Issues in youtube.php - New Issues - Inspection of "Jetpack Sync: Adding jetpack_installed_plugin acti..." - Automattic/jetpack - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — add/plugin_install ( 13506f )

unknown

created 2017-04-18 20:58 UTC

modules/shortcodes/youtube.php (2 issues)

Labels

Bug 2

Severity

Major 2

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

/**
 * youtube shortcode
 *
 * Contains shortcode + some improvements over the Embeds syntax @
 * http://codex.wordpress.org/Embeds
 *
 * @example [youtube=http://www.youtube.com/watch?v=wq0rXGLs0YM&amp;fs=1&amp;hl=bg_BG]
 */

/**
 * Replaces YouTube embeds with YouTube shortcodes.
 *
 * @param string $content HTML content.
 * @return string The content with YouTube embeds replaced with YouTube shortcodes.
 */
// 2008-07-15:
//<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/bZBHZT3a-FA&hl=en&fs=1"></param><param name="allowFullScreen" value="true"></param><embed src="http://www.youtube.com/v/bZBHZT3a-FA&hl=en&fs=1" type="application/x-shockwave-flash" allowfullscreen="true" width="425" height="344"></embed></object>
// around 2008-06-06 youtube changed their old embed code to this:
//<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/M1D30gS7Z8U&hl=en"></param><embed src="http://www.youtube.com/v/M1D30gS7Z8U&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed></object>
// old style was:
// <object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/dGY28Qbj76A&rel=0"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/dGY28Qbj76A&rel=0" type="application/x-shockwave-flash" wmode="transparent" width="425" height="344"></embed></object>
// 12-2010:
// <object width="640" height="385"><param name="movie" value="http://www.youtube.com/v/3H8bnKdf654?fs=1&amp;hl=en_GB"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/3H8bnKdf654?fs=1&amp;hl=en_GB" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="385"></embed></object>
// 01-2011:
// <iframe title="YouTube video player" class="youtube-player" type="text/html" width="640" height="390" src="http://www.youtube.com/embed/Qq9El3ki0_g" frameborder="0" allowFullScreen></iframe>
// <iframe class="youtube-player" type="text/html" width="640" height="385" src="http://www.youtube.com/embed/VIDEO_ID" frameborder="0"></iframe>

function youtube_embed_to_short_code( $content ) {
	if ( ! is_string( $content ) || false === strpos( $content, 'youtube.com' ) ) {
		return $content;
	}

	//older codes
	$regexp = '!<object width="\d+" height="\d+"><param name="movie" value="https?://www\.youtube\.com/v/([^"]+)"></param>(?:<param name="\w+" value="[^"]*"></param>)*<embed src="https?://www\.youtube\.com/v/(.+)" type="application/x-shockwave-flash"(?: \w+="[^"]*")* width="\d+" height="\d+"></embed></object>!i';
	$regexp_ent = htmlspecialchars( $regexp, ENT_NOQUOTES );
	$old_regexp = '!<embed(?:\s+\w+="[^"]*")*\s+src="https?(?:\:|&#0*58;)//www\.youtube\.com/v/([^"]+)"(?:\s+\w+="[^"]*")*\s*(?:/>|>\s*</embed>)!';
	$old_regexp_ent = str_replace( '&amp;#0*58;', '&amp;#0*58;|&#0*58;', htmlspecialchars( $old_regexp, ENT_NOQUOTES ) );

	//new code
	$ifr_regexp = '!<iframe((?:\s+\w+="[^"]*")*?)\s+src="(https?:)?//(?:www\.)*youtube.com/embed/([^"]+)".*?</iframe>!i';
	$ifr_regexp_ent = str_replace( '&amp;#0*58;', '&amp;#0*58;|&#0*58;', htmlspecialchars( $ifr_regexp, ENT_NOQUOTES ) );

	foreach ( array( 'regexp', 'regexp_ent', 'old_regexp', 'old_regexp_ent', 'ifr_regexp', 'ifr_regexp_ent' ) as $reg ) {
		if ( ! preg_match_all( $$reg, $content, $matches, PREG_SET_ORDER ) )
			continue;

		foreach ( $matches as $match ) {
			// Hack, but '?' should only ever appear once, and
			// it should be for the 1st field-value pair in query string,
			// if it is present
			// YouTube changed their embed code.
			// Example of how it is now:
			//     <object width="640" height="385"><param name="movie" value="http://www.youtube.com/v/aP9AaD4tgBY?fs=1&amp;hl=en_US"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/aP9AaD4tgBY?fs=1&amp;hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="385"></embed></object>
			// As shown at the start of function, previous YouTube didn't '?'
			// the 1st field-value pair.
			if ( in_array ( $reg, array( 'ifr_regexp', 'ifr_regexp_ent' ) ) ) {
				$params = $match[1];

				if ( 'ifr_regexp_ent' == $reg )
					$params = html_entity_decode( $params );

				$params = wp_kses_hair( $params, array( 'http' ) );

