } 374 375 return ''; 376 } 377 378 /** 379 * Converts a number of special characters into their HTML entities. Stolen from WP. 380 * 381 * Specifically deals with: &, <, >, ", and '. 382 * 383 * $quote_style can be set to ENT_COMPAT to encode " to 384 * ", or ENT_QUOTES to do both. Default is ENT_NOQUOTES where no quotes are encoded. 385 * 386 * @since 1.6 387 * 388 * @param string $string The text which is to be encoded. 389 * @param mixed $quote_style Optional. Converts double quotes if set to ENT_COMPAT, both single and double if set to ENT_QUOTES or none if set to ENT_NOQUOTES. Also compatible with old values; converting single quotes if set to 'single', double if set to 'double' or both if otherwise set. Default is ENT_NOQUOTES. 390 * @param boolean $double_encode Optional. Whether to encode existing html entities. Default is false. 391 * @return string The encoded text with HTML entities. 392 */ 393 function yourls_specialchars( $string, $quote_style = ENT_NOQUOTES, $double_encode = false ) { 394 $string = (string) $string; 395 396 if ( 0 === strlen( $string ) ) 397 return ''; 398 399 // Don't bother if there are no specialchars - saves some processing 400 if ( ! preg_match( '/[&<>"\']/', $string ) ) 401 return $string; 402 403 // Account for the previous behaviour of the function when the $quote_style is not an accepted value 404 if ( empty( $quote_style ) ) 405 $quote_style = ENT_NOQUOTES; 406 elseif ( ! in_array( $quote_style, array( 0, 2, 3, 'single', 'double' ), true ) ) 407 $quote_style = ENT_QUOTES; 408 409 $charset = 'UTF-8'; 410 411 $_quote_style = $quote_style; 412 413 if ( $quote_style === 'double' ) { 414 $quote_style = ENT_COMPAT; 415 $_quote_style = ENT_COMPAT; 416 } elseif ( $quote_style === 'single' ) { 417 $quote_style = ENT_NOQUOTES; 418 } 419 420 // Handle double encoding ourselves 421 if ( $double_encode ) { 422 $string = @htmlspecialchars( $string, $quote_style, $charset ); 423 } else { 424 // Decode & into & 425 $string = yourls_specialchars_decode( $string, $_quote_style ); 426 427 // Guarantee every &entity; is valid or re-encode the & 428 $string = yourls_kses_normalize_entities( $string ); 429 430 // Now re-encode everything except &entity; 431 $string = preg_split( '/(&#?x?[0-9a-z]+;)/i', $string, -1, PREG_SPLIT_DELIM_CAPTURE ); 432 433 for ( $i = 0; $i < count( $string ); $i += 2 ) 434 $string[$i] = @htmlspecialchars( $string[$i], $quote_style, $charset ); 435 436 $string = implode( '', $string ); 437 } 438 439 // Backwards compatibility 440 if ( 'single' === $_quote_style ) 441 $string = str_replace( "'", ''', $string ); 442 443 return $string; 444 } 445 446 /** 447 * Converts a number of HTML entities into their special characters. Stolen from WP. 448 * 449 * Specifically deals with: &, <, >, ", and '. 450 * 451 * $quote_style can be set to ENT_COMPAT to decode " entities, 452 * or ENT_QUOTES to do both " and '. Default is ENT_NOQUOTES where no quotes are decoded. 453 * 454 * @since 1.6 455 * 456 * @param string $string The text which is to be decoded. 457 * @param mixed $quote_style Optional. Converts double quotes if set to ENT_COMPAT, both single and double if set to ENT_QUOTES or none if set to ENT_NOQUOTES. Also compatible with old _wp_specialchars() values; converting single quotes if set to 'single', double if set to 'double' or both if otherwise set. Default is ENT_NOQUOTES. 458 * @return string The decoded text without HTML entities. 459 */ 460 function yourls_specialchars_decode( $string, $quote_style = ENT_NOQUOTES ) { 461 $string = (string) $string; 462 463 if ( 0 === strlen( $string ) ) { 464 return ''; 465 } 466 467 // Don't bother if there are no entities - saves a lot of processing 468 if ( strpos( $string, '&' ) === false ) { 469 return $string; 470 } 471 472 // Match the previous behaviour of _wp_specialchars() when the $quote_style is not an accepted value 473 if ( empty( $quote_style ) ) { 474 $quote_style = ENT_NOQUOTES; 475 } elseif ( !in_array( $quote_style, array( 0, 2, 3, 'single', 'double' ), true ) ) { 476 $quote_style = ENT_QUOTES; 477 } 478 479 // More complete than get_html_translation_table( HTML_SPECIALCHARS ) 480 $single = array( ''' => '\'', ''' => '\'' ); 481 $single_preg = array( '/�*39;/' => ''', '/�*27;/i' => ''' ); 482 $double = array( '"' => '"', '"' => '"', '"' => '"' ); 483 $double_preg = array( '/�*34;/' => '"', '/�*22;/i' => '"' ); 484 $others = array( '<' => '<', '<' => '<', '>' => '>', '>' => '>', '&' => '&', '&' => '&', '&' => '&' ); 485 $others_preg = array( '/�*60;/' => '<', '/�*62;/' => '>', '/�*38;/' => '&', '/�*26;/i' => '&' ); 486 487 $translation = $translation_preg = []; 488 489 if ( $quote_style === ENT_QUOTES ) { 490 $translation = array_merge( $single, $double, $others ); 491 $translation_preg = array_merge( $single_preg, $double_preg, $others_preg ); 492 } elseif ( $quote_style === ENT_COMPAT || $quote_style === 'double' ) { 493 $translation = array_merge( $double, $others ); 494 $translation_preg = array_merge( $double_preg, $others_preg ); 495 } elseif ( $quote_style === 'single' ) { 496 $translation = array_merge( $single, $others ); 497 $translation_preg = array_merge( $single_preg, $others_preg ); 498 } elseif ( $quote_style === ENT_NOQUOTES ) { 499 $translation = $others; 500 $translation_preg = $others_preg; 501 } 502 503 // Remove zero padding on numeric entities 504 $string = preg_replace( array_keys( $translation_preg ), array_values( $translation_preg ), $string ); 505 506 // Replace characters according to translation table 507 return strtr( $string, $translation ); 508 } 509 510 511 /** 512 * Escaping for HTML blocks. Stolen from WP 513 * 514 * @since 1.6 515 * 516 * @param string $text 517 * @return string 518 */ 519 function yourls_esc_html( $text ) { 520 $safe_text = yourls_check_invalid_utf8( $text ); 521 $safe_text = yourls_specialchars( $safe_text, ENT_QUOTES ); 522 return yourls_apply_filter( 'esc_html', $safe_text, $text ); 523 } 524 525 /** 526 * Escape HTML text, but allow some tags and attributes. 527 * 528 * Useful when you want to allow only some HTML tags in a string (<a href='..'>, <b>...) 529 * Escape everything first with yourls_esc_html(), then selectively un-escape only whitelisted 530 * tags and attributes. Attributes not listed are stripped, href/src values are sanitized. 531 * 532 * @since 1.10.5 533 * @param string $string String to escape 534 * @param array $allowed Tag => [attr => true, ...] map, or null for KSES defaults 535 * @return string 536 */ 537 function yourls_esc_html_with_whitelist(string $string, array $allowed = []): string { 538 $string = yourls_esc_html($string); 539 540 if (empty($allowed)) { 541 return $string; 542 } 543 544 $allowed = yourls_kses_array_lc($allowed); 545 546 return preg_replace_callback( 547 '/<(\/?)([\w]+)(.*?)>/', 548 function ($m) use ($allowed) { 549 $closing = $m[1]; 550 $tag = strtolower($m[2]); 551 $raw = $m[3]; 552 553 if (!isset($allowed[$tag])) { 554 return $m[0]; 555 } 556 557 if ($closing === '/') { 558 return "</$tag>"; 559 } 560 561 $attrs = ''; 562 $allowed_attrs = $allowed[$tag]; 563 564 if (!empty($allowed_attrs) && $raw !== '') { 565 preg_match_all( 566 '/\s+([\w-]+)=(?:"(.*?)"|'(.*?)')/', 567 $raw, 568 $matches, 569 PREG_SET_ORDER 570 ); 571 572 foreach ($matches as $match) { 573 $name = strtolower($match[1]); 574 $value = ($match[2] ?? '') !