Skip to content
Permalink
Browse files

KSES: Conditionally remove the `<form>` element from `$allowedposttags`.

To avoid backwards compatibility issues, `<form>` is re-added if a custom filter has added the `<input>` or `<select>` elements to `$allowedposttags`.

Merges [43994] to the 4.9 branch.


git-svn-id: https://develop.svn.wordpress.org/branches/4.9@43997 602fd350-edb4-49c9-b593-d223f7449a82
  • Loading branch information...
pento committed Dec 12, 2018
1 parent ff58a69 commit 4a807b3c7f18b316781173468f6093d989f77f7e
Showing with 22 additions and 10 deletions.
  1. +22 −10 src/wp-includes/kses.php
@@ -184,15 +184,6 @@
'lang' => true, 'lang' => true,
'xml:lang' => true, 'xml:lang' => true,
), ),
'form' => array(
'action' => true,
'accept' => true,
'accept-charset' => true,
'enctype' => true,
'method' => true,
'name' => true,
'target' => true,
),
'h1' => array( 'h1' => array(
'align' => true, 'align' => true,
), ),
@@ -610,6 +601,7 @@ function wp_kses_one_attr( $string, $element ) {
* Return a list of allowed tags and attributes for a given context. * Return a list of allowed tags and attributes for a given context.
* *
* @since 3.5.0 * @since 3.5.0
* @since 5.0.1 `form` removed as allowable HTML tag.
* *
* @global array $allowedposttags * @global array $allowedposttags
* @global array $allowedtags * @global array $allowedtags
@@ -638,7 +630,27 @@ function wp_kses_allowed_html( $context = '' ) {
switch ( $context ) { switch ( $context ) {
case 'post': case 'post':
/** This filter is documented in wp-includes/kses.php */ /** This filter is documented in wp-includes/kses.php */
return apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context ); $tags = apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
// 5.0.1 removed the `<form>` tag, allow it if a filter is allowing it's sub-elements `<input>` or `<select>`.
if ( ! CUSTOM_TAGS && ! isset( $tags['form'] ) && ( isset( $tags['input'] ) || isset( $tags['select'] ) ) ) {
$tags = $allowedposttags;
$tags['form'] = array(
'action' => true,
'accept' => true,
'accept-charset' => true,
'enctype' => true,
'method' => true,
'name' => true,
'target' => true,
);
/** This filter is documented in wp-includes/kses.php */
$tags = apply_filters( 'wp_kses_allowed_html', $tags, $context );
}
return $tags;
case 'user_description': case 'user_description':
case 'pre_user_description': case 'pre_user_description':

0 comments on commit 4a807b3

Please sign in to comment.
You can’t perform that action at this time.