Ticket #18311: 18311.patch

wp-includes/media.php

@@ -737 +737 @@
                 'caption' => ''
         ), $attr));
 
+        // Restore the original HTML
+        $_caption = html_entity_decode($caption);
+        
+        // Only allow a subset of tags
+        $allowed_tags = array('strong', 'em', 'a');
+        
+        // Set those tags aside
+        if ( preg_match_all('/<\/?([a-zA-Z]+).*?>/x', $_caption, $matches) ) {
+                $i = 0;
+                $searches = array();
+                $replacements = array(); 
+                foreach ( $matches[0] as $k => $v ) {
+                        if (in_array($matches[1][$k], $allowed_tags) ) {
+                                $_caption = str_replace($v, 'tag-' . $i, $_caption);
+                                $searches[] = 'tag-' . $i++;
+                                $replacements[] = $v;
+                        }
+                }
+                
+                // Re-encode the caption
+                $_caption = htmlentities($_caption);
+
+                // Restore the allowed HTML
+                $caption = str_replace($searches, $replacements, $_caption);
+        }
+
         if ( 1 > (int) $width || empty($caption) )
                 return $content;