Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use wp_kses() in wp_trigger_error() #5303

Conversation

hellofromtonya
Copy link
Contributor

Implements the balance between security and readability:

  • Replaces esc_html() with wp_kses() with a list of allowed HTML tags and protocols.
  • Documents extenders need to first escape HTML that is disallowed before passing the message to the function. Else, the disallowed tags and protocols will be stripped from the message.

Trac ticket: https://core.trac.wordpress.org/ticket/57686


This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

Copy link
Contributor

@costdev costdev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great to me! 👍

@hellofromtonya
Copy link
Contributor Author

@hellofromtonya hellofromtonya deleted the try/wp-kses-in-wp_trigger_error branch September 26, 2023 12:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants