Ticket #20812: 20812.diff

wp-includes/comment-template.php

@@ -816 +816 @@
         if ( !empty($post) )
                 $post_id = $post->ID;
 
-        if ( current_user_can('unfiltered_html') )
-                wp_nonce_field('unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment', false);
+        if ( current_user_can( 'unfiltered_html' ) ) {
+                wp_nonce_field( 'unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment_disabled', false );
+                echo "<script>(function(){if(window===window.parent){document.getElementById('_wp_unfiltered_html_comment_disabled').name='_wp_unfiltered_html_comment';}})();</script>\n";
+        }
 }
 
 /**

wp-includes/kses.php

@@ -1363 +1363 @@
  * @uses add_filter() See description for what functions are added to what hooks.
  */
 function kses_init_filters() {
-        // Normal filtering.
-        add_filter('pre_comment_content', 'wp_filter_kses');
+        // Normal filtering
         add_filter('title_save_pre', 'wp_filter_kses');
 
+        // Comment filtering
+        if ( current_user_can( 'unfiltered_html' ) )
+                add_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+        else
+                add_filter( 'pre_comment_content', 'wp_filter_kses' );
+
         // Post filtering
         add_filter('content_save_pre', 'wp_filter_post_kses');
         add_filter('excerpt_save_pre', 'wp_filter_post_kses');
@@ -1386 +1391 @@
  * @since 2.0.6
  */
 function kses_remove_filters() {
-        // Normal filtering.
-        remove_filter('pre_comment_content', 'wp_filter_kses');
+        // Normal filtering
         remove_filter('title_save_pre', 'wp_filter_kses');
 
+        // Comment filtering
+        remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+        remove_filter( 'pre_comment_content', 'wp_filter_kses' );
+
         // Post filtering
         remove_filter('content_save_pre', 'wp_filter_post_kses');
         remove_filter('excerpt_save_pre', 'wp_filter_post_kses');