== '' ? $match[2] : ($match[3] ?? ''); 575 576 if (empty($allowed_attrs[$name])) { 577 continue; 578 } 579 580 $value = html_entity_decode($value, ENT_QUOTES, 'UTF-8'); 581 $value = yourls_kses_no_null($value); 582 583 if ($name === 'href' || $name === 'src') { 584 $value = yourls_sanitize_url($value); 585 } 586 587 $value = yourls_esc_attr($value); 588 $attrs .= " $name=\"$value\""; 589 } 590 } 591 592 return "<$tag$attrs>"; 593 }, 594 $string 595 ); 596 } 597 598 /** 599 * Escaping for HTML attributes. Stolen from WP 600 * 601 * @since 1.6 602 * 603 * @param string $text 604 * @return string 605 */ 606 function yourls_esc_attr( $text ) { 607 $safe_text = yourls_check_invalid_utf8( $text ); 608 $safe_text = yourls_specialchars( $safe_text, ENT_QUOTES ); 609 return yourls_apply_filter( 'esc_attr', $safe_text, $text ); 610 } 611 612 /** 613 * Checks and cleans a URL before printing it. Stolen from WP. 614 * 615 * A number of characters are removed from the URL. If the URL is for displaying 616 * (the default behaviour) ampersands are also replaced. 617 * 618 * This function by default "escapes" URL for display purpose (param $context = 'display') but can 619 * take extra steps in URL sanitization. See yourls_sanitize_url() and yourls_sanitize_url_safe() 620 * 621 * @since 1.6 622 * 623 * @param string $url The URL to be cleaned. 624 * @param string $context 'display' or something else. Use yourls_sanitize_url() for database or redirection usage. 625 * @param array $protocols Optional. Array of allowed protocols, defaults to global $yourls_allowedprotocols 626 * @return string The cleaned $url 627 */ 628 function yourls_esc_url( $url, $context = 'display', $protocols = array() ) { 629 // trim first -- see #1931 630 $url = trim( $url ); 631 632 // make sure there's only one 'http://' at the beginning (prevents pasting a URL right after the default 'http://') 633 $url = str_replace( 634 array( 'http://http://', 'http://https://' ), 635 array( 'http://', 'https://' ), 636 $url 637 ); 638 639 if ( '' == $url ) 640 return $url; 641 642 $original_url = $url; 643 644 // force scheme and domain to lowercase - see issues 591 and 1630 645 $url = yourls_normalize_uri( $url ); 646 647 $url = preg_replace( '|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\\\\\x80-\\xff]|i', '', $url ); 648 // The replace above allows backslashes now, but we only should only allow them after a query string or a fragment identifier 649 $url = yourls_remove_backslashes_before_query_fragment($url); 650 651 // Previous regexp in YOURLS was '|[^a-z0-9-~+_.?\[\]\^#=!&;,/:%@$\|*`\'<>"()\\x80-\\xff\{\}]|i' 652 // TODO: check if that was it too destructive 653 654 // If $context is 'safe', an extra step is taken to make sure no CRLF injection is possible. 655 // To be used when $url can be forged by evil user (eg it's from a $_SERVER variable, a query string, etc..) 656 if ( 'safe' == $context ) { 657 $strip = array( '%0d', '%0a', '%0D', '%0A' ); 658 $url = yourls_deep_replace( $strip, $url ); 659 } 660 661 // Decode the URL as a browser would, to check its scheme below. Do it before the display 662 // escaping, which can only disarm references: this way display and storage reject the same URLs. 663 $protocol_url = yourls_decode_url_for_protocol_check( $url ); 664 665 // Replace ampersands and single quotes only when displaying. 666 if ( 'display' == $context ) { 667 $url = yourls_kses_normalize_entities( $url ); 668 $url = str_replace( '&', '&', $url ); 669 $url = str_replace( "'", ''', $url ); 670 } 671 672 // If there's a protocol, make sure it's OK. Check the decoded URL, so an encoded scheme 673 // (eg "javascript:") cannot bypass the allowed list 674 if( yourls_get_protocol($protocol_url) !