WordPress.org

Make WordPress Core

Changeset 20974


Ignore:
Timestamp:
06/01/2012 08:47:08 PM (6 years ago)
Author:
ryan
Message:

Don't allow unfiltered HTML comments from a frame. Props nacin. fixes #20812

Location:
trunk/wp-includes
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-includes/comment-template.php

    r20641 r20974  
    817817        $post_id = $post->ID;
    818818
    819     if ( current_user_can('unfiltered_html') )
    820         wp_nonce_field('unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment', false);
     819    if ( current_user_can( 'unfiltered_html' ) ) {
     820        wp_nonce_field( 'unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment_disabled', false );
     821        echo "<script>(function(){if(window===window.parent){document.getElementById('_wp_unfiltered_html_comment_disabled').name='_wp_unfiltered_html_comment';}})();</script>\n";
     822    }
    821823}
    822824
  • trunk/wp-includes/kses.php

    r20540 r20974  
    13641364 */
    13651365function kses_init_filters() {
    1366     // Normal filtering.
    1367     add_filter('pre_comment_content', 'wp_filter_kses');
     1366    // Normal filtering
    13681367    add_filter('title_save_pre', 'wp_filter_kses');
     1368
     1369    // Comment filtering
     1370    if ( current_user_can( 'unfiltered_html' ) )
     1371        add_filter( 'pre_comment_content', 'wp_filter_post_kses' );
     1372    else
     1373        add_filter( 'pre_comment_content', 'wp_filter_kses' );
    13691374
    13701375    // Post filtering
     
    13871392 */
    13881393function kses_remove_filters() {
    1389     // Normal filtering.
    1390     remove_filter('pre_comment_content', 'wp_filter_kses');
     1394    // Normal filtering
    13911395    remove_filter('title_save_pre', 'wp_filter_kses');
     1396
     1397    // Comment filtering
     1398    remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
     1399    remove_filter( 'pre_comment_content', 'wp_filter_kses' );
    13921400
    13931401    // Post filtering
Note: See TracChangeset for help on using the changeset viewer.