Fix link color for roles without unfiltered_html capabilities #25411
Conversation
oandregal
requested review from
spacedmonkey and
TimothyBJacobs
as code owners
oandregal
added
[Type] Bug
|
Size Change: 0 B Total Size: 1.2 MB ℹ️ View Unchanged
|
oandregal
changed the title
| add_action( 'init', 'gutenberg_experimental_global_styles_register_cpt' ); | ||
| add_filter( 'block_editor_settings', 'gutenberg_experimental_global_styles_settings' ); | ||
| add_action( 'wp_enqueue_scripts', 'gutenberg_experimental_global_styles_enqueue_assets' ); | ||
| add_filter( 'safe_style_css', 'gutenberg_experimental_global_styles_allow_css_var_name' ); |
There was a problem hiding this comment.
oandregal
requested review from
ajitbohra,
nerrad,
ntwb and
talldan
as code owners
There was a problem hiding this comment.
In the core, we already have a good testing infrastructure for kses rule changes. And we will need to port this change to core anyways. Would it make sense the create a core patch with the change here and adding some kses rule test cases there? Similar to the patch we previously implemented for gradients https://github.com/WordPress/wordpress-develop/pull/110/files.
- match start and end of value characters - make sure color name can only have hyphen or alphanumeric chars
oandregal
force-pushed
the
fix/link-control-author-role
branch
from
7b0b3f2
to
7b94a13
Compare
I can do that as a follow-up to this. I'd also want to merge this as it is to make sure the link color is no longer broken in the plugin without having to wait for a core release that is still a few months away. What I'm unsure about is: when to prepare/merge that core patch. Is the 5.6 window a good time? I know there's uncertainty about whether link color is going to be merged into core in 5.6 (it doesn't look like it) so I wonder if we should wait to the 5.7 window instead. To my understanding, people have talked about that a few things can change (the general approach -classes instead of css vars-, the name of the var, the name of the value). I haven't done a core patch before so I don't have a good sense of whether this is a good idea or not (things like how difficult would it be to remove/update the patch, should we need it). So, essentially, I'm happy to take any advice here. What do you think? |
There was a problem hiding this comment.
LGTM 👍
The reason I referred the core patch was to be able to test this kses changes against the core kses tests to increase the confidence we have on this change given that it may have a security impact. It would be good to test the patch before the next Gutenberg release.
|
I'm trying to figure out who can provide a sanity check from a security point of view before this is merged. |
|
I've run this by some security folks and they aren't wild about serializing CSS Custom Properties in the post content. They'd rather keep the behavior as it is (not allowing CSS vars in the post content) or allow any in core, as it was done for So we're back at the drawing board. Going to close this for the moment. Perhaps we can revisit Riad's #21420 |
Fixes #25151