Skip to content

Commit 38285d1

Browse files
Viper007BondViper007Bond
committed
Pass __FILE__ to plugins_url() so that this plugin works with a plugin directory that has been moved to a location other than the default one.
Also a small security fix.
1 parent 28cec4e commit 38285d1

File tree

1 file changed

+47
-42
lines changed

1 file changed

+47
-42
lines changed

‎syntaxhighlighter.php‎

Lines changed: 47 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -115,48 +115,48 @@ function __construct() {
115115
}
116116

117117
// Register brush scripts
118-
wp_register_script( 'syntaxhighlighter-core', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shCore.js'), array(), $this->agshver );
119-
wp_register_script( 'syntaxhighlighter-brush-as3', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushAS3.js'), array('syntaxhighlighter-core'), $this->agshver );
120-
wp_register_script( 'syntaxhighlighter-brush-bash', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushBash.js'), array('syntaxhighlighter-core'), $this->agshver );
121-
wp_register_script( 'syntaxhighlighter-brush-coldfusion', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushColdFusion.js'), array('syntaxhighlighter-core'), $this->agshver );
122-
wp_register_script( 'syntaxhighlighter-brush-cpp', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushCpp.js'), array('syntaxhighlighter-core'), $this->agshver );
123-
wp_register_script( 'syntaxhighlighter-brush-csharp', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushCSharp.js'), array('syntaxhighlighter-core'), $this->agshver );
124-
wp_register_script( 'syntaxhighlighter-brush-css', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushCss.js'), array('syntaxhighlighter-core'), $this->agshver );
125-
wp_register_script( 'syntaxhighlighter-brush-delphi', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushDelphi.js'), array('syntaxhighlighter-core'), $this->agshver );
126-
wp_register_script( 'syntaxhighlighter-brush-diff', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushDiff.js'), array('syntaxhighlighter-core'), $this->agshver );
127-
wp_register_script( 'syntaxhighlighter-brush-erlang', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushErlang.js'), array('syntaxhighlighter-core'), $this->agshver );
128-
wp_register_script( 'syntaxhighlighter-brush-groovy', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushGroovy.js'), array('syntaxhighlighter-core'), $this->agshver );
129-
wp_register_script( 'syntaxhighlighter-brush-java', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushJava.js'), array('syntaxhighlighter-core'), $this->agshver );
130-
wp_register_script( 'syntaxhighlighter-brush-javafx', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushJavaFX.js'), array('syntaxhighlighter-core'), $this->agshver );
131-
wp_register_script( 'syntaxhighlighter-brush-jscript', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushJScript.js'), array('syntaxhighlighter-core'), $this->agshver );
132-
wp_register_script( 'syntaxhighlighter-brush-perl', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushPerl.js'), array('syntaxhighlighter-core'), $this->agshver );
133-
wp_register_script( 'syntaxhighlighter-brush-php', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushPhp.js'), array('syntaxhighlighter-core'), $this->agshver );
134-
wp_register_script( 'syntaxhighlighter-brush-plain', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushPlain.js'), array('syntaxhighlighter-core'), $this->agshver );
135-
wp_register_script( 'syntaxhighlighter-brush-powershell', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushPowerShell.js'), array('syntaxhighlighter-core'), $this->agshver );
136-
wp_register_script( 'syntaxhighlighter-brush-python', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushPython.js'), array('syntaxhighlighter-core'), $this->agshver );
137-
wp_register_script( 'syntaxhighlighter-brush-ruby', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushRuby.js'), array('syntaxhighlighter-core'), $this->agshver );
138-
wp_register_script( 'syntaxhighlighter-brush-scala', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushScala.js'), array('syntaxhighlighter-core'), $this->agshver );
139-
wp_register_script( 'syntaxhighlighter-brush-sql', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushSql.js'), array('syntaxhighlighter-core'), $this->agshver );
140-
wp_register_script( 'syntaxhighlighter-brush-vb', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushVb.js'), array('syntaxhighlighter-core'), $this->agshver );
141-
wp_register_script( 'syntaxhighlighter-brush-xml', plugins_url('syntaxhighlighter/' . $this->shfolder . '/scripts/shBrushXml.js'), array('syntaxhighlighter-core'), $this->agshver );
118+
wp_register_script( 'syntaxhighlighter-core', plugins_url( $this->shfolder . '/scripts/shCore.js', __FILE__ ), array(), $this->agshver );
119+
wp_register_script( 'syntaxhighlighter-brush-as3', plugins_url( $this->shfolder . '/scripts/shBrushAS3.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
120+
wp_register_script( 'syntaxhighlighter-brush-bash', plugins_url( $this->shfolder . '/scripts/shBrushBash.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
121+
wp_register_script( 'syntaxhighlighter-brush-coldfusion', plugins_url( $this->shfolder . '/scripts/shBrushColdFusion.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
122+
wp_register_script( 'syntaxhighlighter-brush-cpp', plugins_url( $this->shfolder . '/scripts/shBrushCpp.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
123+
wp_register_script( 'syntaxhighlighter-brush-csharp', plugins_url( $this->shfolder . '/scripts/shBrushCSharp.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
124+
wp_register_script( 'syntaxhighlighter-brush-css', plugins_url( $this->shfolder . '/scripts/shBrushCss.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
125+
wp_register_script( 'syntaxhighlighter-brush-delphi', plugins_url( $this->shfolder . '/scripts/shBrushDelphi.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
126+
wp_register_script( 'syntaxhighlighter-brush-diff', plugins_url( $this->shfolder . '/scripts/shBrushDiff.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
127+
wp_register_script( 'syntaxhighlighter-brush-erlang', plugins_url( $this->shfolder . '/scripts/shBrushErlang.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
128+
wp_register_script( 'syntaxhighlighter-brush-groovy', plugins_url( $this->shfolder . '/scripts/shBrushGroovy.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
129+
wp_register_script( 'syntaxhighlighter-brush-java', plugins_url( $this->shfolder . '/scripts/shBrushJava.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
130+
wp_register_script( 'syntaxhighlighter-brush-javafx', plugins_url( $this->shfolder . '/scripts/shBrushJavaFX.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
131+
wp_register_script( 'syntaxhighlighter-brush-jscript', plugins_url( $this->shfolder . '/scripts/shBrushJScript.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
132+
wp_register_script( 'syntaxhighlighter-brush-perl', plugins_url( $this->shfolder . '/scripts/shBrushPerl.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
133+
wp_register_script( 'syntaxhighlighter-brush-php', plugins_url( $this->shfolder . '/scripts/shBrushPhp.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
134+
wp_register_script( 'syntaxhighlighter-brush-plain', plugins_url( $this->shfolder . '/scripts/shBrushPlain.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
135+
wp_register_script( 'syntaxhighlighter-brush-powershell', plugins_url( $this->shfolder . '/scripts/shBrushPowerShell.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
136+
wp_register_script( 'syntaxhighlighter-brush-python', plugins_url( $this->shfolder . '/scripts/shBrushPython.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
137+
wp_register_script( 'syntaxhighlighter-brush-ruby', plugins_url( $this->shfolder . '/scripts/shBrushRuby.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
138+
wp_register_script( 'syntaxhighlighter-brush-scala', plugins_url( $this->shfolder . '/scripts/shBrushScala.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
139+
wp_register_script( 'syntaxhighlighter-brush-sql', plugins_url( $this->shfolder . '/scripts/shBrushSql.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
140+
wp_register_script( 'syntaxhighlighter-brush-vb', plugins_url( $this->shfolder . '/scripts/shBrushVb.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
141+
wp_register_script( 'syntaxhighlighter-brush-xml', plugins_url( $this->shfolder . '/scripts/shBrushXml.js', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
142142

