Changeset 21082 for branches/3.3/wp-includes/comment-template.php

Timestamp:

06/15/2012 04:53:15 PM (14 years ago)

Author:

nacin

Message:

Don't allow unfiltered HTML comments from a frame. fixes #20812 for the 3.3 branch.

File:

• branches/3.3/wp-includes/comment-template.php (modified) (1 diff)

branches/3.3/wp-includes/comment-template.php

@@ -817 +817 @@
         $post_id = $post->ID;
 
-    if ( current_user_can('unfiltered_html') )
-        wp_nonce_field('unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment', false);
+    if ( current_user_can( 'unfiltered_html' ) ) {
+        wp_nonce_field( 'unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment_disabled', false );
+        echo "<script>(function(){if(window===window.parent){document.getElementById('_wp_unfiltered_html_comment_disabled').name='_wp_unfiltered_html_comment';}})();</script>\n";
+    }
 }