Changeset 12125

Timestamp:

10/29/2009 05:15:58 PM (15 years ago)

Author:

ryan

Message:

Introduce wp_kses_post() and wp_kses_data() for filtering unescaped data. Fixes slashing of displayed fields. fixes #10949

Location:

trunk/wp-includes

Files:

• default-filters.php (modified) (1 diff)
• kses.php (modified) (4 diffs)

trunk/wp-includes/default-filters.php

@@ -27 +27 @@
 }
 
-// Kses only for textarea saves and displays
-foreach ( array( 'pre_term_description', 'term_description', 'pre_link_description', 'link_description', 'pre_link_notes', 'link_notes', 'pre_user_description', 'user_description' ) as $filter ) {
+// Kses only for textarea saves
+foreach ( array( 'pre_term_description', 'pre_link_description', 'pre_link_notes', 'pre_user_description' ) as $filter ) {
     add_filter( $filter, 'wp_filter_kses' );
+}
+
+// Kses only for textarea saves displays
+foreach ( array( 'term_description', 'link_description', 'link_notes', 'user_description' ) as $filter ) {
+    add_filter( $filter, 'wp_kses_data' );
 }
 

trunk/wp-includes/kses.php

@@ -1060 +1060 @@
  * @uses $allowedtags
  *
- * @param string $data Content to filter
+ * @param string $data Content to filter, expected to be escaped with slashes
  * @return string Filtered content
  */
@@ -1069 +1069 @@
 
 /**
+ * Sanitize content with allowed HTML Kses rules.
+ *
+ * @since 2.9.0
+ * @uses $allowedtags
+ *
+ * @param string $data Content to filter, expected to not be escaped
+ * @return string Filtered content
+ */
+function wp_kses_data($data) {
+    global $allowedtags;
+    return wp_kses( $data , $allowedtags );
+}
+
+/**
  * Sanitize content for allowed HTML tags for post content.
  *
@@ -1077 +1091 @@
  * @uses $allowedposttags
  *
- * @param string $data Post content to filter
+ * @param string $data Post content to filter, expected to be escaped with slashes
  * @return string Filtered post content with allowed HTML tags and attributes intact.
  */
@@ -1083 +1097 @@
     global $allowedposttags;
     return addslashes ( wp_kses(stripslashes( $data ), $allowedposttags) );
+}
+
+/**
+ * Sanitize content for allowed HTML tags for post content.
+ *
+ * Post content refers to the page contents of the 'post' type and not $_POST
+ * data from forms.
+ *
+ * @since 2.9.0
+ * @uses $allowedposttags
+ *
+ * @param string $data Post content to filter
+ * @return string Filtered post content with allowed HTML tags and attributes intact.
+ */
+function wp_kses_post($data) {
+    global $allowedposttags;
+    return wp_kses( $data , $allowedposttags );
 }