Ticket #16788: 16788.diff

wp-includes/kses.php

@@ -484 +484 @@
                 $allowed_protocols = wp_allowed_protocols();
         $string = wp_kses_no_null($string);
         $string = wp_kses_js_entities($string);
-        $string = wp_kses_normalize_entities($string);
+        $string = wp_kses_normalize_entities($string, $allowed_html);
         $string = wp_kses_hook($string, $allowed_html, $allowed_protocols); // WP changed the order of these funcs and added args to wp_kses_hook
         return wp_kses_split($string, $allowed_html, $allowed_protocols);
 }
@@ -1141 +1141 @@
  * @param string $string Content to normalize entities
  * @return string Content with normalized entities
  */
-function wp_kses_normalize_entities($string) {
-        # Disarm all entities by converting & to &
+function wp_kses_normalize_entities($string, $allowed_html = '') {
+        // Don't convert & to & in emails
+        if ( 'pre_user_email' !== $allowed_html ) {
+                # Disarm all entities by converting & to &
+                $string = str_replace('&', '&', $string);
+        }
 
-        $string = str_replace('&', '&', $string);
-
         # Change back the allowed entities in our entity whitelist
 
         $string = preg_replace_callback('/&([A-Za-z]{2,8}[0-9]{0,2});/', 'wp_kses_named_entities', $string);