Changeset 42261 for trunk

Timestamp:

11/29/2017 03:59:41 PM (7 years ago)

Author:

johnbillion

Message:

Hardening: Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.

File:

• trunk/src/wp-includes/functions.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -2566 +2566 @@
         $unfiltered = $user ? user_can( $user, 'unfiltered_html' ) : current_user_can( 'unfiltered_html' );
 
-    if ( empty( $unfiltered ) )
-        unset( $t['htm|html'] );
+    if ( empty( $unfiltered ) ) {
+        unset( $t['htm|html'], $t['js'] );
+    }
 
     /**