Changeset 35341

Timestamp:

10/21/2015 08:37:54 PM (9 years ago)

Author:

azaozz

Message:

TinyMCE:

• Sanitize and render HTML in captions when showing a gallery preview (wpView).
• Encode/escape HTML entered in the text field in the wpLink dialog.

Props iseulde, kraftbj, jnylen0, shawarkhan.
Fixes #32616.

Location:

trunk/src/wp-includes

Files:

• js/mce-view.js (modified) (2 diffs)
• js/wplink.js (modified) (1 diff)
• media-template.php (modified) (1 diff)

trunk/src/wp-includes/js/mce-view.js

@@ -733 +733 @@
  */
 ( function( window, views, media, $ ) {
-    var base, gallery, av, embed;
+    var base, gallery, av, embed,
+        schema, parser, serializer;
+
+    function verifyHTML( string ) {
+        var settings = {};
+
+        if ( ! window.tinymce ) {
+            return string.replace( /<[^>]+>/g, '' );
+        }
+
+        if ( ! string || ( string.indexOf( '<' ) === -1 && string.indexOf( '>' ) === -1 ) ) {
+            return string;
+        }
+
+        schema = schema || new window.tinymce.html.Schema( settings );
+        parser = parser || new window.tinymce.html.DomParser( settings, schema );
+        serializer = serializer || new window.tinymce.html.Serializer( settings, schema );
+
+        return serializer.serialize( parser.parse( string, { forced_root_block: false } ) );
+    }
 
     base = {
@@ -784 +803 @@
 
                 self.render( self.template( {
+                    verifyHTML: verifyHTML,
                     attachments: attachments,
                     columns: attrs.columns ? parseInt( attrs.columns, 10 ) : media.galleryDefaults.columns

trunk/src/wp-includes/js/wplink.js

@@ -383 +383 @@
             } else {
                 if ( text ) {
-                    editor.selection.setNode( editor.dom.create( 'a', attrs, text ) );
+                    editor.selection.setNode( editor.dom.create( 'a', attrs, editor.dom.encode( text ) ) );
                 } else {
                     editor.execCommand( 'mceInsertLink', false, attrs );

trunk/src/wp-includes/media-template.php

@@ -1217 +1217 @@
                         <# if ( attachment.caption ) { #>
                             <dd class="wp-caption-text gallery-caption">
-                                {{ attachment.caption }}
+                                {{{ data.verifyHTML( attachment.caption ) }}}
                             </dd>
                         <# } #>