WordPress.org

Make WordPress Core

Changeset 21082


Ignore:
Timestamp:
06/15/12 16:53:15 (3 years ago)
Author:
nacin
Message:

Don't allow unfiltered HTML comments from a frame. fixes #20812 for the 3.3 branch.

Location:
branches/3.3/wp-includes
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/3.3/wp-includes/comment-template.php

    r19284 r21082  
    817817        $post_id = $post->ID; 
    818818 
    819     if ( current_user_can('unfiltered_html') ) 
    820         wp_nonce_field('unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment', false); 
     819    if ( current_user_can( 'unfiltered_html' ) ) { 
     820        wp_nonce_field( 'unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment_disabled', false ); 
     821        echo "<script>(function(){if(window===window.parent){document.getElementById('_wp_unfiltered_html_comment_disabled').name='_wp_unfiltered_html_comment';}})();</script>\n"; 
     822    } 
    821823} 
    822824 
  • branches/3.3/wp-includes/kses.php

    r20541 r21082  
    13161316 */ 
    13171317function kses_init_filters() { 
    1318     // Normal filtering. 
    1319     add_filter('pre_comment_content', 'wp_filter_kses'); 
     1318    // Normal filtering 
    13201319    add_filter('title_save_pre', 'wp_filter_kses'); 
     1320 
     1321    // Comment filtering 
     1322    if ( current_user_can( 'unfiltered_html' ) ) 
     1323        add_filter( 'pre_comment_content', 'wp_filter_post_kses' ); 
     1324    else 
     1325        add_filter( 'pre_comment_content', 'wp_filter_kses' ); 
    13211326 
    13221327    // Post filtering 
     
    13391344 */ 
    13401345function kses_remove_filters() { 
    1341     // Normal filtering. 
    1342     remove_filter('pre_comment_content', 'wp_filter_kses'); 
     1346    // Normal filtering 
    13431347    remove_filter('title_save_pre', 'wp_filter_kses'); 
     1348 
     1349    // Comment filtering 
     1350    remove_filter( 'pre_comment_content', 'wp_filter_post_kses' ); 
     1351    remove_filter( 'pre_comment_content', 'wp_filter_kses' ); 
    13441352 
    13451353    // Post filtering 
Note: See TracChangeset for help on using the changeset viewer.