rs from.
* @param array $options Set 'slash_zero' => 'keep' when '\0' is allowed. Default is 'remove'.
* @return string Filtered content.
*/
function wp_kses_no_null( $content, $options = null ) {
if ( ! isset( $options['slash_zero'] ) ) {
$options = array( 'slash_zero' => 'remove' );
}
$content = preg_replace( '/[\x00-\x08\x0B\x0C\x0E-\x1F]/', '', $content );
if ( 'remove' === $options['slash_zero'] ) {
$content = preg_replace( '/\\\\+0+/', '', $content );
}
return $content;
}
/**
* Strips slashes from in front of quotes.
*
* This function changes the character sequence `\"` to just `"`. It leaves all other
* slashes alone. The quoting from `preg_replace(//e)` requires this.
*
* @since 1.0.0
*
* @param string $content String to strip slashes from.
* @return string Fixed string with quoted slashes.
*/
function wp_kses_stripslashes( $content ) {
return preg_replace( '%\\\\"%', '"', $content );
}
/**
* Converts the keys of an array to lowercase.
*
* @since 1.0.0
*
* @param array $inarray Unfiltered array.
* @return array Fixed array with all lowercase keys.
*/
function wp_kses_array_lc( $inarray ) {
$outarray = array();
foreach ( (array) $inarray as $inkey => $inval ) {
$outkey = strtolower( $inkey );
$outarray[ $outkey ] = array();
foreach ( (array) $inval as $inkey2 => $inval2 ) {
$outkey2 = strtolower( $inkey2 );
$outarray[ $outkey ][ $outkey2 ] = $inval2;
}
}
return $outarray;
}
/**
* Handles parsing errors in `wp_kses_hair()`.
*
* The general plan is to remove everything to and including some whitespace,
* but it deals with quotes and apostrophes as well.
*
* @since 1.0.0
*
* @param string $attr
* @return string
*/
function wp_kses_html_error( $attr ) {
return preg_replace( '/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $attr );
}
/**
* Sanitizes content from bad protocols and other characters.
*
* This function searches for URL protocols at the beginning of the string, while
* handling whitespace and HTML entities.
*
* @since 1.0.0
*
* @param string $content Content to check for bad protocols.
* @param string[] $allowed_protocols Array of allowed URL protocols.
* @param int $count Depth of call recursion to this function.
* @return string Sanitized content.
*/
function wp_kses_bad_protocol_once( $content, $allowed_protocols, $count = 1 ) {
$content = preg_replace( '/(�*58(?![;0-9])|�*3a(?![;a-f0-9]))/i', '$1;', $content );
$content2 = preg_split( '/:|�*58;|�*3a;|:/i', $content, 2 );
if ( isset( $content2[1] ) && ! preg_match( '%/\?%', $content2[0] ) ) {
$content = trim( $content2[1] );
$protocol = wp_kses_bad_protocol_once2( $content2[0], $allowed_protocols );
if ( 'feed:' === $protocol ) {
if ( $count > 2 ) {
return '';
}
$content = wp_kses_bad_protocol_once( $content, $allowed_protocols, ++$count );
if ( empty( $content ) ) {
return $content;
}
}
$content = $protocol . $content;
}
return $content;
}
/**
* Callback for `wp_kses_bad_protocol_once()` regular expression.
*
* This function processes URL protocols, checks to see if they're in the
* list of allowed protocols or not, and returns different data depending
* on the answer.
*
* @access private
* @ignore
* @since 1.0.0
*
* @param string $scheme URI scheme to check against the list of allowed protocols.
* @param string[] $allowed_protocols Array of allowed URL protocols.
* @return string Sanitized content.
*/
function wp_kses_bad_protocol_once2( $scheme, $allowed_protocols ) {
$scheme = wp_kses_decode_entities( $scheme );
$scheme = preg_replace( '/\s/', '', $scheme );
$scheme = wp_kses_no_null( $scheme );
$scheme = strtolower( $scheme );
$allowed = false;
foreach ( (array) $allowed_protocols as $one_protocol ) {
if ( strtolower( $one_protocol ) === $scheme ) {
$allowed = true;
break;
}
}
if ( $allowed ) {
return "$scheme:";
} else {
return '';
}
}
/**
* Converts and fixes HTML entities.
*
* This function normalizes HTML entities. It will convert `AT&T` to the correct
* `AT&T`, `:` to `:`, `&#XYZZY;` to `&#XYZZY;` and so on.
*
* When `$context` is set to 'xml', HTML entities are converted to their code points. For
* example, `AT&T…&#XYZZY;` is converted to `AT&T…&#XYZZY;`.
