Ticket #24301: 24301.6.diff

wp-admin/includes/post-formats.php

@@ -33 +33 @@
                                         } elseif ( ! preg_match( '#<[^>]+>#', $value ) ) {
                                                 printf( '<img src="%s" alt="" />', esc_url( $value ) );
                                         } else {
-                                                echo $value;
+                                                echo force_balance_tags( strip_tags( $value, '<a><img>' ) );
                                         }
                                 ?>
                         </div>
@@ -90 +90 @@
                                                 $video = wp_get_attachment_url( $value );
                                                 echo do_shortcode( sprintf( '[video src="%s"]', $video ) );
                                         } elseif ( preg_match( '/' . get_shortcode_regex() . '/s', $value ) ) {
-                                                echo do_shortcode( $value );
+                                                echo do_shortcode( strip_tags( $value ) );
                                         } elseif ( ! preg_match( '#<[^>]+>#', $value ) ) {
                                                 if ( strstr( $value, home_url() ) )
                                                         echo do_shortcode( sprintf( '[video src="%s"]', $value ) );
                                                 else
                                                         echo $wp_embed->autoembed( $value );
                                         } else {
-                                                echo $value;
+                                                echo force_balance_tags( strip_tags( $value, '<video><source><a><object><param><embed><iframe>' ) );
                                         }
                                 ?>
                         </div>
@@ -128 +128 @@
                                                 $audio = wp_get_attachment_url( $value );
                                                 echo do_shortcode( sprintf( '[audio src="%s"]', $audio ) );
                                         } elseif ( preg_match( '/' . get_shortcode_regex() . '/s', $value ) ) {
-                                                echo do_shortcode( $value );
+                                                echo do_shortcode( strip_tags( $value ) );
                                         } elseif ( ! preg_match( '#<[^>]+>#', $value ) ) {
                                                 if ( strstr( $value, home_url() ) )
                                                         echo do_shortcode( sprintf( '[audio src="%s"]', $value ) );
                                                 else
                                                         echo $wp_embed->autoembed( $value );
                                         } else {
-                                                echo $value;
+                                                echo force_balance_tags( strip_tags( $value, '<audio><source><a><object><param><embed><iframe>' ) );
                                         }
                                 ?>
                         </div>