== '' ) { 675 if ( ! is_array( $protocols ) or ! $protocols ) { 676 global $yourls_allowedprotocols; 677 $protocols = yourls_apply_filter( 'esc_url_protocols', $yourls_allowedprotocols ); 678 // Note: $yourls_allowedprotocols is also globally filterable in functions-kses.php/yourls_kses_init() 679 } 680 681 if ( !yourls_is_allowed_protocol( $protocol_url, $protocols ) ) 682 return ''; 683 684 // I didn't use KSES function kses_bad_protocol() because it doesn't work the way I liked (returns //blah from illegal://blah) 685 } 686 687 return yourls_apply_filter( 'esc_url', $url, $original_url, $context ); 688 } 689 690 /** 691 * Decode a URL before we read the scheme 692 * 693 * This returns the URL as the browser sees it, to be used only to check the scheme with yourls_get_protocol(), 694 * never as the URL itself. 695 * Control characters and spaces are removed everywhere, which is stricter than a browser. 696 * 697 * @since 1.10.7 698 * @param string $url URL 699 * @return string Decoded URL 700 */ 701 function yourls_decode_url_for_protocol_check(string $url): string { 702 // Single pass: a browser decodes references once, so "&#58;" must give ":", not ":" 703 $url = preg_replace_callback( 704 '/&(#[xX][0-9a-fA-F]+|#[0-9]+|[a-zA-Z][a-zA-Z0-9]*);?/', 705 function (array $matches): string { 706 return html_entity_decode('&' . $matches[1] . ';', ENT_QUOTES | ENT_HTML5, 'UTF-8'); 707 }, 708 $url 709 ); 710 711 // Remove control characters (\x00 NUL, \x09 tab, \x0A line feed, ...) and \x7F delete 712 return preg_replace('/[\x00-\x20\x7F]/', '', $url); 713 } 714 715 /** 716 * Remove backslashes before query string or fragment identifier 717 * 718 * This function removes backslashes before the first ? or #, if any. 719 * If there's no ? or #, all backslashes are removed. 720 * See issue #3802 and PR #3998 721 * 722 * @since 1.10.3 723 * @param string $url URL 724 * @return string URL without backslashes before query string or fragment identifier 725 */ 726 function yourls_remove_backslashes_before_query_fragment(string $url): string { 727 $posQ = strpos($url, '?'); 728 $posH = strpos($url, '#'); 729 730 if ($posQ === false && $posH === false) { 731 // no ? or # -> remove all backslashes 732 return str_replace('\\', '', $url); 733 } 734 735 // chose the first of ? or # 736 if ($posQ === false) { 737 $pos = $posH; 738 } elseif ($posH === false) { 739 $pos = $posQ; 740 } else { 741 $pos = min($posQ, $posH); 742 } 743 744 $before = substr($url, 0, $pos); 745 $after = substr($url, $pos); 746 747 $before = str_replace('\\', '', $before); 748 749 return $before . $after; 750 } 751 752 /** 753 * Normalize a URI : lowercase scheme and domain, convert IDN to UTF8 754 * 755 * All in one example: 'HTTP://XN--mgbuq0c.Com/AbCd' -> 'http://طارق.com/AbCd' 756 * See issues 591, 1630, 1889, 2691 757 * 758 * This function is trickier than what seems to be needed at first 759 * 760 * First, we need to handle several URI types: http://example.com, mailto:[email protected], facetime:[email protected], and so on, see 761 * yourls_kses_allowed_protocols() in functions-kses.php 762 * The general rule is that the scheme ("stuff://" or "stuff:") is case insensitive and should be lowercase. But then, depending on the 763 * scheme, parts of what follows the scheme may or may not be case sensitive. 764 * 765 * Second, simply using parse_url() and its opposite http_build_url() is a pretty unsafe process: 766 * - parse_url() can easily trip up on malformed or weird URLs 767 * - exploding a URL with parse_url(), lowercasing some stuff, and glueing things back with http_build_url() does not handle well 768 * "stuff:"-like URI [1] and can result in URLs ending modified [2][3]. We don't want to *validate* URI, we just want to lowercase 769 * what is supposed to be lowercased. 