*
* @since 1.0.0
* @since 5.5.0 Added `$context` parameter.
*
* @param string $content Content to normalize entities.
* @param string $context Context for normalization. Can be either 'html' or 'xml'.
* Default 'html'.
* @return string Content with normalized entities.
*/
function wp_kses_normalize_entities( $content, $context = 'html' ) {
// Disarm all entities by converting & to &
$content = str_replace( '&', '&', $content );
// Change back the allowed entities in our list of allowed entities.
if ( 'xml' === $context ) {
$content = preg_replace_callback( '/&([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_xml_named_entities', $content );
} else {
$content = preg_replace_callback( '/&([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $content );
}
$content = preg_replace_callback( '/&#(0*[0-9]{1,7});/', 'wp_kses_normalize_entities2', $content );
$content = preg_replace_callback( '/&#[Xx](0*[0-9A-Fa-f]{1,6});/', 'wp_kses_normalize_entities3', $content );
return $content;
}
/**
* Callback for `wp_kses_normalize_entities()` regular expression.
*
* This function only accepts valid named entity references, which are finite,
* case-sensitive, and highly scrutinized by HTML and XML validators.
*
* @since 3.0.0
*
* @global array $allowedentitynames
*
* @param array $matches preg_replace_callback() matches array.
* @return string Correctly encoded entity.
*/
function wp_kses_named_entities( $matches ) {
global $allowedentitynames;
if ( empty( $matches[1] ) ) {
return '';
}
$i = $matches[1];
return ( ! in_array( $i, $allowedentitynames, true ) ) ? "&$i;" : "&$i;";
}
/**
* Callback for `wp_kses_normalize_entities()` regular expression.
*
* This function only accepts valid named entity references, which are finite,
* case-sensitive, and highly scrutinized by XML validators. HTML named entity
* references are converted to their code points.
*
* @since 5.5.0
*
* @global array $allowedentitynames
* @global array $allowedxmlentitynames
*
* @param array $matches preg_replace_callback() matches array.
* @return string Correctly encoded entity.
*/
function wp_kses_xml_named_entities( $matches ) {
global $allowedentitynames, $allowedxmlentitynames;
if ( empty( $matches[1] ) ) {
return '';
}
$i = $matches[1];
if ( in_array( $i, $allowedxmlentitynames, true ) ) {
return "&$i;";
} elseif ( in_array( $i, $allowedentitynames, true ) ) {
return html_entity_decode( "&$i;", ENT_HTML5 );
}
return "&$i;";
}
/**
* Callback for `wp_kses_normalize_entities()` regular expression.
*
* This function helps `wp_kses_normalize_entities()` to only accept 16-bit
* values and nothing more for `&#number;` entities.
*
* @access private
* @ignore
* @since 1.0.0
*
* @param array $matches `preg_replace_callback()` matches array.
* @return string Correctly encoded entity.
*/
function wp_kses_normalize_entities2( $matches ) {
if ( empty( $matches[1] ) ) {
return '';
}
$i = $matches[1];
if ( valid_unicode( $i ) ) {
$i = str_pad( ltrim( $i, '0' ), 3, '0', STR_PAD_LEFT );
$i = "&#$i;";
} else {
$i = "&#$i;";
}
return $i;
}
/**
* Callback for `wp_kses_normalize_entities()` for regular expression.
*
* This function helps `wp_kses_normalize_entities()` to only accept valid Unicode
* numeric entities in hex form.
*
* @since 2.7.0
* @access private
* @ignore
*
* @param array $matches `preg_replace_callback()` matches array.
* @return string Correctly encoded entity.
*/
function wp_kses_normalize_entities3( $matches ) {
if ( empty( $matches[1] ) ) {
return '';
}
$hexchars = $matches[1];
return ( ! valid_unicode( hexdec( $hexchars ) ) ) ? "&#x$hexchars;" : '&#x' . ltrim( $hexchars, '0' ) . ';';
}
/**
* Determines if a Unicode codepoint is valid.
*
* @since 2.7.0
*
* @param int $i Unicode codepoint.
* @return bool Whether or not the codepoint is a valid Unicode codepoint.
*/
function valid_unicode( $i ) {
$i = (int) $i;
return ( 0x9 === $i || 0xa === $i || 0xd === $i ||
( 0x20 <= $i && $i <= 0xd7ff ) ||
( 0xe000 <= $i && $i <= 0xfffd ) ||
( 0x10000 <= $i && $i <= 0x10ffff )
);
}
/**
* Converts all numeric HTML entities to their named counterparts.
*
* This function decodes numeric HTML entities (`A` and `A`).
* It doesn't do anything with named entities like `ä`, but we don't
* need them in the allowed URL protocols system anyway.
