Ticket #41304: fix_41304_patch.diff

wp-includes/kses.php

@@ -1321 +1321 @@
  * @return string Sanitized content
  */
 function wp_kses_bad_protocol_once($string, $allowed_protocols, $count = 1 ) {
-        $string2 = preg_split( '/:|&#0*58;|&#x0*3a;/i', $string, 2 );
+    $string2 = preg_split( '/(:\/\/)|&#0*58;|&#x0*3a;/i', $string, 2 );
         if ( isset($string2[1]) && ! preg_match('%/\?%', $string2[0]) ) {
                 $string = trim( $string2[1] );
                 $protocol = wp_kses_bad_protocol_once2( $string2[0], $allowed_protocols );
@@ -1332 +1332 @@
                         if ( empty( $string ) )
                                 return $string;
                 }
-                $string = $protocol . $string;
+        $string = $protocol . '//' . $string;
         }
 
         return $string;