				$width = isset( $params['width'] ) ? (int) $params['width']['value'] : 0;
				$height = isset( $params['height'] ) ? (int) $params['height']['value'] : 0;
				$wh = '';

				if ( $width && $height )
					$wh = "&w=$width&h=$height";

				$url = esc_url_raw( "https://www.youtube.com/watch?v={$match[3]}{$wh}" );
			} else {
				$match[1] = str_replace( '?', '&', $match[1] );

				$url = esc_url_raw( "https://www.youtube.com/watch?v=" . html_entity_decode( $match[1] ) );
			}

			$content = str_replace( $match[0], "[youtube $url]", $content );

			/**
			 * Fires before the YouTube embed is transformed into a shortcode.
			 *
			 * @module shortcodes
			 *
			 * @since 1.2.0
			 *
			 * @param string youtube Shortcode name.
			 * @param string $url YouTube video URL.
			 */
			do_action( 'jetpack_embed_to_shortcode', 'youtube', $url );
		}
	}

	return $content;
}

add_filter( 'pre_kses', 'youtube_embed_to_short_code' );

/**
 * Replaces plain-text links to YouTube videos with YouTube embeds.
 *
 * @param string $content HTML content
 * @return string The content with embeds instead of URLs
 */
function youtube_link( $content ) {
	return jetpack_preg_replace_callback_outside_tags( '!(?:\n|\A)https?://(?:www\.)?(?:youtube.com/(?:v/|playlist|watch[/\#?])|youtu\.be/)[^\s]+?(?:\n|\Z)!i', 'youtube_link_callback', $content, 'youtube.com/' );
}

/**
 * Callback function for the regex that replaces YouTube URLs with
 * YouTube embeds.
 */
function youtube_link_callback( $matches ) {
	return "\n" . youtube_id( $matches[0] ) . "\n";
}

/**
 * Normalizes a YouTube URL to include a v= parameter and a query string free of encoded ampersands.
 *
 * @param string $url
 * @return string The normalized URL
 */
if ( ! function_exists( 'youtube_sanitize_url' ) ) :
function youtube_sanitize_url( $url ) {
	$url = trim( $url, ' "' );
	$url = trim( $url );
	$url = str_replace( array( 'youtu.be/', '/v/', '#!v=', '&amp;', '&#038;', 'playlist' ), array( 'youtu.be/?v=', '/?v=', '?v=', '&', '&', 'videoseries' ), $url );

	// Replace any extra question marks with ampersands - the result of a URL like "http://www.youtube.com/v/9FhMMmqzbD8?fs=1&hl=en_US" being passed in.
	$query_string_start = strpos( $url, "?" );

	if ( false !== $query_string_start ) {
		$url = substr( $url, 0, $query_string_start + 1 ) . str_replace( "?", "&", substr( $url, $query_string_start + 1 ) );
	}

	return $url;
}
endif;

/*
 * url can be:
 *    http://www.youtube.com/embed/videoseries?list=PL94269DA08231042B&amp;hl=en_US
 *    http://www.youtube.com/watch#!v=H2Ncxw1xfck
 *    http://www.youtube.com/watch?v=H2Ncxw1xfck
 *    http://www.youtube.com/watch?v=H2Ncxw1xfck&w=320&h=240&fmt=1&rel=0&showsearch=1&hd=0
 *    http://www.youtube.com/v/jF-kELmmvgA
 *    http://www.youtube.com/v/9FhMMmqzbD8?fs=1&hl=en_US
 *    http://youtu.be/Rrohlqeir5E
 */

/**
 * Converts a YouTube URL into an embedded YouTube video.
 */
function youtube_id( $url ) {
	if ( ! $id = jetpack_get_youtube_id( $url ) )
		return '<!--YouTube Error: bad URL entered-->';

	$url = youtube_sanitize_url( $url );
	$url = parse_url( $url );

	if ( ! isset( $url['query'] ) )
		return false;

	if ( isset( $url['fragment'] ) ) {
		wp_parse_str( $url['fragment'], $fargs );
function someFunction() {
    $x = 5;
    echo $x;
}
	} else {
		$fargs = array();
	}
	wp_parse_str( $url['query'], $qargs );
function someFunction() {
    $x = 5;
    echo $x;
}

	$qargs = array_merge( $fargs, $qargs );

	// calculate the width and height, taking content_width into consideration
	global $content_width;

	$input_w = ( isset( $qargs['w'] ) && intval( $qargs['w'] ) ) ? intval( $qargs['w'] ) : 0;
	$input_h = ( isset( $qargs['h'] ) && intval( $qargs['h'] ) ) ? intval( $qargs['h'] ) : 0;

	// If we have $content_width, use it.
	if ( ! empty( $content_width ) ) {
		$default_width = $content_width;
	} else {
		// Otherwise get default width from the old, now deprecated embed_size_w option.
		$default_width = get_option('embed_size_w');
	}