*
* @since 1.0.0
*
* @param string $content Content to change entities.
* @return string Content after decoded entities.
*/
function wp_kses_decode_entities( $content ) {
$content = preg_replace_callback( '/&#([0-9]+);/', '_wp_kses_decode_entities_chr', $content );
$content = preg_replace_callback( '/&#[Xx]([0-9A-Fa-f]+);/', '_wp_kses_decode_entities_chr_hexdec', $content );
return $content;
}
/**
* Regex callback for `wp_kses_decode_entities()`.
*
* @since 2.9.0
* @access private
* @ignore
*
* @param array $matches preg match
* @return string
*/
function _wp_kses_decode_entities_chr( $matches ) {
return chr( $matches[1] );
}
/**
* Regex callback for `wp_kses_decode_entities()`.
*
* @since 2.9.0
* @access private
* @ignore
*
* @param array $matches preg match
* @return string
*/
function _wp_kses_decode_entities_chr_hexdec( $matches ) {
return chr( hexdec( $matches[1] ) );
}
/**
* Sanitize content with allowed HTML KSES rules.
*
* This function expects slashed data.
*
* @since 1.0.0
*
* @param string $data Content to filter, expected to be escaped with slashes.
* @return string Filtered content.
*/
function wp_filter_kses( $data ) {
return addslashes( wp_kses( stripslashes( $data ), current_filter() ) );
}
/**
* Sanitize content with allowed HTML KSES rules.
*
* This function expects unslashed data.
*
* @since 2.9.0
*
* @param string $data Content to filter, expected to not be escaped.
* @return string Filtered content.
*/
function wp_kses_data( $data ) {
return wp_kses( $data, current_filter() );
}
/**
* Sanitizes content for allowed HTML tags for post content.
*
* Post content refers to the page contents of the 'post' type and not `$_POST`
* data from forms.
*
* This function expects slashed data.
*
* @since 2.0.0
*
* @param string $data Post content to filter, expected to be escaped with slashes.
* @return string Filtered post content with allowed HTML tags and attributes intact.
*/
function wp_filter_post_kses( $data ) {
return addslashes( wp_kses( stripslashes( $data ), 'post' ) );
}
/**
* Sanitizes global styles user content removing unsafe rules.
*
* @since 5.9.0
*
* @param string $data Post content to filter.
* @return string Filtered post content with unsafe rules removed.
*/
function wp_filter_global_styles_post( $data ) {
$decoded_data = json_decode( wp_unslash( $data ), true );
$json_decoding_error = json_last_error();
if (
JSON_ERROR_NONE === $json_decoding_error &&
is_array( $decoded_data ) &&
isset( $decoded_data['isGlobalStylesUserThemeJSON'] ) &&
$decoded_data['isGlobalStylesUserThemeJSON']
) {
unset( $decoded_data['isGlobalStylesUserThemeJSON'] );
$data_to_encode = WP_Theme_JSON::remove_insecure_properties( $decoded_data );
$data_to_encode['isGlobalStylesUserThemeJSON'] = true;
return wp_slash( wp_json_encode( $data_to_encode ) );
}
return $data;
}
/**
* Sanitizes content for allowed HTML tags for post content.
*
* Post content refers to the page contents of the 'post' type and not `$_POST`
* data from forms.
*
* This function expects unslashed data.
*
* @since 2.9.0
*
* @param string $data Post content to filter.
* @return string Filtered post content with allowed HTML tags and attributes intact.
*/
function wp_kses_post( $data ) {
return wp_kses( $data, 'post' );
}
/**
* Navigates through an array, object, or scalar, and sanitizes content for
* allowed HTML tags for post content.
*
* @since 4.4.2
*
* @see map_deep()
*
* @param mixed $data The array, object, or scalar value to inspect.
* @return mixed The filtered content.
*/
function wp_kses_post_deep( $data ) {
return map_deep( $data, 'wp_kses_post' );
}
/**
* Strips all HTML from a text string.
*
* This function expects slashed data.
*
* @since 2.1.0
*
* @param string $data Content to strip all HTML from.
* @return string Filtered content without any HTML.
*/
function wp_filter_nohtml_kses( $data ) {
return addslashes( wp_kses( stripslashes( $data ), 'strip' ) );
}
/**
* Adds all KSES input form content filters.
*
* All hooks have default priority. The `wp_filter_kses()` function is added to
* the 'pre_comment_content' and 'title_save_pre' hooks.
*
* The `wp_filter_post_kses()` function is added to the 'content_save_pre',
* 'excerpt_save_pre', and 'content_filtered_save_pre' hooks.
