Make WordPress Core


Ignore:
Timestamp:
06/01/2012 08:47:08 PM (13 years ago)
Author:
ryan
Message:

Don't allow unfiltered HTML comments from a frame. Props nacin. fixes #20812

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-includes/comment-template.php

    r20641 r20974  
    817817        $post_id = $post->ID;
    818818
    819     if ( current_user_can('unfiltered_html') )
    820         wp_nonce_field('unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment', false);
     819    if ( current_user_can( 'unfiltered_html' ) ) {
     820        wp_nonce_field( 'unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment_disabled', false );
     821        echo "<script>(function(){if(window===window.parent){document.getElementById('_wp_unfiltered_html_comment_disabled').name='_wp_unfiltered_html_comment';}})();</script>\n";
     822    }
    821823}
    822824
Note: See TracChangeset for help on using the changeset viewer.