	// If we don't know those 2 values use a hardcoded width.h
	if ( empty( $default_width ) ) {
		$default_width = 640;
	}

	if ( $input_w > 0 && $input_h > 0 ) {
		$w = $input_w;
		$h = $input_h;
	} elseif ( 0 == $input_w && 0 == $input_h ) {
		if ( isset( $qargs['fmt'] ) && intval( $qargs['fmt'] ) ) {
			$w = ( ! empty( $content_width ) ? min( $content_width, 480 ) : 480 );
		} else {
			$w = ( ! empty( $content_width ) ? min( $content_width, $default_width ) : $default_width );
			$h = ceil( ( $w / 16 ) * 9 ) + 30;
		}
	} elseif ( $input_w > 0 ) {
		$w = $input_w;
		$h = ceil( ( $w / 16 ) * 9 ) + 30;
	} else {
		if ( isset( $qargs['fmt'] ) && intval( $qargs['fmt'] ) ) {
			$w = ( ! empty( $content_width ) ? min( $content_width, 480 ) : 480 );
		} else {
			$w = ( ! empty( $content_width ) ? min( $content_width, $default_width ) : $default_width );
			$h = $input_h;
		}
	}

	/**
	 * Filter the YouTube player width.
	 *
	 * @module shortcodes
	 *
	 * @since 1.1.0
	 *
	 * @param int $w Width of the YouTube player in pixels.
	 */
	$w = (int) apply_filters( 'youtube_width', $w );

	/**
	 * Filter the YouTube player height.
	 *
	 * @module shortcodes
	 *
	 * @since 1.1.0
	 *
	 * @param int $h Height of the YouTube player in pixels.
	 */
	$h = (int) apply_filters( 'youtube_height', $h );

	$rel =    ( isset( $qargs['rel'] )            && 0 == $qargs['rel']            ) ? 0 : 1;
	$search = ( isset( $qargs['showsearch'] )     && 1 == $qargs['showsearch']     ) ? 1 : 0;
	$info =   ( isset( $qargs['showinfo'] )       && 0 == $qargs['showinfo']       ) ? 0 : 1;
	$iv =     ( isset( $qargs['iv_load_policy'] ) && 3 == $qargs['iv_load_policy'] ) ? 3 : 1;

	$fmt =    ( isset( $qargs['fmt'] )            && intval( $qargs['fmt'] )       ) ? '&fmt=' . (int) $qargs['fmt']     : '';

	if ( ! isset( $qargs['autohide'] ) || ( $qargs['autohide'] < 0 || 2 < $qargs['autohide'] ) ) {
		$autohide = '&autohide=2';
	} else {
		$autohide = '&autohide=' . absint( $qargs['autohide'] );
	}

	$start = 0;
	if ( isset( $qargs['start'] ) ) {
		$start = intval( $qargs['start'] );
	} else if ( isset( $qargs['t'] ) ) {
		$time_pieces = preg_split( '/(?<=\D)(?=\d+)/', $qargs['t'] );

		foreach ( $time_pieces as $time_piece ) {
			$int = (int) $time_piece;
			switch ( substr( $time_piece, -1 ) ) {
			case 'h' :
				$start += $int * 3600;
				break;
			case 'm' :
				$start += $int * 60;
				break;
			case 's' :
				$start += $int;
				break;
			}
		}
	}

	$start = $start ? '&start=' . $start : '';
	$end =    ( isset( $qargs['end'] )            && intval( $qargs['end'] )       ) ? '&end=' . (int) $qargs['end']     : '';
	$hd =     ( isset( $qargs['hd'] )             && intval( $qargs['hd'] )        ) ? '&hd=' . (int) $qargs['hd']       : '';

	$vq =     ( isset( $qargs['vq'] )             && in_array( $qargs['vq'], array('hd720','hd1080') ) ) ? '&vq=' . $qargs['vq'] : '';

	$cc = ( isset( $qargs['cc_load_policy'] ) ) ? '&cc_load_policy=1' : '';
	$cc_lang = ( isset( $qargs['cc_lang_pref'] )   ) ? '&cc_lang_pref=' . preg_replace( '/[^_a-z0-9-]/i', '', $qargs['cc_lang_pref'] ) : '';

	$wmode =  ( isset( $qargs['wmode'] ) && in_array( strtolower( $qargs['wmode'] ), array( 'opaque', 'window', 'transparent' ) ) ) ? $qargs['wmode'] : 'transparent';

	$theme =  ( isset( $qargs['theme'] ) && in_array( strtolower( $qargs['theme'] ), array( 'dark', 'light' ) ) ) ? '&theme=' . $qargs['theme'] : '';