*
* @since 2.0.0
*/
function kses_init_filters() {
// Normal filtering.
add_filter( 'title_save_pre', 'wp_filter_kses' );
// Comment filtering.
if ( current_user_can( 'unfiltered_html' ) ) {
add_filter( 'pre_comment_content', 'wp_filter_post_kses' );
} else {
add_filter( 'pre_comment_content', 'wp_filter_kses' );
}
// Global Styles filtering: Global Styles filters should be executed before normal post_kses HTML filters.
add_filter( 'content_save_pre', 'wp_filter_global_styles_post', 9 );
add_filter( 'content_filtered_save_pre', 'wp_filter_global_styles_post', 9 );
// Post filtering.
add_filter( 'content_save_pre', 'wp_filter_post_kses' );
add_filter( 'excerpt_save_pre', 'wp_filter_post_kses' );
add_filter( 'content_filtered_save_pre', 'wp_filter_post_kses' );
}
/**
* Removes all KSES input form content filters.
*
* A quick procedural method to removing all of the filters that KSES uses for
* content in WordPress Loop.
*
* Does not remove the `kses_init()` function from {@see 'init'} hook (priority is
* default). Also does not remove `kses_init()` function from {@see 'set_current_user'}
* hook (priority is also default).
*
* @since 2.0.6
*/
function kses_remove_filters() {
// Normal filtering.
remove_filter( 'title_save_pre', 'wp_filter_kses' );
// Comment filtering.
remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
remove_filter( 'pre_comment_content', 'wp_filter_kses' );
// Global Styles filtering.
remove_filter( 'content_save_pre', 'wp_filter_global_styles_post', 9 );
remove_filter( 'content_filtered_save_pre', 'wp_filter_global_styles_post', 9 );
// Post filtering.
remove_filter( 'content_save_pre', 'wp_filter_post_kses' );
remove_filter( 'excerpt_save_pre', 'wp_filter_post_kses' );
remove_filter( 'content_filtered_save_pre', 'wp_filter_post_kses' );
}
/**
* Sets up most of the KSES filters for input form content.
*
* First removes all of the KSES filters in case the current user does not need
* to have KSES filter the content. If the user does not have `unfiltered_html`
* capability, then KSES filters are added.
*
* @since 2.0.0
*/
function kses_init() {
kses_remove_filters();
if ( ! current_user_can( 'unfiltered_html' ) ) {
kses_init_filters();
}
}
/**
* Filters an inline style attribute and removes disallowed rules.
*
* @since 2.8.1
* @since 4.4.0 Added support for `min-height`, `max-height`, `min-width`, and `max-width`.
* @since 4.6.0 Added support for `list-style-type`.
* @since 5.0.0 Added support for `background-image`.
* @since 5.1.0 Added support for `text-transform`.
* @since 5.2.0 Added support for `background-position` and `grid-template-columns`.
* @since 5.3.0 Added support for `grid`, `flex` and `column` layout properties.
* Extended `background-*` support for individual properties.
* @since 5.3.1 Added support for gradient backgrounds.
* @since 5.7.1 Added support for `object-position`.
* @since 5.8.0 Added support for `calc()` and `var()` values.
* @since 6.1.0 Added support for `min()`, `max()`, `minmax()`, `clamp()`,
* nested `var()` values, and assigning values to CSS variables.
* Added support for `object-fit`, `gap`, `column-gap`, `row-gap`, and `flex-wrap`.
* Extended `margin-*` and `padding-*` support for logical properties.
* @since 6.2.0 Added support for `aspect-ratio`, `position`, `top`, `right`, `bottom`, `left`,
* and `z-index` CSS properties.
* @since 6.3.0 Extended support for `filter` to accept a URL and added support for repeat().
* Added support for `box-shadow`.
* @since 6.4.0 Added support for `writing-mode`.
*
* @param string $css A string of CSS rules.
* @param string $deprecated Not used.
* @return string Filtered string of CSS rules.
*/
function safecss_filter_attr( $css, $deprecated = '' ) {
if ( ! empty( $deprecated ) ) {
_deprecated_argument( __FUNCTION__, '2.8.1' ); // Never implemented.
}
$css = wp_kses_no_null( $css );
$css = str_replace( array( "\n", "\r", "\t" ), '', $css );
$allowed_protocols = wp_allowed_protocols();
$css_array = explode( ';', trim( $css ) );
/**
* Filters the list of allowed CSS attributes.
*
* @since 2.8.1
*
* @param string[] $attr Array of allowed CSS attributes.
