Make WordPress Core


Ignore:
Timestamp:
06/01/2012 08:47:08 PM (12 years ago)
Author:
ryan
Message:

Don't allow unfiltered HTML comments from a frame. Props nacin. fixes #20812

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-includes/kses.php

    r20540 r20974  
    13641364 */
    13651365function kses_init_filters() {
    1366     // Normal filtering.
    1367     add_filter('pre_comment_content', 'wp_filter_kses');
     1366    // Normal filtering
    13681367    add_filter('title_save_pre', 'wp_filter_kses');
     1368
     1369    // Comment filtering
     1370    if ( current_user_can( 'unfiltered_html' ) )
     1371        add_filter( 'pre_comment_content', 'wp_filter_post_kses' );
     1372    else
     1373        add_filter( 'pre_comment_content', 'wp_filter_kses' );
    13691374
    13701375    // Post filtering
     
    13871392 */
    13881393function kses_remove_filters() {
    1389     // Normal filtering.
    1390     remove_filter('pre_comment_content', 'wp_filter_kses');
     1394    // Normal filtering
    13911395    remove_filter('title_save_pre', 'wp_filter_kses');
     1396
     1397    // Comment filtering
     1398    remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
     1399    remove_filter( 'pre_comment_content', 'wp_filter_kses' );
    13921400
    13931401    // Post filtering
Note: See TracChangeset for help on using the changeset viewer.