143143
// Register some popular third-party brushes
144-
wp_register_script( 'syntaxhighlighter-brush-clojure', plugins_url('syntaxhighlighter/third-party-brushes/shBrushClojure.js'), array('syntaxhighlighter-core'), '20090602' );
145-
wp_register_script( 'syntaxhighlighter-brush-fsharp', plugins_url('syntaxhighlighter/third-party-brushes/shBrushFSharp.js'), array('syntaxhighlighter-core'), '20091003' );
146-
wp_register_script( 'syntaxhighlighter-brush-latex', plugins_url('syntaxhighlighter/third-party-brushes/shBrushLatex.js'), array('syntaxhighlighter-core'), '20090613' );
147-
wp_register_script( 'syntaxhighlighter-brush-matlabkey', plugins_url('syntaxhighlighter/third-party-brushes/shBrushMatlabKey.js'), array('syntaxhighlighter-core'), '20091209' );
148-
wp_register_script( 'syntaxhighlighter-brush-objc', plugins_url('syntaxhighlighter/third-party-brushes/shBrushObjC.js'), array('syntaxhighlighter-core'), '20091207' );
149-
wp_register_script( 'syntaxhighlighter-brush-r', plugins_url('syntaxhighlighter/third-party-brushes/shBrushR.js'), array('syntaxhighlighter-core'), '20100919' );
144+
wp_register_script( 'syntaxhighlighter-brush-clojure', plugins_url( 'third-party-brushes/shBrushClojure.js', __FILE__ ), array('syntaxhighlighter-core'), '20090602' );
145+
wp_register_script( 'syntaxhighlighter-brush-fsharp', plugins_url( 'third-party-brushes/shBrushFSharp.js', __FILE__ ), array('syntaxhighlighter-core'), '20091003' );
146+
wp_register_script( 'syntaxhighlighter-brush-latex', plugins_url( 'third-party-brushes/shBrushLatex.js', __FILE__ ), array('syntaxhighlighter-core'), '20090613' );
147+
wp_register_script( 'syntaxhighlighter-brush-matlabkey', plugins_url( 'third-party-brushes/shBrushMatlabKey.js', __FILE__ ), array('syntaxhighlighter-core'), '20091209' );
148+
wp_register_script( 'syntaxhighlighter-brush-objc', plugins_url( 'third-party-brushes/shBrushObjC.js', __FILE__ ), array('syntaxhighlighter-core'), '20091207' );
149+
wp_register_script( 'syntaxhighlighter-brush-r', plugins_url( 'third-party-brushes/shBrushR.js', __FILE__ ), array('syntaxhighlighter-core'), '20100919' );
150150

