-
Notifications
You must be signed in to change notification settings - Fork 4.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix link color for roles without unfiltered_html capabilities #25411
Conversation
Size Change: 0 B Total Size: 1.2 MB ℹ️ View Unchanged
|
add_action( 'init', 'gutenberg_experimental_global_styles_register_cpt' ); | ||
add_filter( 'block_editor_settings', 'gutenberg_experimental_global_styles_settings' ); | ||
add_action( 'wp_enqueue_scripts', 'gutenberg_experimental_global_styles_enqueue_assets' ); | ||
add_filter( 'safe_style_css', 'gutenberg_experimental_global_styles_allow_css_var_name' ); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In the core, we already have a good testing infrastructure for kses rule changes. And we will need to port this change to core anyways. Would it make sense the create a core patch with the change here and adding some kses rule test cases there? Similar to the patch we previously implemented for gradients https://github.com/WordPress/wordpress-develop/pull/110/files.
- match start and end of value characters - make sure color name can only have hyphen or alphanumeric chars
7b0b3f2
to
7b94a13
Compare
I can do that as a follow-up to this. I'd also want to merge this as it is to make sure the link color is no longer broken in the plugin without having to wait for a core release that is still a few months away. What I'm unsure about is: when to prepare/merge that core patch. Is the 5.6 window a good time? I know there's uncertainty about whether link color is going to be merged into core in 5.6 (it doesn't look like it) so I wonder if we should wait to the 5.7 window instead. To my understanding, people have talked about that a few things can change (the general approach -classes instead of css vars-, the name of the var, the name of the value). I haven't done a core patch before so I don't have a good sense of whether this is a good idea or not (things like how difficult would it be to remove/update the patch, should we need it). So, essentially, I'm happy to take any advice here. What do you think? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 👍
The reason I referred the core patch was to be able to test this kses changes against the core kses tests to increase the confidence we have on this change given that it may have a security impact. It would be good to test the patch before the next Gutenberg release.
I'm trying to figure out who can provide a sanity check from a security point of view before this is merged. |
I've run this by some security folks and they aren't wild about serializing CSS Custom Properties in the post content. They'd rather keep the behavior as it is (not allowing CSS vars in the post content) or allow any in core, as it was done for So we're back at the drawing board. Going to close this for the moment. Perhaps we can revisit Riad's #21420 |
Fixes #25151