Ticket #11311: 11311.patch

wp-includes/kses.php

@@ -948 +948 @@
 function wp_kses_normalize_entities($string) {
         # Disarm all entities by converting & to &
 
-        $string = str_replace('&', '&', $string);
+        $string = str_replace('&', '%%ampplaceholder%%', $string);
 
         # Change back the allowed entities in our entity whitelist
 
@@ -956 +956 @@
         $string = preg_replace_callback('/&#0*([0-9]{1,5});/', 'wp_kses_normalize_entities2', $string);
         $string = preg_replace_callback('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', 'wp_kses_normalize_entities3', $string);
 
+        $string = str_replace('%%ampplaceholder%%', '&', $string);
+
         return $string;
 }