	$autoplay = '';
	/**
	 * Allow YouTube videos to start playing automatically.
	 *
	 * @module shortcodes
	 *
	 * @since 2.2.2
	 *
	 * @param bool false Enable autoplay for YouTube videos.
	 */
	if ( apply_filters( 'jetpack_youtube_allow_autoplay', false ) && isset( $qargs['autoplay'] ) )
		$autoplay = '&autoplay=' . (int)$qargs['autoplay'];

	if ( ( isset( $url['path'] ) && '/videoseries' == $url['path'] ) || isset( $qargs['list'] ) ) {
		$html = "<iframe class='youtube-player' type='text/html' width='$w' height='$h' src='" . esc_url( set_url_scheme( "http://www.youtube.com/embed/videoseries?list=$id&hl=en_US" ) ) . "' allowfullscreen='true' style='border:0;'></iframe>";
	} else {
		$html = "<iframe class='youtube-player' type='text/html' width='$w' height='$h' src='" . esc_url( set_url_scheme( "http://www.youtube.com/embed/$id?version=3&rel=$rel&fs=1$fmt$autohide&showsearch=$search&showinfo=$info&iv_load_policy=$iv$start$end$hd&wmode=$wmode$theme$autoplay{$cc}{$cc_lang}" ) ) . "' allowfullscreen='true' style='border:0;'></iframe>";
	}

	// Let's do some alignment wonder in a span, unless we're producing a feed
	if ( ! is_feed() ) {
		$alignmentcss = 'text-align:center;';
		if ( isset( $qargs['align'] ) ) {
			switch ( $qargs['align'] ) {
				case 'left':
					$alignmentcss = "float:left; width:{$w}px; height:{$h}px; margin-right:10px; margin-bottom: 10px;";
					break;
				case 'right':
					$alignmentcss = "float:right; width:{$w}px; height:{$h}px; margin-left:10px; margin-bottom: 10px;";
					break;
			}
		}

		$html = sprintf(
			'<span class="embed-youtube" style="%s display: block;">%s</span>',
			esc_attr( $alignmentcss ),
			$html
		);

	}

	/**
	 * Filter the YouTube video HTML output.
	 *
	 * @module shortcodes
	 *
	 * @since 1.2.3
	 *
	 * @param string $html YouTube video HTML output.
	 */
	$html = apply_filters( 'video_embed_html', $html );

	return $html;
}

function youtube_shortcode( $atts ) {
	return youtube_id( ( isset ( $atts[0] ) ) ? ltrim( $atts[0] , '=' ) : shortcode_new_to_old_params( $atts ) );
}

add_shortcode( 'youtube', 'youtube_shortcode' );

/**
 * For bare URLs on their own line of the form
 * http://www.youtube.com/v/9FhMMmqzbD8?fs=1&hl=en_US
 */
function wpcom_youtube_embed_crazy_url( $matches, $attr, $url ) {
	return youtube_id( $url );
}

function wpcom_youtube_embed_crazy_url_init() {
	wp_embed_register_handler( 'wpcom_youtube_embed_crazy_url', '#https?://(?:www\.)?(?:youtube.com/(?:v/|playlist|watch[/\#?])|youtu\.be/).*#i', 'wpcom_youtube_embed_crazy_url' );
}

add_action( 'init', 'wpcom_youtube_embed_crazy_url_init' );

/**
 * Allow oEmbeds in Jetpack's Comment form.
 *
 * @module shortcodes
 *
 * @since 2.8.0
 *
 * @param int get_option('embed_autourls') Option to automatically embed all plain text URLs.
 */
if ( ! is_admin() && apply_filters( 'jetpack_comments_allow_oembed', true ) ) {
	// We attach wp_kses_post to comment_text in default-filters.php with priority of 10 anyway, so the iframe gets filtered out.
	// Higher priority because we need it before auto-link and autop get to it
	add_filter( 'comment_text', 'youtube_link', 1 );
}

/**
 * Core changes to do_shortcode (https://core.trac.wordpress.org/changeset/34747) broke "improper" shortcodes
 * with the format [shortcode=http://url.com].
 *
 * This removes the "=" from the shortcode so it can be parsed.
 *
 * @see https://github.com/Automattic/jetpack/issues/3121
 */
function jetpack_fix_youtube_shortcode_display_filter( $content ) {
	if ( strpos( $content, '[youtube=' ) !== false ) {
		$content = preg_replace( '@\[youtube=(.*?)\]@', '[youtube $1]', $content );
	}

	return $content;
}
add_filter( 'the_content', 'jetpack_fix_youtube_shortcode_display_filter', 7 );


