Changeset 38092

Timestamp:

07/18/2016 02:03:04 PM (7 years ago)

Author:

ocean90

Message:

Comments: Use wp_strip_all_tags() to strip HTML tags.

wp_kses() should only be used if you have a whitelist.

Props rachelbaker.
Fixes #37208.

File:

• trunk/src/wp-includes/comment.php (modified) (1 diff)

trunk/src/wp-includes/comment.php

@@ -1058 +1058 @@
 
     // Ensure HTML tags are not being used to bypass the blacklist.
-    $comment_without_html = wp_kses( $comment, array() );
+    $comment_without_html = wp_strip_all_tags( $comment );
 
     $words = explode("\n", $mod_keys );