Changeset 20974 for trunk/wp-includes/kses.php

Timestamp:

06/01/2012 08:47:08 PM (14 years ago)

Author:

ryan

Message:

Don't allow unfiltered HTML comments from a frame. Props nacin. fixes #20812

File:

• trunk/wp-includes/kses.php (modified) (2 diffs)

trunk/wp-includes/kses.php

@@ -1364 +1364 @@
  */
 function kses_init_filters() {
-    // Normal filtering.
-    add_filter('pre_comment_content', 'wp_filter_kses');
+    // Normal filtering
     add_filter('title_save_pre', 'wp_filter_kses');
+
+    // Comment filtering
+    if ( current_user_can( 'unfiltered_html' ) )
+        add_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+    else
+        add_filter( 'pre_comment_content', 'wp_filter_kses' );
 
     // Post filtering
@@ -1387 +1392 @@
  */
 function kses_remove_filters() {
-    // Normal filtering.
-    remove_filter('pre_comment_content', 'wp_filter_kses');
+    // Normal filtering
     remove_filter('title_save_pre', 'wp_filter_kses');
+
+    // Comment filtering
+    remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+    remove_filter( 'pre_comment_content', 'wp_filter_kses' );
 
     // Post filtering