1		<?php
2
3		/**
4		* youtube shortcode
5		*
6		* Contains shortcode + some improvements over the Embeds syntax @
7		* http://codex.wordpress.org/Embeds
8		*
9		* @example [youtube=http://www.youtube.com/watch?v=wq0rXGLs0YM&fs=1&hl=bg_BG]
10		*/
11
12		/**
13		* Replaces YouTube embeds with YouTube shortcodes.
14		*
15		* @param string $content HTML content.
16		* @return string The content with YouTube embeds replaced with YouTube shortcodes.
17		*/
18		// 2008-07-15:
19		//<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/bZBHZT3a-FA&hl=en&fs=1"></param><param name="allowFullScreen" value="true"></param><embed src="http://www.youtube.com/v/bZBHZT3a-FA&hl=en&fs=1" type="application/x-shockwave-flash" allowfullscreen="true" width="425" height="344"></embed></object>
20		// around 2008-06-06 youtube changed their old embed code to this:
21		//<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/M1D30gS7Z8U&hl=en"></param><embed src="http://www.youtube.com/v/M1D30gS7Z8U&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed></object>
22		// old style was:
23		// <object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/dGY28Qbj76A&rel=0"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/dGY28Qbj76A&rel=0" type="application/x-shockwave-flash" wmode="transparent" width="425" height="344"></embed></object>
24		// 12-2010:
25		// <object width="640" height="385"><param name="movie" value="http://www.youtube.com/v/3H8bnKdf654?fs=1&hl=en_GB"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/3H8bnKdf654?fs=1&hl=en_GB" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="385"></embed></object>
26		// 01-2011:
27		// <iframe title="YouTube video player" class="youtube-player" type="text/html" width="640" height="390" src="http://www.youtube.com/embed/Qq9El3ki0_g" frameborder="0" allowFullScreen></iframe>
28		// <iframe class="youtube-player" type="text/html" width="640" height="385" src="http://www.youtube.com/embed/VIDEO_ID" frameborder="0"></iframe>
29
30		function youtube_embed_to_short_code( $content ) {
31		if ( ! is_string( $content ) \|\| false === strpos( $content, 'youtube.com' ) ) {
32		return $content;
33		}
34
35		//older codes
36		$regexp = '!<object width="\d+" height="\d+"><param name="movie" value="https?://www\.youtube\.com/v/([^"]+)"></param>(?:<param name="\w+" value="[^"]"></param>)<embed src="https?://www\.youtube\.com/v/(.+)" type="application/x-shockwave-flash"(?: \w+="[^"]") width="\d+" height="\d+"></embed></object>!i';
37		$regexp_ent = htmlspecialchars( $regexp, ENT_NOQUOTES );
38		$old_regexp = '!<embed(?:\s+\w+="[^"]")\s+src="https?(?:\:\|&#058;)//www\.youtube\.com/v/([^"]+)"(?:\s+\w+="[^"]")\s(?:/>\|>\s*</embed>)!';
39		$old_regexp_ent = str_replace( '&#058;', '&#058;\|&#0*58;', htmlspecialchars( $old_regexp, ENT_NOQUOTES ) );
40
41		//new code
42		$ifr_regexp = '!<iframe((?:\s+\w+="[^"]")?)\s+src="(https?:)?//(?:www\.)youtube.com/embed/([^"]+)".?</iframe>!i';
43		$ifr_regexp_ent = str_replace( '&#058;', '&#058;\|&#0*58;', htmlspecialchars( $ifr_regexp, ENT_NOQUOTES ) );
44
45		foreach ( array( 'regexp', 'regexp_ent', 'old_regexp', 'old_regexp_ent', 'ifr_regexp', 'ifr_regexp_ent' ) as $reg ) {
46		if ( ! preg_match_all( $$reg, $content, $matches, PREG_SET_ORDER ) )
47		continue;
48
49		foreach ( $matches as $match ) {
50		// Hack, but '?' should only ever appear once, and
51		// it should be for the 1st field-value pair in query string,
52		// if it is present
53		// YouTube changed their embed code.
54		// Example of how it is now:
55		// <object width="640" height="385"><param name="movie" value="http://www.youtube.com/v/aP9AaD4tgBY?fs=1&hl=en_US"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/aP9AaD4tgBY?fs=1&hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="385"></embed></object>
56		// As shown at the start of function, previous YouTube didn't '?'
57		// the 1st field-value pair.
58		if ( in_array ( $reg, array( 'ifr_regexp', 'ifr_regexp_ent' ) ) ) {
59		$params = $match[1];
60
61		if ( 'ifr_regexp_ent' == $reg )
62		$params = html_entity_decode( $params );
63
64		$params = wp_kses_hair( $params, array( 'http' ) );
65
66		$width = isset( $params['width'] ) ? (int) $params['width']['value'] : 0;
67		$height = isset( $params['height'] ) ? (int) $params['height']['value'] : 0;
68		$wh = '';
69
70		if ( $width && $height )
71		$wh = "&w=$width&h=$height";
72