*/
$allowed_attr = apply_filters(
'safe_style_css',
array(
'background',
'background-color',
'background-image',
'background-position',
'background-size',
'background-attachment',
'background-blend-mode',
'border',
'border-radius',
'border-width',
'border-color',
'border-style',
'border-right',
'border-right-color',
'border-right-style',
'border-right-width',
'border-bottom',
'border-bottom-color',
'border-bottom-left-radius',
'border-bottom-right-radius',
'border-bottom-style',
'border-bottom-width',
'border-bottom-right-radius',
'border-bottom-left-radius',
'border-left',
'border-left-color',
'border-left-style',
'border-left-width',
'border-top',
'border-top-color',
'border-top-left-radius',
'border-top-right-radius',
'border-top-style',
'border-top-width',
'border-top-left-radius',
'border-top-right-radius',
'border-spacing',
'border-collapse',
'caption-side',
'columns',
'column-count',
'column-fill',
'column-gap',
'column-rule',
'column-span',
'column-width',
'color',
'filter',
'font',
'font-family',
'font-size',
'font-style',
'font-variant',
'font-weight',
'letter-spacing',
'line-height',
'text-align',
'text-decoration',
'text-indent',
'text-transform',
'height',
'min-height',
'max-height',
'width',
'min-width',
'max-width',
'margin',
'margin-right',
'margin-bottom',
'margin-left',
'margin-top',
'margin-block-start',
'margin-block-end',
'margin-inline-start',
'margin-inline-end',
'padding',
'padding-right',
'padding-bottom',
'padding-left',
'padding-top',
'padding-block-start',
'padding-block-end',
'padding-inline-start',
'padding-inline-end',
'flex',
'flex-basis',
'flex-direction',
'flex-flow',
'flex-grow',
'flex-shrink',
'flex-wrap',
'gap',
'column-gap',
'row-gap',
'grid-template-columns',
'grid-auto-columns',
'grid-column-start',
'grid-column-end',
'grid-column-gap',
'grid-template-rows',
'grid-auto-rows',
'grid-row-start',
'grid-row-end',
'grid-row-gap',
'grid-gap',
'justify-content',
'justify-items',
'justify-self',
'align-content',
'align-items',
'align-self',
'clear',
'cursor',
'direction',
'float',
'list-style-type',
'object-fit',
'object-position',
'overflow',
'vertical-align',
'writing-mode',
'position',
'top',
'right',
'bottom',
'left',
'z-index',
'box-shadow',
'aspect-ratio',
// Custom CSS properties.
'--*',
)
);
/*
* CSS attributes that accept URL data types.
*
* This is in accordance to the CSS spec and unrelated to
* the sub-set of supported attributes above.
*
* See: https://developer.mozilla.org/en-US/docs/Web/CSS/url
*/
$css_url_data_types = array(
'background',
'background-image',
'cursor',
'filter',
'list-style',
'list-style-image',
);
/*
* CSS attributes that accept gradient data types.
*
*/
$css_gradient_data_types = array(
'background',
'background-image',
);
if ( empty( $allowed_attr ) ) {
return $css;
}
$css = '';
foreach ( $css_array as $css_item ) {
if ( '' === $css_item ) {
continue;
}
$css_item = trim( $css_item );
$css_test_string = $css_item;
$found = false;
$url_attr = false;
$gradient_attr = false;
$is_custom_var = false;
if ( ! str_contains( $css_item, ':' ) ) {
$found = true;
} else {
$parts = explode( ':', $css_item, 2 );
$css_selector = trim( $parts[0] );
// Allow assigning values to CSS variables.
if ( in_array( '--*', $allowed_attr, true ) && preg_match( '/^--[a-zA-Z0-9-_]+$/', $css_selector ) ) {
$allowed_attr[] = $css_selector;
$is_custom_var = true;
}
if ( in_array( $css_selector, $allowed_attr, true ) ) {
$found = true;
$url_attr = in_array( $css_selector, $css_url_data_types, true );
$gradient_attr = in_array( $css_selector, $css_gradient_data_types, true );
}
if ( $is_custom_var ) {
$css_value = trim( $parts[1] );
$url_attr = str_starts_with( $css_value, 'url(' );
$gradient_attr = str_contains( $css_value, '-gradient(' );
}
}
if ( $found && $url_attr ) {
// Simplified: matches the sequence `url(*)`.
preg_match_all( '/url\([^)]+\)/', $parts[1], $url_matches );
foreach ( $url_matches[0] as $url_match ) {
// Clean up the URL from each of the matches above.
preg_match( '/^url\(\s*([\'\"]?)(.*)(\g1)\s*\)$/', $url_match, $url_pieces );
if ( empty( $url_pieces[2] ) ) {
$found = false;
break;
}
$url = trim( $url_pieces[2] );
if ( empty( $url ) || wp_kses_bad_protocol( $url, $allowed_protocols ) !== $url ) {
$found = false;
break;
} else {
// Remove the whole `url(*)` bit that was matched above from the CSS.