770 * 771 * So, to be conservative, this function: 772 * - lowercases the scheme 773 * - does not lowercase anything else on "stuff:" URI 774 * - tries to lowercase only scheme and domain of "stuff://" URI 775 * 776 * [1] http_build_url(parse_url("mailto:ozh")) == "mailto:///ozh" 777 * [2] http_build_url(parse_url("http://blah#omg")) == "http://blah/#omg" 778 * [3] http_build_url(parse_url("http://blah?#")) == "http://blah/" 779 * 780 * @since 1.7.1 781 * @param string $url URL 782 * @return string URL with lowercase scheme and protocol 783 */ 784 function yourls_normalize_uri( $url ) { 785 $scheme = yourls_get_protocol( $url ); 786 787 if ('' == $scheme) { 788 // Scheme not found, malformed URL? Something else? Not sure. 789 return $url; 790 } 791 792 /** 793 * Case 1 : scheme like "stuff:", as opposed to "stuff://" 794 * Examples: "mailto:[email protected]" or "bitcoin:15p1o8vnWqNkJBJGgwafNgR1GCCd6EGtQR?amount=1&label=Ozh" 795 * In this case, we only lowercase the scheme, because depending on it, things after should or should not be lowercased 796 */ 797 if (substr($scheme, -2, 2) != '//') { 798 $url = str_replace( $scheme, strtolower( $scheme ), $url ); 799 return $url; 800 } 801 802 /** 803 * Case 2 : scheme like "stuff://" (eg "http://example.com/" or "ssh://[email protected]") 804 * Here we lowercase the scheme and domain parts 805 */ 806 $parts = parse_url($url); 807 808 // Most likely malformed stuff, could not parse : we'll just lowercase the scheme and leave the rest untouched 809 if (false == $parts) { 810 $url = str_replace( $scheme, strtolower( $scheme ), $url ); 811 return $url; 812 } 813 814 // URL seems parsable, let's do the best we can 815 $lower = array(); 816 $lower['scheme'] = strtolower( $parts['scheme'] ); 817 if( isset( $parts['host'] ) ) { 818 // Convert domain to lowercase, with mb_ to preserve UTF8 819 $lower['host'] = mb_strtolower($parts['host']); 820 /** 821 * Convert IDN domains to their UTF8 form so that طارق.net and xn--mgbuq0c.net 822 * are considered the same. Explicitly mention option and variant to avoid notice 823 * on PHP 7.2 and 7.3 824 */ 825 $lower['host'] = idn_to_utf8($lower['host'], IDNA_DEFAULT, INTL_IDNA_VARIANT_UTS46); 826 } 827 828 $url = http_build_url($url, $lower); 829 830 return $url; 831 } 832 833 834 /** 835 * Escape single quotes, htmlspecialchar " < > &, and fix line endings. Stolen from WP. 836 * 837 * Escapes text strings for echoing in JS. It is intended to be used for inline JS 838 * (in a tag attribute, for example onclick="..."). Note that the strings have to 839 * be in single quotes. The filter 'js_escape' is also applied here. 840 * 841 * @since 1.6 842 * 843 * @param string $text The text to be escaped. 844 * @return string Escaped text. 845 */ 846 function yourls_esc_js( $text ) { 847 $safe_text = yourls_check_invalid_utf8( $text ); 848 $safe_text = yourls_specialchars( $safe_text, ENT_COMPAT ); 849 $safe_text = preg_replace( '/&#(x)?0*(?(1)27|39);?/i', "'", stripslashes( $safe_text ) ); 850 $safe_text = str_replace( "\r", '', $safe_text ); 851 $safe_text = str_replace( "\n", '\\n', addslashes( $safe_text ) ); 852 return yourls_apply_filter( 'esc_js', $safe_text, $text ); 853 } 854 855 /** 856 * Escaping for textarea values. Stolen from WP. 857 * 858 * @since 1.6 859 * 860 * @param string $text 861 * @return string 862 */ 863 function yourls_esc_textarea( $text ) { 864 $safe_text = htmlspecialchars( $text, ENT_QUOTES ); 865 return yourls_apply_filter( 'esc_textarea', $safe_text, $text ); 866 } 867 868 /** 869 * Adds backslashes before letters and before a number at the start of a string. Stolen from WP. 870 * 871 * @since 1.6 872 * @param string $string Value to which backslashes will be added. 