73		$url = esc_url_raw( "https://www.youtube.com/watch?v={$match[3]}{$wh}" );
74		} else {
75		$match[1] = str_replace( '?', '&', $match[1] );
76
77		$url = esc_url_raw( "https://www.youtube.com/watch?v=" . html_entity_decode( $match[1] ) );
78		}
79
80		$content = str_replace( $match[0], "[youtube $url]", $content );
81
82		/**
83		* Fires before the YouTube embed is transformed into a shortcode.
84		*
85		* @module shortcodes
86		*
87		* @since 1.2.0
88		*
89		* @param string youtube Shortcode name.
90		* @param string $url YouTube video URL.
91		*/
92		do_action( 'jetpack_embed_to_shortcode', 'youtube', $url );
93		}
94		}
95
96		return $content;
97		}
98
99		add_filter( 'pre_kses', 'youtube_embed_to_short_code' );
100
101		/**
102		* Replaces plain-text links to YouTube videos with YouTube embeds.
103		*
104		* @param string $content HTML content
105		* @return string The content with embeds instead of URLs
106		*/
107		function youtube_link( $content ) {
108		return jetpack_preg_replace_callback_outside_tags( '!(?:\n\|\A)https?://(?:www\.)?(?:youtube.com/(?:v/\|playlist\|watch[/\#?])\|youtu\.be/)[^\s]+?(?:\n\|\Z)!i', 'youtube_link_callback', $content, 'youtube.com/' );
109		}
110
111		/**
112		* Callback function for the regex that replaces YouTube URLs with
113		* YouTube embeds.
114		*/
115		function youtube_link_callback( $matches ) {
116		return "\n" . youtube_id( $matches[0] ) . "\n";
117		}
118
119		/**
120		* Normalizes a YouTube URL to include a v= parameter and a query string free of encoded ampersands.
121		*
122		* @param string $url
123		* @return string The normalized URL
124		*/
125	View Code Duplication	if ( ! function_exists( 'youtube_sanitize_url' ) ) :
126		function youtube_sanitize_url( $url ) {
127		$url = trim( $url, ' "' );
128		$url = trim( $url );
129		$url = str_replace( array( 'youtu.be/', '/v/', '#!v=', '&', '&', 'playlist' ), array( 'youtu.be/?v=', '/?v=', '?v=', '&', '&', 'videoseries' ), $url );
130
131		// Replace any extra question marks with ampersands - the result of a URL like "http://www.youtube.com/v/9FhMMmqzbD8?fs=1&hl=en_US" being passed in.
132		$query_string_start = strpos( $url, "?" );
133
134		if ( false !== $query_string_start ) {
135		$url = substr( $url, 0, $query_string_start + 1 ) . str_replace( "?", "&", substr( $url, $query_string_start + 1 ) );
136		}
137
138		return $url;
139		}
140		endif;
141
142		/*
143		* url can be:
144		* http://www.youtube.com/embed/videoseries?list=PL94269DA08231042B&hl=en_US
145		* http://www.youtube.com/watch#!v=H2Ncxw1xfck
146		* http://www.youtube.com/watch?v=H2Ncxw1xfck
147		* http://www.youtube.com/watch?v=H2Ncxw1xfck&w=320&h=240&fmt=1&rel=0&showsearch=1&hd=0
148		* http://www.youtube.com/v/jF-kELmmvgA
149		* http://www.youtube.com/v/9FhMMmqzbD8?fs=1&hl=en_US
150		* http://youtu.be/Rrohlqeir5E
151		*/
152
153		/**
154		* Converts a YouTube URL into an embedded YouTube video.
155		*/
156		function youtube_id( $url ) {
157		if ( ! $id = jetpack_get_youtube_id( $url ) )
158		return '<!--YouTube Error: bad URL entered-->';
159
160		$url = youtube_sanitize_url( $url );
161		$url = parse_url( $url );
162
163		if ( ! isset( $url['query'] ) )
164		return false;
165
166		if ( isset( $url['fragment'] ) ) {
167		wp_parse_str( $url['fragment'], $fargs );
		0 ignored issues – show Bug introduced 2015-11-20 23:03 UTC by Report Bug Copy Issue Report Show Similar Issues like this The variable `$fargs` seems only to be defined at a later point. Did you maybe move this code here without moving the variable definition? This error can happen if you refactor code and forget to move the variable initialization. Let’s take a look at a simple example: function someFunction() { $x = 5; echo $x; } The above code is perfectly fine. Now imagine that we re-order the statements: function someFunction() { echo $x; $x = 5; } In that case, `$x` would be read before it is initialized. This was a very basic example, however the principle is the same for the found issue. Loading history...
168		} else {
169		$fargs = array();
170		}
171		wp_parse_str( $url['query'], $qargs );