$css_test_string = str_replace( $url_match, '', $css_test_string );
}
}
}
if ( $found && $gradient_attr ) {
$css_value = trim( $parts[1] );
if ( preg_match( '/^(repeating-)?(linear|radial|conic)-gradient\(([^()]|rgb[a]?\([^()]*\))*\)$/', $css_value ) ) {
// Remove the whole `gradient` bit that was matched above from the CSS.
$css_test_string = str_replace( $css_value, '', $css_test_string );
}
}
if ( $found ) {
/*
* Allow CSS functions like var(), calc(), etc. by removing them from the test string.
* Nested functions and parentheses are also removed, so long as the parentheses are balanced.
*/
$css_test_string = preg_replace(
'/\b(?:var|calc|min|max|minmax|clamp|repeat)(\((?:[^()]|(?1))*\))/',
'',
$css_test_string
);
/*
* Disallow CSS containing \ ( & } = or comments, except for within url(), var(), calc(), etc.
* which were removed from the test string above.
*/
$allow_css = ! preg_match( '%[\\\(&=}]|/\*%', $css_test_string );
/**
* Filters the check for unsafe CSS in `safecss_filter_attr`.
*
* Enables developers to determine whether a section of CSS should be allowed or discarded.
* By default, the value will be false if the part contains \ ( & } = or comments.
* Return true to allow the CSS part to be included in the output.
*
* @since 5.5.0
*
* @param bool $allow_css Whether the CSS in the test string is considered safe.
* @param string $css_test_string The CSS string to test.
*/
$allow_css = apply_filters( 'safecss_filter_attr_allow_css', $allow_css, $css_test_string );
// Only add the CSS part if it passes the regex check.
if ( $allow_css ) {
if ( '' !== $css ) {
$css .= ';';
}
$css .= $css_item;
}
}
}
return $css;
}
/**
* Helper function to add global attributes to a tag in the allowed HTML list.
*
* @since 3.5.0
* @since 5.0.0 Added support for `data-*` wildcard attributes.
* @since 6.0.0 Added `dir`, `lang`, and `xml:lang` to global attributes.
* @since 6.3.0 Added `aria-controls`, `aria-current`, and `aria-expanded` attributes.
* @since 6.4.0 Added `aria-live` and `hidden` attributes.
*
* @access private
* @ignore
*
* @param array $value An array of attributes.
* @return array The array of attributes with global attributes added.
*/
function _wp_add_global_attributes( $value ) {
$global_attributes = array(
'aria-controls' => true,
'aria-current' => true,
'aria-describedby' => true,
'aria-details' => true,
'aria-expanded' => true,
'aria-hidden' => true,
'aria-label' => true,
'aria-labelledby' => true,
'aria-live' => true,
'class' => true,
'data-*' => true,
'dir' => true,
'hidden' => true,
'id' => true,
'lang' => true,
'style' => true,
'title' => true,
'role' => true,
'xml:lang' => true,
);
if ( true === $value ) {
$value = array();
}
if ( is_array( $value ) ) {
return array_merge( $value, $global_attributes );
}
return $value;
}
/**
* Helper function to check if this is a safe PDF URL.
*
* @since 5.9.0
* @access private
* @ignore
*
* @param string $url The URL to check.
* @return bool True if the URL is safe, false otherwise.
*/
function _wp_kses_allow_pdf_objects( $url ) {
// We're not interested in URLs that contain query strings or fragments.
if ( str_contains( $url, '?' ) || str_contains( $url, '#' ) ) {
return false;
}
// If it doesn't have a PDF extension, it's not safe.
if ( ! str_ends_with( $url, '.pdf' ) ) {
return false;
}
// If the URL host matches the current site's media URL, it's safe.
$upload_info = wp_upload_dir( null, false );
$parsed_url = wp_parse_url( $upload_info['url'] );
$upload_host = isset( $parsed_url['host'] ) ? $parsed_url['host'] : '';
$upload_port = isset( $parsed_url['port'] ) ? ':' . $parsed_url['port'] : '';
if ( str_starts_with( $url, "http://$upload_host$upload_port/" )
|| str_starts_with( $url, "https://$upload_host$upload_port/" )
) {
return true;
}
return false;
}
operator for testing the return value of this function.
*
* @since 2.1.0
* @since 5.1.0 Return value added to indicate success or failure.
* @since 5.7.0 Functionality moved to _wp_cron() to which this becomes a wrapper.