873 * @return string String with backslashes inserted. 874 */ 875 function yourls_backslashit($string) { 876 $string = preg_replace('/^([0-9])/', '\\\\\\\\\1', (string)$string); 877 $string = preg_replace('/([a-z])/i', '\\\\\1', (string)$string); 878 return $string; 879 } 880 881 /** 882 * Check if a string seems to be urlencoded 883 * 884 * We use rawurlencode instead of urlencode to avoid messing with '+' 885 * 886 * @since 1.7 887 * @param string $string 888 * @return bool 889 */ 890 function yourls_is_rawurlencoded( $string ) { 891 return rawurldecode( $string ) != $string; 892 } 893 894 /** 895 * rawurldecode a string till it's not encoded anymore 896 * 897 * Deals with multiple encoding (eg "%2521" => "%21" => "!"). 898 * See https://github.com/YOURLS/YOURLS/issues/1303 899 * 900 * @since 1.7 901 * @param string $string 902 * @return string 903 */ 904 function yourls_rawurldecode_while_encoded( $string ) { 905 $string = rawurldecode( $string ); 906 if( yourls_is_rawurlencoded( $string ) ) { 907 $string = yourls_rawurldecode_while_encoded( $string ); 908 } 909 return $string; 910 } 911 912 /** 913 * Converts readable Javascript code into a valid bookmarklet link 914 * 915 * Uses https://github.com/ozh/bookmarkletgen 916 * 917 * @since 1.7.1 918 * @param string $code Javascript code 919 * @return string Bookmarklet link 920 */ 921 function yourls_make_bookmarklet( $code ) { 922 $book = new \Ozh\Bookmarkletgen\Bookmarkletgen; 923 return $book->crunch( $code ); 924 } 925 926 /** 927 * Return a timestamp, plus or minus the time offset if defined 928 * 929 * @since 1.7.10 930 * @param string|int $timestamp a timestamp 931 * @return int a timestamp, plus or minus offset if defined 932 */ 933 function yourls_get_timestamp( $timestamp ) { 934 $offset = yourls_get_time_offset(); 935 $timestamp_offset = (int)$timestamp + ($offset * 3600); 936 937 return yourls_apply_filter( 'get_timestamp', $timestamp_offset, $timestamp, $offset ); 938 } 939 940 /** 941 * Get time offset, as defined in config, filtered 942 * 943 * @since 1.7.10 944 * @return int Time offset 945 */ 946 function yourls_get_time_offset() { 947 $offset = defined('YOURLS_HOURS_OFFSET') ? (int)YOURLS_HOURS_OFFSET : 0; 948 return yourls_apply_filter( 'get_time_offset', $offset ); 949 } 950 951 /** 952 * Return a date() format for a full date + time, filtered 953 * 954 * @since 1.7.10 955 * @param string $format Date format string 956 * @return string Date format string 957 */ 958 function yourls_get_datetime_format( $format ) { 959 return yourls_apply_filter( 'get_datetime_format', (string)$format ); 960 } 961 962 /** 963 * Return a date() format for date (no time), filtered 964 * 965 * @since 1.7.10 966 * @param string $format Date format string 967 * @return string Date format string 968 */ 969 function yourls_get_date_format( $format ) { 970 return yourls_apply_filter( 'get_date_format', (string)$format ); 971 } 972 973 /** 974 * Return a date() format for a time (no date), filtered 975 * 976 * @since 1.7.10 977 * @param string $format Date format string 978 * @return string Date format string 979 */ 980 function yourls_get_time_format( $format ) { 981 return yourls_apply_filter( 'get_time_format', (string)$format ); 982 }
title
Description
Body
title
Description
Body
title
Description
Body
title
Body
| Generated: Mon Nov 9 05:10:31 2026 | Cross-referenced by PHPXref 0.7.1 |