Ticket #40575: 40575.patch

src/wp-includes/kses.php

@@ -549 +549 @@
         $allowed_html = wp_kses_allowed_html( 'post' );
         $allowed_protocols = wp_allowed_protocols();
         $string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
-        
+
         // Preserve leading and trailing whitespace.
         $matches = array();
         preg_match('/^\s*/', $string, $matches);
@@ -561 +561 @@
         } else {
                 $string = substr( $string, strlen( $lead ), -strlen( $trail ) );
         }
-        
+
         // Parse attribute name and value from input.
         $split = preg_split( '/\s*=\s*/', $string, 2 );
         $name = $split[0];
@@ -598 +598 @@
                 $value = '';
                 $vless = 'y';
         }
-        
+
         // Sanitize attribute by name.
         wp_kses_attr_check( $name, $value, $string, $vless, $element, $allowed_html );
 
@@ -633 +633 @@
                  * @param string $context Context to judge allowed tags by. Allowed values are 'post',
                  *                        'data', 'strip', 'entities', 'explicit', or the name of a filter.
                  */
-                return apply_filters( 'wp_kses_allowed_html', $context, 'explicit' );
+                return apply_filters( 'wp_kses_allowed_html', $tags, 'explicit' );
         }
 
         switch ( $context ) {
@@ -1061 +1061 @@
         } else {
                 $xhtml_slash = '';
         }
-        
+
         // Split it
         $attrarr = wp_kses_hair_parse( $attr );
         if ( false === $attrarr ) {
@@ -1071 +1071 @@
         // Make sure all input is returned by adding front and back matter.
         array_unshift( $attrarr, $begin . $slash . $elname );
         array_push( $attrarr, $xhtml_slash . $end );
-        
+
         return $attrarr;
 }