WordPress.org

Make WordPress Core

Changeset 20974


Ignore:
Timestamp:
06/01/12 20:47:08 (23 months ago)
Author:
ryan
Message:

Don't allow unfiltered HTML comments from a frame. Props nacin. fixes #20812

Location:
trunk/wp-includes
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-includes/comment-template.php

    r20641 r20974  
    817817        $post_id = $post->ID; 
    818818 
    819     if ( current_user_can('unfiltered_html') ) 
    820         wp_nonce_field('unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment', false); 
     819    if ( current_user_can( 'unfiltered_html' ) ) { 
     820        wp_nonce_field( 'unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment_disabled', false ); 
     821        echo "<script>(function(){if(window===window.parent){document.getElementById('_wp_unfiltered_html_comment_disabled').name='_wp_unfiltered_html_comment';}})();</script>\n"; 
     822    } 
    821823} 
    822824 
  • trunk/wp-includes/kses.php

    r20540 r20974  
    13641364 */ 
    13651365function kses_init_filters() { 
    1366     // Normal filtering. 
    1367     add_filter('pre_comment_content', 'wp_filter_kses'); 
     1366    // Normal filtering 
    13681367    add_filter('title_save_pre', 'wp_filter_kses'); 
     1368 
     1369    // Comment filtering 
     1370    if ( current_user_can( 'unfiltered_html' ) ) 
     1371        add_filter( 'pre_comment_content', 'wp_filter_post_kses' ); 
     1372    else 
     1373        add_filter( 'pre_comment_content', 'wp_filter_kses' ); 
    13691374 
    13701375    // Post filtering 
     
    13871392 */ 
    13881393function kses_remove_filters() { 
    1389     // Normal filtering. 
    1390     remove_filter('pre_comment_content', 'wp_filter_kses'); 
     1394    // Normal filtering 
    13911395    remove_filter('title_save_pre', 'wp_filter_kses'); 
     1396 
     1397    // Comment filtering 
     1398    remove_filter( 'pre_comment_content', 'wp_filter_post_kses' ); 
     1399    remove_filter( 'pre_comment_content', 'wp_filter_kses' ); 
    13921400 
    13931401    // Post filtering 
Note: See TracChangeset for help on using the changeset viewer.