		0 ignored issues – show Bug introduced 2015-11-20 23:03 UTC by Report Bug Copy Issue Report Show Similar Issues like this The variable `$qargs` seems only to be defined at a later point. Did you maybe move this code here without moving the variable definition? This error can happen if you refactor code and forget to move the variable initialization. Let’s take a look at a simple example: function someFunction() { $x = 5; echo $x; } The above code is perfectly fine. Now imagine that we re-order the statements: function someFunction() { echo $x; $x = 5; } In that case, `$x` would be read before it is initialized. This was a very basic example, however the principle is the same for the found issue. Loading history...
172
173		$qargs = array_merge( $fargs, $qargs );
174
175		// calculate the width and height, taking content_width into consideration
176		global $content_width;
177
178		$input_w = ( isset( $qargs['w'] ) && intval( $qargs['w'] ) ) ? intval( $qargs['w'] ) : 0;
179		$input_h = ( isset( $qargs['h'] ) && intval( $qargs['h'] ) ) ? intval( $qargs['h'] ) : 0;
180
181		// If we have $content_width, use it.
182		if ( ! empty( $content_width ) ) {
183		$default_width = $content_width;
184		} else {
185		// Otherwise get default width from the old, now deprecated embed_size_w option.
186		$default_width = get_option('embed_size_w');
187		}
188
189		// If we don't know those 2 values use a hardcoded width.h
190		if ( empty( $default_width ) ) {
191		$default_width = 640;
192		}
193
194		if ( $input_w > 0 && $input_h > 0 ) {
195		$w = $input_w;
196		$h = $input_h;
197		} elseif ( 0 == $input_w && 0 == $input_h ) {
198		if ( isset( $qargs['fmt'] ) && intval( $qargs['fmt'] ) ) {
199		$w = ( ! empty( $content_width ) ? min( $content_width, 480 ) : 480 );
200		} else {
201		$w = ( ! empty( $content_width ) ? min( $content_width, $default_width ) : $default_width );
202		$h = ceil( ( $w / 16 ) * 9 ) + 30;
203		}
204		} elseif ( $input_w > 0 ) {
205		$w = $input_w;
206		$h = ceil( ( $w / 16 ) * 9 ) + 30;
207		} else {
208		if ( isset( $qargs['fmt'] ) && intval( $qargs['fmt'] ) ) {
209		$w = ( ! empty( $content_width ) ? min( $content_width, 480 ) : 480 );
210		} else {
211		$w = ( ! empty( $content_width ) ? min( $content_width, $default_width ) : $default_width );
212		$h = $input_h;
213		}
214		}
215
216		/**
217		* Filter the YouTube player width.
218		*
219		* @module shortcodes
220		*
221		* @since 1.1.0
222		*
223		* @param int $w Width of the YouTube player in pixels.
224		*/
225		$w = (int) apply_filters( 'youtube_width', $w );
226
227		/**
228		* Filter the YouTube player height.
229		*
230		* @module shortcodes
231		*
232		* @since 1.1.0
233		*
234		* @param int $h Height of the YouTube player in pixels.
235		*/
236		$h = (int) apply_filters( 'youtube_height', $h );
237
238		$rel = ( isset( $qargs['rel'] ) && 0 == $qargs['rel'] ) ? 0 : 1;
239		$search = ( isset( $qargs['showsearch'] ) && 1 == $qargs['showsearch'] ) ? 1 : 0;
240		$info = ( isset( $qargs['showinfo'] ) && 0 == $qargs['showinfo'] ) ? 0 : 1;
241		$iv = ( isset( $qargs['iv_load_policy'] ) && 3 == $qargs['iv_load_policy'] ) ? 3 : 1;
242
243		$fmt = ( isset( $qargs['fmt'] ) && intval( $qargs['fmt'] ) ) ? '&fmt=' . (int) $qargs['fmt'] : '';
244
245		if ( ! isset( $qargs['autohide'] ) \|\| ( $qargs['autohide'] < 0 \|\| 2 < $qargs['autohide'] ) ) {
246		$autohide = '&autohide=2';
247		} else {
248		$autohide = '&autohide=' . absint( $qargs['autohide'] );
249		}
250
251		$start = 0;
252		if ( isset( $qargs['start'] ) ) {
253		$start = intval( $qargs['start'] );
254		} else if ( isset( $qargs['t'] ) ) {
255		$time_pieces = preg_split( '/(?<=\D)(?=\d+)/', $qargs['t'] );
256
257		foreach ( $time_pieces as $time_piece ) {
258		$int = (int) $time_piece;
259		switch ( substr( $time_piece, -1 ) ) {
260		case 'h' :
261		$start += $int * 3600;
262		break;
263		case 'm' :
264		$start += $int * 60;
265		break;
266		case 's' :
267		$start += $int;
268		break;
269		}
270		}
271		}
272
273		$start = $start ? '&start=' . $start : '';
274		$end = ( isset( $qargs['end'] ) && intval( $qargs['end'] ) ) ? '&end=' . (int) $qargs['end'] : '';
275		$hd = ( isset( $qargs['hd'] ) && intval( $qargs['hd'] ) ) ? '&hd=' . (int) $qargs['hd'] : '';
276
277		$vq = ( isset( $qargs['vq'] ) && in_array( $qargs['vq'], array('hd720','hd1080') ) ) ? '&vq=' . $qargs['vq'] : '';
278
279		$cc = ( isset( $qargs['cc_load_policy'] ) ) ? '&cc_load_policy=1' : '';
280		$cc_lang = ( isset( $qargs['cc_lang_pref'] ) ) ? '&cc_lang_pref=' . preg_replace( '/[^_a-z0-9-]/i', '', $qargs['cc_lang_pref'] ) : '';
281
282		$wmode = ( isset( $qargs['wmode'] ) && in_array( strtolower( $qargs['wmode'] ), array( 'opaque', 'window', 'transparent' ) ) ) ? $qargs['wmode'] : 'transparent';
