Changeset 25137 for trunk/src/wp-comments-post.php

Timestamp:

08/27/2013 01:56:17 PM (11 years ago)

Author:

duck_

Message:

Initialize kses filters if _wp_unfiltered_html_comment nonce isn't set.

See #24752.

File:

• trunk/src/wp-comments-post.php (modified) (1 diff)

trunk/src/wp-comments-post.php

@@ -61 +61 @@
     $comment_author_email = wp_slash( $user->user_email );
     $comment_author_url   = wp_slash( $user->user_url );
-    if ( current_user_can( 'unfiltered_html' ) && isset( $_POST['_wp_unfiltered_html_comment'] ) ) {
-        if ( wp_create_nonce( 'unfiltered-html-comment_' . $comment_post_ID ) != $_POST['_wp_unfiltered_html_comment'] ) {
+    if ( current_user_can( 'unfiltered_html' ) ) {
+        if ( ! isset( $_POST['_wp_unfiltered_html_comment'] )
+            || ! wp_verify_nonce( $_POST['_wp_unfiltered_html_comment'], 'unfiltered-html-comment_' . $comment_post_ID )
+        ) {
             kses_remove_filters(); // start with a clean slate
             kses_init_filters(); // set up the filters