Ticket #14758: 14758.diff

wp-includes/default-filters.php

@@ -21 +21 @@
 
 // Strip, kses, special chars for string display
 foreach ( array( 'term_name', 'comment_author_name', 'link_name', 'link_target', 'link_rel', 'user_display_name', 'user_first_name', 'user_last_name', 'user_nickname' ) as $filter ) {
-        add_filter( $filter, 'sanitize_text_field'  );
-        add_filter( $filter, 'wp_kses_data'       );
+        if ( is_admin() || is_network_admin() ) {
+                // These are expensive. Run only on admin pages for defense in depth.
+                add_filter( $filter, 'sanitize_text_field'  );
+                add_filter( $filter, 'wp_kses_data'       );
+        }
         add_filter( $filter, '_wp_specialchars', 30 );
 }
 
@@ -31 +34 @@
         add_filter( $filter, 'wp_filter_kses' );
 }
 
-// Kses only for textarea saves displays
-foreach ( array( 'term_description', 'link_description', 'link_notes', 'user_description' ) as $filter ) {
-        add_filter( $filter, 'wp_kses_data' );
+// Kses only for textarea admin displays
+if ( is_admin() || is_network_admin() ) {
+        foreach ( array( 'term_description', 'link_description', 'link_notes', 'user_description' ) as $filter ) {
+                add_filter( $filter, 'wp_kses_data' );
+        }
 }
 
 // Email saves
@@ -43 +48 @@
         add_filter( $filter, 'wp_filter_kses' );
 }
 
-// Email display
+// Email admin display
 foreach ( array( 'comment_author_email', 'user_email' ) as $filter ) {
         add_filter( $filter, 'sanitize_email' );
-        add_filter( $filter, 'wp_kses_data' );
+        if ( is_admin() || is_network_admin() )
+                add_filter( $filter, 'wp_kses_data' );
 }
 
 // Save URL
@@ -59 +65 @@
 
 // Display URL
 foreach ( array( 'user_url', 'link_url', 'link_image', 'link_rss', 'comment_url' ) as $filter ) {
-        add_filter( $filter, 'wp_strip_all_tags' );
+        if ( is_admin() || is_network_admin() )
+                add_filter( $filter, 'wp_strip_all_tags' );
         add_filter( $filter, 'esc_url'           );
-        add_filter( $filter, 'wp_kses_data'    );
+        if ( is_admin() || is_network_admin() )
+                add_filter( $filter, 'wp_kses_data'    );
 }
 
 // Slugs