Changeset 35341

Timestamp:

10/21/2015 08:37:54 PM (11 years ago)

Author:

azaozz

Message:

TinyMCE:

• Sanitize and render HTML in captions when showing a gallery preview (wpView).
• Encode/escape HTML entered in the text field in the wpLink dialog.

Props iseulde, kraftbj, jnylen0, shawarkhan.
Fixes #32616.

Location:

trunk/src/wp-includes

Files:

• js/mce-view.js (modified) (2 diffs)
• js/wplink.js (modified) (1 diff)
• media-template.php (modified) (1 diff)

trunk/src/wp-includes/js/mce-view.js

@@ -733 +733 @@
  */
 ( function( window, views, media, $ ) {
-        var base, gallery, av, embed;
+        var base, gallery, av, embed,
+                schema, parser, serializer;
+
+        function verifyHTML( string ) {
+                var settings = {};
+
+                if ( ! window.tinymce ) {
+                        return string.replace( /<[^>]+>/g, '' );
+                }
+
+                if ( ! string || ( string.indexOf( '<' ) === -1 && string.indexOf( '>' ) === -1 ) ) {
+                        return string;
+                }
+
+                schema = schema || new window.tinymce.html.Schema( settings );
+                parser = parser || new window.tinymce.html.DomParser( settings, schema );
+                serializer = serializer || new window.tinymce.html.Serializer( settings, schema );
+
+                return serializer.serialize( parser.parse( string, { forced_root_block: false } ) );
+        }
 
         base = {
@@ -784 +803 @@
 
                                 self.render( self.template( {
+                                        verifyHTML: verifyHTML,
                                         attachments: attachments,
                                         columns: attrs.columns ? parseInt( attrs.columns, 10 ) : media.galleryDefaults.columns

trunk/src/wp-includes/js/wplink.js

@@ -383 +383 @@
                         } else {
                                 if ( text ) {
-                                        editor.selection.setNode( editor.dom.create( 'a', attrs, text ) );
+                                        editor.selection.setNode( editor.dom.create( 'a', attrs, editor.dom.encode( text ) ) );
                                 } else {
                                         editor.execCommand( 'mceInsertLink', false, attrs );

trunk/src/wp-includes/media-template.php

@@ -1217 +1217 @@
                                                 <# if ( attachment.caption ) { #>
                                                         <dd class="wp-caption-text gallery-caption">
-                                                                {{ attachment.caption }}
+                                                                {{{ data.verifyHTML( attachment.caption ) }}}
                                                         </dd>
                                                 <# } #>