Changeset 17421 for branches/3.0/wp-includes/default-filters.php

Timestamp:

02/08/2011 08:15:53 PM (14 years ago)

Author:

nacin

Message:

Only run kses on comment_text in the admin. Use wp_kses_post instead of wp_kses_data for a better balance between security and flexibility. fixes #16489 for the 3.0 branch.

File:

• branches/3.0/wp-includes/default-filters.php (modified) (1 diff)

branches/3.0/wp-includes/default-filters.php

@@ -33 +33 @@
 
 // Kses only for textarea admin displays
-foreach ( array( 'term_description', 'link_description', 'link_notes', 'user_description', 'comment_text' ) as $filter ) {
+foreach ( array( 'term_description', 'link_description', 'link_notes', 'user_description' ) as $filter ) {
     add_filter( $filter, 'wp_kses_data' );
 }
+if ( is_admin() )
+    add_filter( 'comment_text', 'wp_kses_post' );
 
 // Email saves