Skip to content
Permalink
Browse files

Pings/Trackbacks: In `wp_xmlrpc_server::pingback_ping()`, strip inlin…

…e JS and CSS while trying to figure out the pingback context.

Props david.binda.
Fixes #47283.

git-svn-id: https://develop.svn.wordpress.org/trunk@45823 602fd350-edb4-49c9-b593-d223f7449a82
  • Loading branch information...
SergeyBiryukov committed Aug 17, 2019
1 parent c5438c3 commit e810b32f428cef07711e401b1900a28d410f8fd4
Showing with 4 additions and 1 deletion.
  1. +4 −1 src/wp-includes/class-wp-xmlrpc-server.php
@@ -6880,7 +6880,10 @@ public function pingback_ping( $args ) {
return $this->pingback_error( 32, __( 'We cannot find a title on that page.' ) );
}
$remote_source = strip_tags( $remote_source, '<a>' ); // just keep the tag we need
// Remove all script and style tags including their content.
$remote_source = preg_replace( '@<(script|style)[^>]*?>.*?</\\1>@si', '', $remote_source );
// Just keep the tag we need.
$remote_source = strip_tags( $remote_source, '<a>' );
$p = explode( "\n\n", $remote_source );

0 comments on commit e810b32

Please sign in to comment.
You can’t perform that action at this time.