*
* @return false|int|void On success an integer indicating number of events spawned (0 indicates no
* events needed to be spawned), false if spawning fails for one or more events or
* void if the function registered _wp_cron() to run on the action.
*/
function wp_cron() {
if ( did_action( 'wp_loaded' ) ) {
return _wp_cron();
}
add_action( 'wp_loaded', '_wp_cron', 20 );
}
/**
* Runs scheduled callbacks or spawns cron for all scheduled events.
*
* Warning: This function may return Boolean FALSE, but may also return a non-Boolean
* value which evaluates to FALSE. For information about casting to booleans see the
* {@link https://www.php.net/manual/en/language.types.boolean.php PHP documentation}. Use
* the `===` operator for testing the return value of this function.
*
* @since 5.7.0
* @access private
*
* @return int|false On success an integer indicating number of events spawned (0 indicates no
* events needed to be spawned), false if spawning fails for one or more events.
*/
function _wp_cron() {
// Prevent infinite loops caused by lack of wp-cron.php.
if ( str_contains( $_SERVER['REQUEST_URI'], '/wp-cron.php' )
|| ( defined( 'DISABLE_WP_CRON' ) && DISABLE_WP_CRON )
) {
return 0;
}
$crons = wp_get_ready_cron_jobs();
if ( empty( $crons ) ) {
return 0;
}
$gmt_time = microtime( true );
$keys = array_keys( $crons );
if ( isset( $keys[0] ) && $keys[0] > $gmt_time ) {
return 0;
}
$schedules = wp_get_schedules();
$results = array();
foreach ( $crons as $timestamp => $cronhooks ) {
if ( $timestamp > $gmt_time ) {
break;
}
foreach ( (array) $cronhooks as $hook => $args ) {
if ( isset( $schedules[ $hook ]['callback'] )
&& ! call_user_func( $schedules[ $hook ]['callback'] )
) {
continue;
}
$results[] = spawn_cron( $gmt_time );
break 2;
}
}
if ( in_array( false, $results, true ) ) {
return false;
}
return count( $results );
}
/**
* Retrieves supported event recurrence schedules.
*
* The default supported recurrences are 'hourly', 'twicedaily', 'daily', and 'weekly'.
* A plugin may add more by hooking into the {@see 'cron_schedules'} filter.
* The filter accepts an array of arrays. The outer array has a key that is the name
* of the schedule, for example 'monthly'. The value is an array with two keys,
* one is 'interval' and the other is 'display'.
*
* The 'interval' is a number in seconds of when the cron job should run.
* So for 'hourly' the time is `HOUR_IN_SECONDS` (60 * 60 or 3600). For 'monthly',
* the value would be `MONTH_IN_SECONDS` (30 * 24 * 60 * 60 or 2592000).
*
* The 'display' is the description. For the 'monthly' key, the 'display'
* would be `__( 'Once Monthly' )`.
*
* For your plugin, you will be passed an array. You can easily add your
* schedule by doing the following.
*
* // Filter parameter variable name is 'array'.
* $array['monthly'] = array(
* 'interval' => MONTH_IN_SECONDS,
* 'display' => __( 'Once Monthly' )
* );
*
* @since 2.1.0
* @since 5.4.0 The 'weekly' schedule was added.
*
* @return array {
* The array of cron schedules keyed by the schedule name.
*
* @type array ...$0 {
* Cron schedule information.
*
* @type int $interval The schedule interval in seconds.
* @type string $display The schedule display name.
* }
* }
*/
function wp_get_schedules() {
$schedules = array(
'hourly' => array(
'interval' => HOUR_IN_SECONDS,
'display' => __( 'Once Hourly' ),
),
'twicedaily' => array(
'interval' => 12 * HOUR_IN_SECONDS,
'display' => __( 'Twice Daily' ),
),
'daily' => array(
'interval' => DAY_IN_SECONDS,
'display' => __( 'Once Daily' ),
),
'weekly' => array(
'interval' => WEEK_IN_SECONDS,
'display' => __( 'Once Weekly' ),
),
);
/**
* Filters the non-default cron schedules.
*
* @since 2.1.0
*
* @param array $new_schedules {
* An array of non-default cron schedules keyed by the schedule name. Default empty array.
*
* @type array ...$0 {
* Cron schedule information.
*
* @type int $interval The schedule interval in seconds.
* @type string $display The schedule display name.
* }
* }
*/
return array_merge( apply_filters( 'cron_schedules', array() ), $schedules );
}
/**
* Retrieves the name of the recurrence schedule for an event.
*
* @see wp_get_schedules() for available schedules.
*
* @since 2.1.0
* @since 5.1.0 {@see 'get_schedule'} filter added.
