Ticket #28564: miqro-28564.patch

src/wp-includes/formatting.php

@@ -203 +203 @@
                 . '|'
                 .       '\['            // Find start of shortcode.
                 .       '\[?'           // Shortcodes may begin with [[
-                .       '[^\[\]<>]+'    // Shortcodes do not contain other shortcodes or HTML elements.
+                .       '[^\[\]]+'      // Shortcodes do not contain other shortcodes.  HTML recursion is permitted, but not texturized.
                 .       '\]'            // Find end of shortcode.
                 .       '\]?'           // Shortcodes may end with ]]
                 . ')/s';
@@ -220 +220 @@
                                 _wptexturize_pushpop_element( $curl, $no_texturize_tags_stack, $no_texturize_tags, '<', '>' );
                         }
 
-                } elseif ( '[' === $first && 1 === preg_match( '/^\[[^\[\]<>]+\]$/', $curl ) ) {
+                } elseif ( '[' === $first && 1 === preg_match( '/^\[[^\[\]]+\]$/', $curl ) ) {
                         // This is a shortcode delimeter.
 
                         _wptexturize_pushpop_element( $curl, $no_texturize_shortcodes_stack, $no_texturize_shortcodes, '[', ']' );
 
-                } elseif ( '[' === $first && 1 === preg_match( '/^\[\[?[^\[\]<>]+\]\]?$/', $curl ) ) {
+                } elseif ( '[' === $first && 1 === preg_match( '/^\[\[?[^\[\]]+\]\]?$/', $curl ) ) {
                         // This is an escaped shortcode delimeter.
 
                         // Do not texturize.

tests/phpunit/tests/formatting/WPTexturize.php

@@ -1186 +1186 @@
                                 '[code]...[/code]]...', // This test would not pass in 3.9 because the extra brace was always ignored by texturize.
                         ),
                         array(
+                                '[gal>ery ...]', // This is a potentially usable shortcode.
                                 '[gal>ery ...]',
-                                '[gal>ery …]',
                         ),
                         array(
                                 '[gallery ...',
@@ -1194 +1194 @@
                                 '[gallery …',
                         ),
                         array(
+                                '[gallery <br ... /> ...]', // This tag is still valid. Shortcode 'attributes' are not considered in the initial parsing of shortcodes, and HTML is allowed.
                                 '[gallery <br ... /> ...]',
-                                '[gallery <br ... /> &#8230;]',
                         ),
                         array(
                                 '<br [gallery ...] ... />',
@@ -1234 +1234 @@
                                 '[/gallery ...]]',
                         ),
                         array(
+                                '[[gallery <br ... /> ...]]', // This gets parsed as an escaped shortcode with embedded HTML.  Brains may explode.
                                 '[[gallery <br ... /> ...]]',
-                                '[[gallery <br ... /> &#8230;]]',
                         ),
                         array(
                                 '<br [[gallery ...]] ... />',