151151
// Register theme stylesheets
152-
wp_register_style( 'syntaxhighlighter-core', plugins_url('syntaxhighlighter/' . $this->shfolder . '/styles/shCore.css'), array(), $this->agshver );
153-
wp_register_style( 'syntaxhighlighter-theme-default', plugins_url('syntaxhighlighter/' . $this->shfolder . '/styles/shThemeDefault.css'), array('syntaxhighlighter-core'), $this->agshver );
154-
wp_register_style( 'syntaxhighlighter-theme-django', plugins_url('syntaxhighlighter/' . $this->shfolder . '/styles/shThemeDjango.css'), array('syntaxhighlighter-core'), $this->agshver );
155-
wp_register_style( 'syntaxhighlighter-theme-eclipse', plugins_url('syntaxhighlighter/' . $this->shfolder . '/styles/shThemeEclipse.css'), array('syntaxhighlighter-core'), $this->agshver );
156-
wp_register_style( 'syntaxhighlighter-theme-emacs', plugins_url('syntaxhighlighter/' . $this->shfolder . '/styles/shThemeEmacs.css'), array('syntaxhighlighter-core'), $this->agshver );
157-
wp_register_style( 'syntaxhighlighter-theme-fadetogrey', plugins_url('syntaxhighlighter/' . $this->shfolder . '/styles/shThemeFadeToGrey.css'), array('syntaxhighlighter-core'), $this->agshver );
158-
wp_register_style( 'syntaxhighlighter-theme-midnight', plugins_url('syntaxhighlighter/' . $this->shfolder . '/styles/shThemeMidnight.css'), array('syntaxhighlighter-core'), $this->agshver );
159-
wp_register_style( 'syntaxhighlighter-theme-rdark', plugins_url('syntaxhighlighter/' . $this->shfolder . '/styles/shThemeRDark.css'), array('syntaxhighlighter-core'), $this->agshver );
152+
wp_register_style( 'syntaxhighlighter-core', plugins_url( $this->shfolder . '/styles/shCore.css', __FILE__ ), array(), $this->agshver );
153+
wp_register_style( 'syntaxhighlighter-theme-default', plugins_url( $this->shfolder . '/styles/shThemeDefault.css', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
154+
wp_register_style( 'syntaxhighlighter-theme-django', plugins_url( $this->shfolder . '/styles/shThemeDjango.css', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
155+
wp_register_style( 'syntaxhighlighter-theme-eclipse', plugins_url( $this->shfolder . '/styles/shThemeEclipse.css', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
156+
wp_register_style( 'syntaxhighlighter-theme-emacs', plugins_url( $this->shfolder . '/styles/shThemeEmacs.css', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
157+
wp_register_style( 'syntaxhighlighter-theme-fadetogrey', plugins_url( $this->shfolder . '/styles/shThemeFadeToGrey.css', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
158+
wp_register_style( 'syntaxhighlighter-theme-midnight', plugins_url( $this->shfolder . '/styles/shThemeMidnight.css', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
159+
wp_register_style( 'syntaxhighlighter-theme-rdark', plugins_url( $this->shfolder . '/styles/shThemeRDark.css', __FILE__ ), array('syntaxhighlighter-core'), $this->agshver );
160160

161161

162162
// Create list of brush aliases and map them to their real brushes
@@ -281,10 +281,10 @@ function add_tinymce_plugin( $plugins ) {
281281
add_action( 'admin_print_footer_scripts', array( $this, 'output_shortcodes_for_tinymce' ), 9 );
282282

283283
if ( substr( $tinymce_version, 0, 1 ) < 4 ) {
284-
$plugins['syntaxhighlighter'] = plugins_url('syntaxhighlighter/syntaxhighlighter_mce.js');
284+
$plugins['syntaxhighlighter'] = plugins_url( 'syntaxhighlighter_mce.js', __FILE__ );
285285
} else {
286-
$plugins['syntaxhighlighter'] = plugins_url('syntaxhighlighter/syntaxhighlighter_mce-4.js?ver=' . $this->pluginver );
287-
wp_enqueue_script( 'syntaxhighlighter', plugins_url( '/syntaxhighlighter.js', __FILE__ ), array(), false, true );
286+
$plugins['syntaxhighlighter'] = add_query_arg( 'ver', $this->pluginver, plugins_url( 'syntaxhighlighter_mce-4.js', __FILE__ ) );
287+
wp_enqueue_script( 'syntaxhighlighter', plugins_url( 'syntaxhighlighter.js', __FILE__ ), array(), false, true );
288288
}
289289

290290
return $plugins;
@@ -656,7 +656,7 @@ function maybe_output_scripts() {
656656

657657
switch ( $this->settings['shversion'] ) {
658658
case 2:
659-
echo " SyntaxHighlighter.config.clipboardSwf = '" . esc_js( apply_filters( 'syntaxhighlighter_clipboardurl', plugins_url('syntaxhighlighter/syntaxhighlighter2/scripts/clipboard.swf') ) ) . "';\n";
659+
echo " SyntaxHighlighter.config.clipboardSwf = '" . esc_js( apply_filters( 'syntaxhighlighter_clipboardurl', plugins_url( 'syntaxhighlighter2/scripts/clipboard.swf', __FILE__ ) ) ) . "';\n";
660660
echo " SyntaxHighlighter.config.strings.expandSource = '" . $this->js_escape_singlequotes( __( 'show source', 'syntaxhighlighter' ) ) . "';\n";
661661
echo " SyntaxHighlighter.config.strings.viewSource = '" . $this->js_escape_singlequotes( __( 'view source', 'syntaxhighlighter' ) ) . "';\n";
662662
echo " SyntaxHighlighter.config.strings.copyToClipboard = '" . $this->js_escape_singlequotes( __( 'copy to clipboard', 'syntaxhighlighter' ) ) . "';\n";
@@ -958,6 +958,11 @@ function shortcode_callback( $atts, $code = '', $tag = false ) {
958958
continue;
959959
}
960960

961+
// Don't allow HTML in the title parameter
962+
if ( 'title' == $key ) {
963+
$value = strip_tags( html_entity_decode( strip_tags( $value ) ) );
964+
}
965+
961966
$params[] = "$key: $value;";
962967

963968
// Set the title variable if the title parameter is set (but not for feeds)

0 commit comments

Comments
 (0)