WordPress.org

Make WordPress Core

Changeset 21082


Ignore:
Timestamp:
06/15/2012 04:53:15 PM (6 years ago)
Author:
nacin
Message:

Don't allow unfiltered HTML comments from a frame. fixes #20812 for the 3.3 branch.

Location:
branches/3.3/wp-includes
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/3.3/wp-includes/comment-template.php

    r19284 r21082  
    817817        $post_id = $post->ID;
    818818
    819     if ( current_user_can('unfiltered_html') )
    820         wp_nonce_field('unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment', false);
     819    if ( current_user_can( 'unfiltered_html' ) ) {
     820        wp_nonce_field( 'unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment_disabled', false );
     821        echo "<script>(function(){if(window===window.parent){document.getElementById('_wp_unfiltered_html_comment_disabled').name='_wp_unfiltered_html_comment';}})();</script>\n";
     822    }
    821823}
    822824
  • branches/3.3/wp-includes/kses.php

    r20541 r21082  
    13161316 */
    13171317function kses_init_filters() {
    1318     // Normal filtering.
    1319     add_filter('pre_comment_content', 'wp_filter_kses');
     1318    // Normal filtering
    13201319    add_filter('title_save_pre', 'wp_filter_kses');
     1320
     1321    // Comment filtering
     1322    if ( current_user_can( 'unfiltered_html' ) )
     1323        add_filter( 'pre_comment_content', 'wp_filter_post_kses' );
     1324    else
     1325        add_filter( 'pre_comment_content', 'wp_filter_kses' );
    13211326
    13221327    // Post filtering
     
    13391344 */
    13401345function kses_remove_filters() {
    1341     // Normal filtering.
    1342     remove_filter('pre_comment_content', 'wp_filter_kses');
     1346    // Normal filtering
    13431347    remove_filter('title_save_pre', 'wp_filter_kses');
     1348
     1349    // Comment filtering
     1350    remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
     1351    remove_filter( 'pre_comment_content', 'wp_filter_kses' );
    13441352
    13451353    // Post filtering
Note: See TracChangeset for help on using the changeset viewer.