Changeset 35788

Timestamp:

12/06/2015 08:28:26 PM (9 years ago)

Author:

kovshenin

Message:

Allow usage of angle brackets in a site title or tagline.

The whole string is escaped with esc_html() anyway, so we don't
need to wp_kses_post(). This is a better experience for users who
want to use angle brackets in their site title or description.
Does not allow any HTML, adds unit tests.

props BandonRandon, pauldewouters.
fixes #27942.

Location:

trunk

Files:

• src/wp-includes/formatting.php (modified) (1 diff)
• tests/phpunit/tests/formatting/BlogInfo.php (modified) (1 diff)

trunk/src/wp-includes/formatting.php

@@ -3707 +3707 @@
                 $error = $value->get_error_message();
             } else {
-                $value = wp_kses_post( $value );
                 $value = esc_html( $value );
             }

trunk/tests/phpunit/tests/formatting/BlogInfo.php

@@ -32 +32 @@
         );
     }
+
+    /**
+     * @ticket 27942
+     */
+    function test_bloginfo_sanitize_option() {
+        $old_values = array(
+            'blogname'        => get_option( 'blogname' ),
+            'blogdescription' => get_option( 'blogdescription' ),
+        );
+
+        $values = array(
+            'foo'                  => 'foo',
+            '<em>foo</em>'         => '&lt;em&gt;foo&lt;/em&gt;',
+            '<script>foo</script>' => '&lt;script&gt;foo&lt;/script&gt;',
+            '&lt;foo&gt;'          => '&lt;foo&gt;',
+            '<foo'                 => '&lt;foo',
+        );
+
+        foreach ( $values as $value => $expected ) {
+            $sanitized_value = sanitize_option( 'blogname', $value );
+            update_option( 'blogname', $sanitized_value );
+
+            $this->assertEquals( $expected, $sanitized_value );
+            $this->assertEquals( $expected, get_bloginfo( 'name' ) );
+            $this->assertEquals( $expected, get_bloginfo( 'name', 'display' ) );
+
+            $sanitized_value = sanitize_option( 'blogdescription', $value );
+            update_option( 'blogdescription', $sanitized_value );
+
+            $this->assertEquals( $expected, $sanitized_value );
+            $this->assertEquals( $expected, get_bloginfo( 'description' ) );
+            $this->assertEquals( $expected, get_bloginfo( 'description', 'display' ) );
+        }
+
+        // Restore old values.
+        foreach ( $old_values as $option_name => $value ) {
+            update_option( $option_name, $value );
+        }
+    }
 }