Ticket #6602 (closed defect (bug): fixed)

Opened 4 years ago

Last modified 2 years ago

kses Should Prevent Duplicate Attributes

Reported by: schiller Owned by: anonymous
Priority: normal Milestone: 2.6.1
Component: General Version: 2.6
Severity: normal Keywords: has-patch 2nd-opinion
Cc:

Description

The following is allowed, which would break a blog using strict XHTML:

<a href='foo' href='foo'>blah</a>

Attachments

bug6602.patch Download (3.0 KB) - added by schiller 4 years ago.
Updated patch to take first attribute and ignore later duplicate attributes (per Sam Ruby's comment)

Change History

comment:1   schiller — 4 years ago

  • Cc rubys@… added

schiller — 4 years ago

Updated patch to take first attribute and ignore later duplicate attributes (per Sam Ruby's comment)

comment:2   schiller — 4 years ago

  • Keywords has-patch 2nd-opinion added; xhtml, kses removed

comment:3   schiller — 4 years ago

  • Milestone changed from 2.7 to 2.5.1

comment:4   lloydbudd — 4 years ago

  • Version set to 2.5.1
  • Milestone changed from 2.5.2 to 2.6

comment:5   azaozz — 4 years ago

  • Milestone changed from 2.9 to 2.7

comment:6   azaozz — 4 years ago

  • Status changed from new to closed
  • Resolution set to fixed

(In [8384]) Take first attribute and ignore later duplicate attributes. Fixes #6602 for trunk. Props schiller.

comment:7   azaozz — 4 years ago

  • Status changed from closed to reopened
  • Resolution fixed deleted
  • Milestone changed from 2.7 to 2.6.1

Re-open for 2.6.1

comment:8   azaozz — 4 years ago

  • Status changed from reopened to closed
  • Resolution set to fixed

(In [8385]) Take first attribute and ignore later duplicate attributes. Fixes #6602 for 2.6.1. Props schiller.

comment:9   codedread — 2 years ago

  • Status changed from closed to reopened
  • Version changed from 2.5.1 to 2.9.1
  • Resolution fixed deleted

Bug appears to still be valid in WP 2.9.1, despite my patch being in kses.php

comment:10   nacin — 2 years ago

  • Status changed from reopened to closed
  • Version changed from 2.9.1 to 2.6
  • Resolution set to fixed

Re-closing (see #6642:comment:15)

comment:11   rubys — 2 years ago

  • Cc rubys@… removed
Note: See TracTickets for help on using tickets.