283
284		$theme = ( isset( $qargs['theme'] ) && in_array( strtolower( $qargs['theme'] ), array( 'dark', 'light' ) ) ) ? '&theme=' . $qargs['theme'] : '';
285
286		$autoplay = '';
287		/**
288		* Allow YouTube videos to start playing automatically.
289		*
290		* @module shortcodes
291		*
292		* @since 2.2.2
293		*
294		* @param bool false Enable autoplay for YouTube videos.
295		*/
296		if ( apply_filters( 'jetpack_youtube_allow_autoplay', false ) && isset( $qargs['autoplay'] ) )
297		$autoplay = '&autoplay=' . (int)$qargs['autoplay'];
298
299		if ( ( isset( $url['path'] ) && '/videoseries' == $url['path'] ) \|\| isset( $qargs['list'] ) ) {
300		$html = "<iframe class='youtube-player' type='text/html' width='$w' height='$h' src='" . esc_url( set_url_scheme( "http://www.youtube.com/embed/videoseries?list=$id&hl=en_US" ) ) . "' allowfullscreen='true' style='border:0;'></iframe>";
301		} else {
302		$html = "<iframe class='youtube-player' type='text/html' width='$w' height='$h' src='" . esc_url( set_url_scheme( "http://www.youtube.com/embed/$id?version=3&rel=$rel&fs=1$fmt$autohide&showsearch=$search&showinfo=$info&iv_load_policy=$iv$start$end$hd&wmode=$wmode$theme$autoplay{$cc}{$cc_lang}" ) ) . "' allowfullscreen='true' style='border:0;'></iframe>";
303		}
304
305		// Let's do some alignment wonder in a span, unless we're producing a feed
306		if ( ! is_feed() ) {
307		$alignmentcss = 'text-align:center;';
308		if ( isset( $qargs['align'] ) ) {
309		switch ( $qargs['align'] ) {
310		case 'left':
311		$alignmentcss = "float:left; width:{$w}px; height:{$h}px; margin-right:10px; margin-bottom: 10px;";
312		break;
313		case 'right':
314		$alignmentcss = "float:right; width:{$w}px; height:{$h}px; margin-left:10px; margin-bottom: 10px;";
315		break;
316		}
317		}
318
319		$html = sprintf(
320		'<span class="embed-youtube" style="%s display: block;">%s</span>',
321		esc_attr( $alignmentcss ),
322		$html
323		);
324
325		}
326
327		/**
328		* Filter the YouTube video HTML output.
329		*
330		* @module shortcodes
331		*
332		* @since 1.2.3
333		*
334		* @param string $html YouTube video HTML output.
335		*/
336		$html = apply_filters( 'video_embed_html', $html );
337
338		return $html;
339		}
340
341		function youtube_shortcode( $atts ) {
342		return youtube_id( ( isset ( $atts[0] ) ) ? ltrim( $atts[0] , '=' ) : shortcode_new_to_old_params( $atts ) );
343		}
344
345		add_shortcode( 'youtube', 'youtube_shortcode' );
346
347		/**
348		* For bare URLs on their own line of the form
349		* http://www.youtube.com/v/9FhMMmqzbD8?fs=1&hl=en_US
350		*/
351		function wpcom_youtube_embed_crazy_url( $matches, $attr, $url ) {
352		return youtube_id( $url );
353		}
354
355		function wpcom_youtube_embed_crazy_url_init() {
356		wp_embed_register_handler( 'wpcom_youtube_embed_crazy_url', '#https?://(?:www\.)?(?:youtube.com/(?:v/\|playlist\|watch[/\#?])\|youtu\.be/).*#i', 'wpcom_youtube_embed_crazy_url' );
357		}
358
359		add_action( 'init', 'wpcom_youtube_embed_crazy_url_init' );
360
361		/**
362		* Allow oEmbeds in Jetpack's Comment form.
363		*
364		* @module shortcodes
365		*
366		* @since 2.8.0
367		*
368		* @param int get_option('embed_autourls') Option to automatically embed all plain text URLs.
369		*/
370		if ( ! is_admin() && apply_filters( 'jetpack_comments_allow_oembed', true ) ) {
371		// We attach wp_kses_post to comment_text in default-filters.php with priority of 10 anyway, so the iframe gets filtered out.
372		// Higher priority because we need it before auto-link and autop get to it
373		add_filter( 'comment_text', 'youtube_link', 1 );
374		}
375
376		/**
377		* Core changes to do_shortcode (https://core.trac.wordpress.org/changeset/34747) broke "improper" shortcodes
378		* with the format [shortcode=http://url.com].
379		*
380		* This removes the "=" from the shortcode so it can be parsed.
381		*
382		* @see https://github.com/Automattic/jetpack/issues/3121
383		*/
384		function jetpack_fix_youtube_shortcode_display_filter( $content ) {
385		if ( strpos( $content, '[youtube=' ) !== false ) {
386		$content = preg_replace( '@\[youtube=(.*?)\]@', '[youtube $1]', $content );
387		}
388
389		return $content;
390		}
391		add_filter( 'the_content', 'jetpack_fix_youtube_shortcode_display_filter', 7 );
392

Automattic / jetpack

Push — add/plugin_install ( 13506f )

modules/shortcodes/youtube.php (2 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like