*
* @param string $hook Action hook to identify the event.
* @param array $args Optional. Arguments passed to the event's callback function.
* Default empty array.
* @return string|false Schedule name on success, false if no schedule.
*/
function wp_get_schedule( $hook, $args = array() ) {
$schedule = false;
$event = wp_get_scheduled_event( $hook, $args );
if ( $event ) {
$schedule = $event->schedule;
}
/**
* Filters the schedule name for a hook.
*
* @since 5.1.0
*
* @param string|false $schedule Schedule for the hook. False if not found.
* @param string $hook Action hook to execute when cron is run.
* @param array $args Arguments to pass to the hook's callback function.
*/
return apply_filters( 'get_schedule', $schedule, $hook, $args );
}
/**
* Retrieves cron jobs ready to be run.
*
* Returns the results of _get_cron_array() limited to events ready to be run,
* ie, with a timestamp in the past.
*
* @since 5.1.0
*
* @return array[] Array of cron job arrays ready to be run.
*/
function wp_get_ready_cron_jobs() {
/**
* Filter to override retrieving ready cron jobs.
*
* Returning an array will short-circuit the normal retrieval of ready
* cron jobs, causing the function to return the filtered value instead.
*
* @since 5.1.0
*
* @param null|array[] $pre Array of ready cron tasks to return instead. Default null
* to continue using results from _get_cron_array().
*/
$pre = apply_filters( 'pre_get_ready_cron_jobs', null );
if ( null !== $pre ) {
return $pre;
}
$crons = _get_cron_array();
$gmt_time = microtime( true );
$results = array();
foreach ( $crons as $timestamp => $cronhooks ) {
if ( $timestamp > $gmt_time ) {
break;
}
$results[ $timestamp ] = $cronhooks;
}
return $results;
}
//
// Private functions.
//
/**
* Retrieves cron info array option.
*
* @since 2.1.0
* @since 6.1.0 Return type modified to consistently return an array.
* @access private
*
* @return array[] Array of cron events.
*/
function _get_cron_array() {
$cron = get_option( 'cron' );
if ( ! is_array( $cron ) ) {
return array();
}
if ( ! isset( $cron['version'] ) ) {
$cron = _upgrade_cron_array( $cron );
}
unset( $cron['version'] );
return $cron;
}
/**
* Updates the cron option with the new cron array.
*
* @since 2.1.0
* @since 5.1.0 Return value modified to outcome of update_option().
* @since 5.7.0 The `$wp_error` parameter was added.
*
* @access private
*
* @param array[] $cron Array of cron info arrays from _get_cron_array().
* @param bool $wp_error Optional. Whether to return a WP_Error on failure. Default false.
* @return bool|WP_Error True if cron array updated. False or WP_Error on failure.
*/
function _set_cron_array( $cron, $wp_error = false ) {
if ( ! is_array( $cron ) ) {
$cron = array();
}
$cron['version'] = 2;
$result = update_option( 'cron', $cron );
if ( $wp_error && ! $result ) {
return new WP_Error(
'could_not_set',
__( 'The cron event list could not be saved.' )
);
}
return $result;
}
/**
* Upgrades a cron info array.
*
* This function upgrades the cron info array to version 2.
*
* @since 2.1.0
* @access private
*
* @param array $cron Cron info array from _get_cron_array().
* @return array An upgraded cron info array.
*/
function _upgrade_cron_array( $cron ) {
if ( isset( $cron['version'] ) && 2 === $cron['version'] ) {
return $cron;
}
$new_cron = array();
foreach ( (array) $cron as $timestamp => $hooks ) {
foreach ( (array) $hooks as $hook => $args ) {
$key = md5( serialize( $args['args'] ) );
$new_cron[ $timestamp ][ $hook ][ $key ] = $args;
}
}
$new_cron['version'] = 2;
update_option( 'cron', $new_cron );
return $new_cron;
}
Fatal error: require(): Failed opening required '/home/merciket/public_html/wp-includes/deprecated.php' (include_path='.:/opt/alt/php74/usr/share/pear') in /home/merciket/public_html/wp-settings.php on line 222
Fatal error: Uncaught Error: Call to a member function set() on null in /home/merciket/public_html/wp-includes/l10n.php:793
Stack trace:
#0 /home/merciket/public_html/wp-includes/l10n.php(900): load_textdomain('default', '/home/merciket/...', 'fa_IR')
#1 /home/merciket/public_html/wp-includes/class-wp-fatal-error-handler.php(47): load_default_textdomain()
#2 [internal function]: WP_Fatal_Error_Handler->handle()
#3 {main}
thrown in /home/merciket/public_html/wp-includes/l10n.php on line 793