Stripping `<script>` tags when saving post

[webmandesign]

Description

When adding a <script> tag into post content in Code Editor mode, the tag is not stripped out during post saving/update/publish process. This is working fine in excerpt field though.

This is not a security issue, as the post content is saved without the actual <script> tags.

It's just that page refresh/reload is required to preview of what has really happened with the tags in post content.

To reproduce

Expected behavior

<script> tags should be stripped out the same way as it is in excerpt field.

Additional context

• Tested using WordPress 5.0.1 (without Gutenberg plugin enabled)

[swissspidy]

Hmm... Editors and admins are allowed to post unfiltered HTML in the content by default.

[webmandesign]

Yes, sure, that's working fine. But this is a preview of how the <script> tag should be removed the same way as it is in "Excerpt" field on the right.

BTW, I've actually tested with superadmin account on multisite installation with define( 'DISALLOW_UNFILTERED_HTML', true ); set in wp-config.php file. But that's shouldn't be relevant to the issue, right? I will test with "Author" role too.

[webmandesign]

I can confirm now, the same happens for Author user role. So, the issue is not related to user accounts. And I mean this is not critical issue at all. It would only be great to have the same behavior for Excerpt field and for post content area too - removing <script> tag on save in both.

[ocean90]

Probably related to #12026.

[spacedmonkey]

@ocean90 I can confirm that is 100% related to #12026.

When PHP strips / changes the content on the post, this is not reflected in editor. As I mention in #12026 gutenberg needs to check if the value of the post content as changed on save and redraw the editor if it has.

[youknowriad]

Closing as a duplicate